This says a good deal about your company's priorities.

You say you do due diligence to make sure the software you include is secure... yet you miss on such blatant vulnerabilities.

"Not doing enough" only scrapes the surface.