dorgaa fahed

Your python:3.12-slim image ships Perl. 17 CVEs in perl-base, 3 critical, up to 9.8. Debian marks it Essential because its packaging tools need it. The Python binary isn't linked against it. Whether those CVEs matter depends on something no scanner knows: does anything in your setup run Perl on attacker-controlled input? #AppSec #DevSecOps

Log4Shell, CVSS 10.0, dans un service interne que rien ne peut atteindre. Huit modèles. Sept le font redescendre à Note ou Low. Le moins cher le remonte à 48.8 sur 81. Mon moteur de règles sans LLM le classe Low, lui. Sur cette CVE, le modèle pas cher fait moins bien que pas de modèle du tout. Le benchmark complet, douze modèles, en réponse. #AppSec #LLM

If you run Dependency-Track: since 5.1 it reads the OWASP rating straight out of a VEX on import. CVSS gives a CVE one number for everyone. This one moves with where the thing runs: same CVE, same component, 2.0 internal, 22.5 exposed. Guide in the reply. #DependencyTrack #AppSec #VEX

Tired of CVSS scores that ignore your app's context? 🎯 I'm sharing a CLI to prioritize vulnerabilities based on real-world risk, not abstract metrics. vens v0.5.0 is out with big updates! Link below 👇 #AppSec #SBOM #LLM