CYBERSECURITY
FEATURED ANALYSIS
Where Severity Scores Go Wrong: “Just Add Prototype Pollution”
BY
drewt
SOURCE
From the Frog's mouth - JFrog Blog
DATE
READ
1 min read
At JFrog, our Security Research team continuously monitors and analyzes newly disclosed CVEs across the open-source ecosystem. Throughout our research, we have repeatedly observed cases where the assigned severity score …
At JFrog, our Security Research team continuously monitors and analyzes newly disclosed CVEs across the open-source ecosystem. Throughout our research, we have repeatedly observed cases where the assigned severity score does not accurately reflect a vulnerability’s real-world impact or exploitability. In fact, during 2025, JFrog researchers reassessed NVD critical-severity vulnerabilities and concluded that 96% warranted