Red = critical severity bugs; orange = high; blue = medium; and black = low. The X axis is total number of security bugs; the Y axis shows the kernel version. So, the height of the bar shows how long that bug was present.