Cvss

CVSS (Common Vulnerability Scoring System) is an open framework published by FIRST (Forum of Incident Response and Security Teams) for characterising and communicating the technical severity of software vulnerabilities through a standardised numerical score. The current version is CVSS v4.0 (released November 2023), which introduced a fourth metric group and clarified nomenclature to address the persistent misuse of CVSS Base scores as standalone risk measurements. CVSS scores appear in the NVD (National Vulnerability Database), CVE entries, scanner output from Qualys, Tenable, Rapid7, Grype, and Trivy, and in compliance frameworks that specify remediation SLAs based on severity bands — “critical (9.0–10.0) within 15 days, high (7.0–8.9) within 30 days.” The score ranges from 0.0 (no impact) to 10.0 (maximum severity) and maps to five qualitative ratings: None (0.0), Low (0.1–3.9), Medium (4.0–6.9), High (7.0–8.9), and Critical (9.0–10.0).