Severities are not directly comparable. The CVSS docs leave the choice of the "vulnerable component" as an exercise for the reader. The choice of the "vulnerable component" is also not encoded in the score so a critical may be a critical in the context of a library scored against a theoretical (and bad) program or it could be scored on a single website with known mitigations.
replyThanks for the link!
1) It seems some are coming down, like RedHat
2) This pattern should be expected based on the amount of "intelligent" compute, heuristic agentic algorithms, money and awareness on the issue of software vulnerabilities at the moment. Projects like Glasswing, Daybreak, Fairwind, Purple etc are in full swing and seemingly effective
replyThey are also incentivized to find high severity vulnerabilities - and/or to announce found vulnerabilities as high severity.
replyAfter all, what would all that hardware and research be worth it, if it didn't find the most critical vulnerabilities around?
Many CVEs have too high severity for what they describe.
replyI'll look to add some additional features to the site based on this feedback - thanks!
reply