A Third of Critical Java Advisories Have Wrong Info

We re-checked 94 critical Java vulnerability advisories. Nearly 1 in 3 had wrong information: bad version ranges, wrong fixed versions, or the wrong package named.

When advisory data is wrong, the tools that rely on it can miss vulnerable versions or point teams to the wrong fix.

Read the full research