Not sure if this is common knowledge, but Microsoft publishes the Microsoft Security Bulletin Advance Notification the week before security bulletins are supposed to come out. While it identifies neither specific issues nor bulletins, it does give you a count of issues for Windows. As a rule of thumb, any Critical or Important bulletin applicable to Windows is packaged to XPE, so the Windows count will be the maximum number of issues we push out in our roll ups.
Also, at this point, we are only handle Critical and Imporant security bulletins by default, so the non-security High Priority updates at the bottom of the page don’t get packaged automagically. If you find you need one of these (because you saw it come down Windows Update or saw in on MSDN or TechNet), contact PSS to request it’s inclusion for XPE.