Analysis shows most security risk sits in longtail open source images, with 98% of CVEs outside top projects & Critical flaws fixed in under 20 hours.