Drupal is one of the most secure Web Content Management systems available today and the credit for this goes to the simple fact that there is a dedicated security team that constantly checks the codebase for any vulnerabilities and provides fixes for any vulnerabilities identified.
As per the Drupal Security team, security release "windows" are every Wednesday for Drupal contributed projects, and one Wednesday a month (usually the third Wednesday) for Drupal core.
