CVE to Real Risk
A CVE number is not a risk score.
- → CVE
- ↓ Affected versions
- ↓ Exposure
- ↓ Reachability
- ↓ Authentication required?
- ↓ Network reachable?
- ↓ Exploitability
- ↓ Impact
- ↓ Known exploitation?
This program does not publish exploit code to “prove” severity. Urgency and impact class stay in separate columns. A KEV item can be urgent and still not be RCE.
Notes
05/CVE to Real Risk/CVE to Real Risk
Authentication → Authorization → Privilege Escalation
Most “broken access control” notes skip the hop that matters: who is authenticated, what was authorized, and whether that principal can reach a privileged sink.
A tracing model for identity bugs: authentication, object-level authorization, then privilege escalation — including when the path can become RCE.
Read the journal note06/CVE to Real Risk/CVE to Real Risk
SSRF: From URL Parser to Server-Side Impact
SSRF research starts at the parser — scheme, host, redirect — and ends at what the server can reach, not at a single blocked IP string.
How a researcher traces server-side request forgery from URL parsing to internal impact, including when it stays data access and when it can precede RCE.
Read the journal note07/CVE to Real Risk/CVE to Real Risk
API Authorization Vulnerability Research
API research is object-level authorization under a real second tenant — not a swagger file and not a scanner’s “missing rate limit” row.
How the laboratory researches API authorization: tenancy, object IDs, batch endpoints, and the hop from data access to privileged sinks.
Read the journal note10/CVE to Real Risk/CVE to Real Risk
CVE to Exploitability: Measuring Real-World Risk
A CVE number is not a risk score. Risk is versions, exposure, reachability, authentication, network, exploitability, impact, and known exploitation.
How the laboratory ranks a public CVE for real-world risk, using exposure and KEV — not CVSS theatre and not an exploit demo.
Read the journal note
FAQ
Questions
- What is CISA KEV used for here?
- The Known Exploited Vulnerabilities catalog is one input for known exploitation. It sets urgency. It does not automatically mean the impact class is RCE.