What Is a CVSS Score?

CVSS (Common Vulnerability Scoring System) is an open standard, maintained by FIRST, that rates the technical severity of a software vulnerability on a scale from 0.0 to 10.0. It describes how bad a successful exploit could be, not how likely exploitation is or how much risk it poses to your own systems.

How a CVSS score is calculated

A CVSS score is calculated from a vector of metrics. Version 4.0, published by FIRST in November 2023, organises them into four groups:

• Base: intrinsic characteristics such as attack vector, attack complexity, the privileges and user interaction required, and the impact on confidentiality, integrity and availability.
• Threat: factors that change over time, chiefly exploit maturity.
• Environmental: adjustments for how important the affected system is in your environment.
• Supplemental: extra context, such as whether an attack can be automated, that does not change the score.

The score maps to qualitative ratings: None (0.0), Low (0.1–3.9), Medium (4.0–6.9), High (7.0–8.9) and Critical (9.0–10.0). Most public databases, including the NVD, publish only base scores, and many advisories still use CVSS v3.1. Two sources can therefore show different numbers for the same CVE.

FIRST's specification is explicit that the base score measures severity, not risk. A 9.8 in a library function your application never calls can matter less than a 7.5 that attackers are exploiting today.

How GeekWala uses CVSS

GeekWala shows the CVSS score of each vulnerability it finds as the severity signal. It adds EPSS (likelihood of exploitation) and CISA KEV status (confirmed exploitation), so you can tell severe-and-exploited apart from severe-on-paper. Because CVSS alone can't tell you whether an attacker is actually targeting a flaw, GeekWala never sorts findings by CVSS in isolation — it always pairs the severity number with EPSS and KEV, so a 9.8 with no real-world exploitation evidence doesn't crowd out a 7.5 that is actively being exploited.

Sources: FIRST — CVSS v4.0 specification · NIST NVD — Vulnerability Metrics

Related terms

• EPSS (Exploit Prediction Scoring System)
• CISA KEV (Known Exploited Vulnerabilities)
• Reachability Analysis

Read the full guide · What dependency vulnerability scanning is · Back to the glossary

Last updated September 13, 2026