Wiz used React2Shell (CVE-2025-55182) in a new blog post to argue that AppSec teams cannot treat scanner output as the whole risk picture. In a Next.js-heavy estate, one flaw can spray thousands of findings across repositories and container images.
The problem is duplication and context. A shared component can show up as many separate alerts, but most of those alerts are just repeat sightings or copies that are not actually reachable; the useful question is which instances sit in internet-facing apps or workloads that can reach sensitive data.
That puts ASPM in a different job than simple aggregation: it has to correlate code, container, cloud, and runtime signals so machine-speed detection stays actionable. For teams running separate scanners across application estates, the exposure is the subset tied to real attack paths, not the size of the finding queue.