Menu
Home
People
Places
Arts
History
Plants & Animals
Science
Life & Culture
Technology
Reference.org
Common Vulnerability Scoring System
open-in-new
<p>The Common Vulnerability Scoring System (CVSS) is a <a href="/facts/Technical_standard/P4orT1SM">technical standard</a> for assessing the severity of <a href="/facts/Vulnerability_(computing)/jg0Gr71M">vulnerabilities</a> in computing systems. Scores are calculated based on a formula with several <a href="/facts/Software_metric/kus08fbs">metrics</a> that approximate ease and impact of an exploit. Scores range from 0 to 10, with 10 being the most severe. While many use only the CVSS Base score for determining severity, temporal and environmental scores also exist, to factor in availability of mitigations and how widespread vulnerable systems are within an organization, respectively. </p><p>The current version of CVSS (CVSSv4.0) was released in November 2023. </p><p>CVSS is not intended to be used as a method for <a href="/facts/Patch_management/NdpBy1S3">patch management</a> prioritization, but is used like that regardless. A more effective approach is to integrate CVSS with predictive models like the Exploit Prediction Scoring System (EPSS), which helps prioritize remediation efforts based on the likelihood of real-world exploitation. </p>