Where Severity Scores Go Wrong: “Just Add Prototype Pollution”

Bugcrowd now supports custom CVSS v3.1 to VRT mappings. Assigning a CVSS score prefills the matching P1-P5 VRT severity, standardizing how security teams prioritize vulnerabilities.

A deep dive into JavaScript prototype pollution: how attackers control undeclared variables to turn weakly-typed checks into XSS on the client side or remote code execution on the server side.

Overview of CVSS, the FIRST-managed open standard for rating vulnerability severity: base metrics like attack vector, complexity and privileges required, and how scores guide patch priorities.

Bugcrowd now maps its Vulnerability Rating Taxonomy to CVSS v3, auto-suggesting CVSS scores on validated submissions; VRT 1.3 adds a Broken Access Control category aligned with OWASP Top 10 2017.

Aikido analyzed the 'critical' Axios CVE-2026-40175 gadget chain—prototype pollution to CRLF injection to SSRF—and concluded Node.js blocks CRLF in headers, making it unexploitable in practice.

npm v12 shifts package installation to explicit trust, blocking lifecycle scripts, Git and remote-URL dependencies by default via new allowScripts, --allow-git and --allow-remote controls.