I'm not sure static analysis statistics are very useful, because bugs that
can be found by static analysis will have *been* found to some degree, and
thus preferentially fixed.
The interesting set is that which no static analysis tool can yet detect.
Unfortunately this is also the set that costs a bomb to locate.