VULNERABILITY PRIORITIZATION BEYOND THE CVSS NUMBER

Summary from the TLDR InfoSec newsletter

CVSS scores alone fail to capture how vulnerabilities propagate through interconnected systems. Log4Shell is an example in which widespread nested dependencies, not just technical severity-driven impact, are at play. The Unified Linkage Model (ULM) framework evaluates vulnerabilities based on adjacency, inheritance, and trust relationships to identify "blast radius multipliers," such as SSO services or CI/CD pipelines. Security teams should map system dependencies and prioritize patching vulnerabilities near identity systems and shared services that can amplify downstream risk.