Glossary
CVSS (Common Vulnerability Scoring System)
FIRST's open standard for describing the technical severity of a vulnerability as a vector and a 0–10 score.
The Common Vulnerability Scoring System (CVSS) is an open standard maintained by FIRST for capturing the principal characteristics of a vulnerability and producing a numerical score from 0.0 to 10.0, with qualitative bands from None to Critical. The current major version, CVSS v4.0, was published in November 2023 and organizes metrics into Base, Threat, Environmental and Supplemental groups, with nomenclature such as CVSS-B and CVSS-BTE to show which groups were used.
The score most people see — published by vendors or NVD — is usually the Base score, which describes intrinsic severity under worst-case assumptions. It does not measure the likelihood of exploitation or the importance of the affected asset, so on its own it is a poor priority signal.
A Vulnerability Operations Center uses CVSS as one input alongside exploitation evidence and asset context. See risk-based prioritization with CVSS v4, EPSS and KEV.