@benbe good call. I'll show all four of them separately...

@schmidt_fu neither, this is the curl security team's severity classification. We don't do anything else

Thank you, I'm just learning about these differences.
How do you assign those numbers?

@schmidt_fu we don't use numbers. We use low, medium, high and critical only: curl.se/dev/vuln-disclosure.ht…

That sounds reasonable and explain a lot more than I could ask, thanks again!

@0xThiebaut confirmed, we don't care about the rest

@icing I tweaked the title a little to maybe help understanding

when smoothed out, almost a work of art

@linus we hadn't gotten that many reports before that and they were almost all quite serious. Then in 2014 we got a whole bunch of medium-rated ones and only one high

@martin until 2006 all reports we got were actually deemed critical. There were very few