> You really should be performing your own risk assessment so you can convert this notional context-free severity rating to your own context-related impact and

> You really should be performing your own risk assessment so you can convert this notional context-free severity rating to your own context-related impact and likelihood to give you your own company risk rating. Totally agree, and I do that - check the vulnerability description, see if we’re using that part of the library, etc… it usually works out that we’re not actually affected by whatever the alert is.