"90% of Java services have critical or severe security vulnerabilities"... or about the quirks of security reporting – JVM Weekly vol. 80