When looking at the number of CVEs you'll also have to take the amount of code written in that language into account, a language which has no users also has no CVEs ;)

I bet there's easily tens of thousands of times more C++ code than Rust code out there.