CVSSscore

CVSSscore refers to the numeric rating produced by the Common Vulnerability Scoring System (CVSS) to express the severity of a software vulnerability. The score ranges from 0.0 to 10.0, with higher numbers indicating greater severity. CVSS scores are widely used in vulnerability management to prioritize remediation and in security advisories and reports.

CVSS scoring is organized into metric groups: base, temporal, and environmental. The base score captures intrinsic characteristics of the vulnerability that are constant across time and contexts, using metrics such as attack vector, attack complexity, privileges required, user interaction, scope, and the impacts on confidentiality, integrity, and availability. The temporal score adjusts the base score for factors that can change over time, like the availability of exploit code and remediation maturity. The environmental score tailors the rating to a specific environment, reflecting the organization’s security requirements and the potential impact on its assets.

Versions of CVSS have evolved since its inception. The most widely used are CVSS v2 and CVSS v3 (including 3.0 and 3.1). The scoring framework is maintained by the Forum of Incident Response and Security Teams (FIRST), and there are official calculators and multiple third‑party tools to compute CVSS scores from metric values.

Limitations: a CVSSscore expresses severity, not the probability of exploitation or overall risk. It should be used alongside other risk factors and organizational context when prioritizing remediation efforts.