Tech »  Security’s blind spot: the problem with taking CVE scores at face value