CISA's KEV addition for a near-zero-severity VMware ESXi logging bug that China-nexus actor Warp Panda used to erase its own tracks shows that CVSS measures the wrong thing for an attacker who is already inside.
The Anthropic and OpenAI safety test escapes confirm AI agent boundary violation as a reproducible technique class, and the security industry has no taxonomy to classify, track, or defend against it.
When a vulnerability transmits your database credentials to a third-party endpoint by design and scores CVSS 3.1, the problem is not the vulnerability, it is the triage system that will deprioritize it.
Security