Skip to content
SelfSec
Join the launch listLaunch list
SelfSec
Vulnerability field guide

Vulnerable Components

Most of the code a web application serves was written by someone else. Here is how outdated libraries, CMS plugins and server products are fingerprinted and matched to public CVEs, how KEV and EPSS decide what to patch first, and the inventory habits that keep components current.

1 article 8 min total Overview to advanced techniques

Start with the overview

Vulnerable Components8 min read

Vulnerable Components, Explained: Version Fingerprints, Public CVEs and the Patch That Never Shipped

Most of the code a web application serves was written by someone else. Here is how outdated libraries, CMS plugins and server products are fingerprinted and matched to public CVEs, how KEV and EPSS decide what to patch first, and the inventory habits that keep components current.

Read the overview