CVE
9 articles with this tag
Deciding What to Patch First — CVSS, EPSS and KEV, and What Each Is For
CVSS is severity, EPSS is probability of exploitation, KEV is confirmed exploitation. They are not substitutes. Our own data across all 1,695 KEV entries: 64% score below CVSS 9 and 24% sit below EPSS 0.1 — so both 'patch the high scores' and 'ignore the low EPSS' fail in practice. Order by KEV, then EPSS, then CVSS, and set the deadline from your own exposure.
Do Next.js and React Have a Lot of Vulnerabilities? What the CVE Data Actually Shows
The data says React core is almost untouched while Next.js CVEs are numerous and rising — but the substance is what matters: they land in middleware, caching, image optimization and Server Actions, with SSRF, deserialization and authorization bypass leading the CWEs. This site's conclusion is that treating Next.js as a front-end framework is the actual mistake. It is a server, so defend it like one: authorize again at the data, allow-list outbound fetches, and put Server Action endpoints behind auth.
Installing and using osv-scanner: find CVEs in your dependencies
osv-scanner scans lockfiles and containers to surface CVEs in your dependencies, free. This walks through install, run, and CI integration, plus when to use it vs npm/pnpm audit vs Dependabot. This site's view: the right tool is decided by YOUR setup — reach for osv-scanner on multi-ecosystem or GitHub-free projects, and the bundled pnpm audit for a single npm tree.
Fixing dependency CVEs for real: scan, fix, isolate, and keep watching
Vulnerability work isn't done when you 'fix it.' Done = 1) scan, 2) fix, 3) isolate/hand off, 4) monitor. Until monitoring (daily change-detection) is in place, it's incomplete — dependencies turn vulnerable again tomorrow. A perfect fix that the next deploy overwrites is worth zero. Small teams stay safe with two disciplines: automated change-detection and 'local→push→deploy.'
Log4Shell (CVE-2021-44228) — the night the world feared a bug it couldn't even confirm it had
Log4j's CVSS 10.0 bug. The real fear was the transitive dependency — being affected through a library you didn't know you used. A passive logging path became an attack vector. SBOM, machine-monitoring, fast patching, and following the follow-up CVEs are the lessons.
What is RCE (Remote Code Execution) — why it's the worst class of bug
RCE lets an attacker run arbitrary code on your server — straight to takeover, the worst class. The blast radius is set by the running process's privileges. The core defenses are fast patching, CVE monitoring, and least privilege.
What is a CVE — the shared 'jersey number' for vulnerabilities
A CVE is a globally shared ID for a vulnerability (e.g. CVE-2025-12345). CVE = the name, CVSS = severity, KEV = is it exploited. It's the anchor for monitoring. Track it with machines, not by hand.
Equifax breach (2017) — how an unpatched Apache Struts flaw leaked 147M people
The cause was a known, already-patched CVE (CVSS 10.0) left unapplied on a public system. An expired monitoring certificate hid the exfiltration for 76 days. In your environment: asset inventory, a patch SLA, machine monitoring, and healthy detection.
Running Next.js safely: not falling behind on published CVEs
The top framework risk is neglected published CVEs. Defend with four pillars: judge by the running version, monitor with Dependabot/osv-scanner, update fast, and run least-privilege. This site's view: indie devs lose not on knowledge but on operational continuity — win with a system that doesn't miss, not with speed.