What we find, and what it means

Notes from the work: findings we keep seeing, fixes that hold up, and the reasoning behind how this product decides what counts as a risk.

1 article matching

Tagged cvss · clear

EPSS vs CVSS: Why "Critical" Doesn't Mean "Fix First"

CVSS measures how bad exploitation would be. EPSS measures how likely it is in the next 30 days. Confusing the two is why teams patch alphabetically while the actually-exploited bug waits.

Aug 24, 20262 min read

Code Security

Talk to us.

Questions about what the engine checks, whether it fits your estate, or what it deliberately refuses to do. A person reads every message.

01You writePlain form, no qualifying call, no obligation. The marketing checkbox is optional and unticked.

02A person reads itMessages land with the team, not a queue-bot. Nothing is auto-replied.

03You get an answerTo the address you gave — including “this product is not the right fit”, when that is the honest answer.

Prefer email?

privacy@webcuris.com

Reporting a vulnerability?

Read the disclosure policy first — it tells you what is in scope and what to expect.