The number of vulnerabilities first reported as exploited surged last year amid a decrease in zero-day reports.