Also known as: Common Vulnerability Scoring System · CVSS score · base score
CVSS (Common Vulnerability Scoring System) is an open standard that scores the technical severity of a vulnerability from 0.0 to 10.0, based on factors such as attack complexity, required privileges, and impact on confidentiality, integrity, and availability.
CVSS scores are conventionally banded as low (0.1–3.9), medium (4.0–6.9), high (7.0–8.9), and critical (9.0–10.0). The score most people cite is the Base score, which describes intrinsic characteristics of the flaw and does not change over time.
The critical caveat: CVSS measures severity, not risk to you. A 9.8 in a component you do not deploy is irrelevant; a 5.3 on an internet-facing authentication service handling your customer data may be urgent. The standard includes Temporal and Environmental metrics intended to close that gap, but they are rarely published, so most teams see only the context-free Base score.
CVE
CVE (Common Vulnerabilities and Exposures) is a public catalogue that assigns a unique identifier, such as CVE-2026-31337, to each publicly disclosed software vulnerability so that everyone can refer to the same flaw unambiguously.
EPSS
EPSS (Exploit Prediction Scoring System) estimates the probability that a given vulnerability will be exploited in the wild within the next 30 days, expressed as a percentage between 0 and 100.
KEV Catalog
The KEV (Known Exploited Vulnerabilities) catalog is a list maintained by the US Cybersecurity and Infrastructure Security Agency of vulnerabilities with confirmed evidence of active exploitation in the wild.
NVD
The NVD (National Vulnerability Database) is the US government repository, maintained by NIST, that enriches published CVE records with CVSS severity scores, affected product identifiers, and references.
Vulnerability Management
Vulnerability management is the ongoing process of identifying, prioritising, remediating, and verifying fixes for security weaknesses across an organisation's systems and software.