I am not tracking closely to be honest since I have not being working with Illumos based distros for 5 years +/-
when we were using omniOS I do not remember things being too bad. Not sure what % of vuln. are Oracle Solaris specific given that majority of orig. SUN eng. left long time ago Illumos might be in much better shape vs Solaris.