CVSS

CVSS is a standard way to rate how serious a security flaw is. FIRST publishes it. Each flaw gets a base score from 0.0 to 10.0, and the score comes with a label. A score of 0.0 is None. Scores from 0.1 to 3.9 are Low, 4.0 to 6.9 are Medium, 7.0 to 8.9 are High, and 9.0 to 10.0 are Critical.

Think of it like a storm rating on the weather report. It tells you how strong the storm is, but not whether it will hit your street. Each score also comes with a short code called a vector string, which shows how the score was reached. For example, it records whether an attacker needs a login or needs someone to click something.

Why it matters

The score describes the flaw itself, not your risk. The CVSS specification advises people to add details about their own setup. For example, a Critical flaw in a feature you never turned on may matter less to you than a Medium flaw in the chatbot your staff use every day.

When the vendor of an AI tool you use announces a flaw, ask them for the CVSS score. Also ask whether your account is affected and when the fix will reach you.

You will often see scores next to a CVE number in the NVD. For a walkthrough, see how to read a CVSS score.