Is comparing an Ubuntu report to a Debian report an apples-to-apples comparison?

[gordonmessmer]

I'm not sure how to phrase the subject.

If I scan similarly configured Debian 12 and Ubuntu 24.04 systems, I get fewer known CVEs on the Debian system. That might mean that Debian is fixing more vulnerabilities, or it might mean that Canonical is confirming more CVE reports.

Can results be compared between these two, or should readers treat those distributions as products that report vulnerabilities differently and therefore cannot compare results between each other?

[gordonmessmer]

I re-posted this question at google/osv-scanner#3106 but I'm actually not sure which project is the right place for it.

[Ly-Joey]

Closing this as a duplicate, as google/osv-scanner#3106 is more active.