> I don't know where that ranking comes from. It comes from MITRE (https://en.wikipedia.org/wiki/Mitre_Corporation https://en.wikipedia.org/wiki/Mitre_Corporat

> I don't know where that ranking comes from. It comes from MITRE (https://en.wikipedia.org/wiki/Mitre_Corporation https://en.wikipedia.org/wiki/Mitre_Corporation), and the methodology is explained on the website (roughly, the score is relative prevalence times relative average vulnerability severity). > and attackers can switch to it, so shutting off one source of UB isn't as effective in practice as you might expect. If that's how things work, you could say the same about all the other weaknesses that have nothing to do with UB.