CVE
10 articles with this tag
Mathspace Data Breach (About 1.08 Million Students, Parents and Staff): What Parents and Schools Should Do
In a blog post dated September 5, 2026 (updated September 8), maths learning platform Mathspace said attackers exploited a security vulnerability in its self-hosted internal reporting system and downloaded information on students, parents or guardians, school staff and Mathspace staff. 1,079,819 people in Australia and New Zealand were affected. The data includes user ID, username, first and last name, email address, country, time zone, user type, email-verification status, last-active date, last-login date and date joined. The company says passwords (including hashes), authentication tokens, SSO credentials, academic records and results were not exposed. According to Mathspace, the software's developer published a critical advisory and patch on August 6, its own vulnerability-notification process did not escalate it, unauthorised access dated back to August 10, and data was downloaded on August 27. This site's take: this is a roster that includes children's accounts, and it can be used to make fake messages claiming to be from Mathspace or your school look genuine. Families should agree with their children never to sign in from a link or share a code. Operators should treat internal reporting tools, which tend to be patched last, like production systems: patch them just as quickly, and check for signs of compromise after patching.
Deciding What to Patch First — CVSS, EPSS and KEV, and What Each Is For
CVSS is severity, EPSS is probability of exploitation, KEV is confirmed exploitation. They are not substitutes. Our own data across all 1,695 KEV entries: 64% score below CVSS 9 and 24% sit below EPSS 0.1 — so both 'patch the high scores' and 'ignore the low EPSS' fail in practice. Order by KEV, then EPSS, then CVSS, and set the deadline from your own exposure.
Do Next.js and React Have a Lot of Vulnerabilities? What the CVE Data Actually Shows
The data says React core has almost no CVEs while Next.js CVEs are numerous and rising. What matters is where they are: they land in middleware, caching, image optimization and Server Actions, with SSRF, deserialization and authorization bypass leading the CWEs. This site's conclusion: Next.js should not be treated as only a front-end framework. It runs as a server, so defend it like one: authorize again at the data, allow-list outbound fetches, and put Server Action endpoints behind auth.
Fixing dependency CVEs for real: scan, fix, isolate, and keep watching
Vulnerability work isn't done when you 'fix it.' Done = 1) scan, 2) fix, 3) isolate/hand off, 4) monitor. Until monitoring (daily change-detection) is in place, it's incomplete — dependencies turn vulnerable again tomorrow. A perfect fix that the next deploy overwrites is worth zero. Small teams stay safe with two disciplines: automated change-detection and 'local→push→deploy.'
Installing and using osv-scanner: find CVEs in your dependencies automatically
osv-scanner scans lockfiles and containers to surface CVEs in your dependencies, free. This walks through install, run, and CI integration, plus when to use it vs npm/pnpm audit vs Dependabot. This site's view: which tool fits depends on your setup. Use osv-scanner on multi-ecosystem or GitHub-free projects, and the bundled pnpm audit for a single npm tree.
What is a CVE? How the shared vulnerability ID system works
A CVE is a globally shared ID for a vulnerability (e.g. CVE-2025-12345). CVE = the name, CVSS = severity, KEV = is it exploited. It's the anchor for monitoring. Track it with machines, not by hand.
What is RCE (Remote Code Execution) — why it's the worst class of bug
RCE lets an attacker run arbitrary code on your server — straight to takeover, the worst class. How far the damage spreads is set by the running process's privileges. The core defenses are fast patching, CVE monitoring, and least privilege.
Equifax breach (2017) — how an unpatched Apache Struts flaw leaked 147M people
The cause was a known, already-patched CVE (CVSS 9.8) left unapplied on a public system. An expired monitoring certificate hid the exfiltration for 76 days. In your environment: asset inventory, a patch SLA, machine monitoring, and healthy detection.
Log4Shell (CVE-2021-44228) — a logging library flaw, and why teams couldn't quickly tell if they used it
Log4j's CVSS 10.0 bug. The core problem was the transitive dependency: being affected through a library you didn't know you used. A passive logging path became an attack vector. SBOM, machine-monitoring, fast patching, and following the follow-up CVEs are the lessons.
Running Next.js safely: not falling behind on published CVEs
The top framework risk is neglected published CVEs. Defend with four practices: judge by the running version, monitor with Dependabot/osv-scanner, update fast, and run least-privilege. This site's view: what indie devs usually lack is not knowledge but a way to keep operations going; a system that doesn't miss CVEs matters more than speed.