Glossary
CVSS
Common Vulnerability Scoring System
A scoring system for the severity of a vulnerability, from 0.0 to 10.0, maintained by FIRST.
The Common Vulnerability Scoring System, maintained by FIRST (Forum of Incident Response and Security Teams), gives a vulnerability a severity score from 0.0 to 10.0. The base score describes the intrinsic characteristics of the flaw: how it is reached, what conditions are required, and what it compromises in confidentiality, integrity and availability.
Successive versions: 2.0 (2007), 3.0 (2015), 3.1 (2019) and 4.0 (November 2023). In v3 and v4 the score maps to ratings: None (0.0), Low (0.1 to 3.9), Medium (4.0 to 6.9), High (7.0 to 8.9) and Critical (9.0 to 10.0). v2 has no Critical rating: a v2 score of 10.0 is rated High.
CVSS measures severity, not risk. A flaw scored 9.8 that is never exploited can be less urgent than a 7.5 under active exploitation, which is why it is read alongside the CISA KEV catalog and the EPSS score. Scores can also differ between the NVD and the vendor (CNA); both are published.
On cveo.tech
Related terms
- CVSS vectorThe text string that spells out, metric by metric, how a CVSS score was obtained.
- EPSSThe probability, from 0 to 1, that a CVE will be exploited in the next 30 days, published by FIRST.
- CISA KEVCISA's catalog of vulnerabilities with confirmed active exploitation.
- NVDNIST's vulnerability database, which enriches each CVE with a CVSS score, a CWE and the affected products.