Critical vulnerabilities take over 500 days to be fixed.