It's almost the entire field these days - just trying to get CVEs for the CV.

The days of Metasploit 0-days are over, so now it's just loads of sensationalist reporting and box-ticking regulation in companies.