CVSS (Common Vulnerability Scoring System)
CVSS (Common Vulnerability Scoring System) is an open standard that rates the severity of a security vulnerability on a 0-10 scale, using characteristics like attack vector, complexity, required privileges, and impact to confidentiality, integrity, and availability.
CVSS, maintained by FIRST, produces a numeric severity score from 0.0 to 10.0, mapped to qualitative bands (None, Low, Medium, High, Critical). The most-cited number is the Base score, which captures intrinsic properties of the flaw that do not change over time — how it is exploited and what damage it can cause.
The score is derived from metric groups. Base metrics include attack vector (network, adjacent, local, physical), attack complexity, privileges required, user interaction, and the confidentiality/integrity/availability impacts. Optional Temporal/Threat and Environmental metrics adjust the score for exploit maturity and for the specifics of your environment, though many teams only publish the Base score.
For developers, CVSS is a quick, comparable measure of 'how bad could this be' and is often used as a policy gate (for example, block builds on Critical findings). Its key limitation is that severity is not the same as risk: a Critical CVSS score says nothing about whether the flaw is actually being exploited in the wild or whether the vulnerable code is even reachable in your application. That is why prioritization pairs CVSS with EPSS, CISA KEV, and reachability.