What are the implications of an old Android version? There have been various bugs and security flaws found in different versions of Android. Many have been pached in newer versions, but the non-updated devices remain bugged/vulnerable. 

My questions are:


Are all Androids with the same version bugged/vulnerable in the same way, e.g., does a Samsung running 4.0 have the same problems as a Sony running 4.0 or as a Nexus device running 4.0?
Is there an overview somewhere what bugs (and especially which security flaws) are there in which versions? Many devices sold today do not run the newest Android; can I tell before buying which bugs/security problems I might encounter? (I am not interested in missing features introduced by newer versions)


Just to make it clear: bugs that can be solved by updating some apps are not relevant. (They are relevant if the update solving the issue would require a newer Android version).
This question cannot be answered in general. Android is open source and therefore can be modified by the mentioned enterprises. These enterprises will be based on the same "stock | untouched" Android with many of the same bugs and "vulnerabilities".

But:


Nearly all enterprises are modifying Android (interface, core) to match their wishes (e.g. Samsung TouchWiz, Sony XperiaUI, etc.). They are changing they way the software works, causing or eliminating bugs and security problems. So it's possible that some problems are fixed/caused by enterprises themselves. Therefore it's not likely for them to have exactly the same problems.
There is no official list of security flaws available. But there is an official bugtracker: http://code.google.com/p/android/issues/list