CVSSCommon Vulnerability Scoring System
Definition
Industry standard to score vulnerability severity on a 0–10 scale. Combines attack vector, complexity, privileges required, user interaction, and impact on C, I, A.
CVSS (currently v3.1, with v4.0 in transition) translates a flaw's properties into a numeric score that helps prioritise patching. The vector matters most: it says how and where an attacker can exploit the bug.
A CVSS 9.8 (Critical) usually means: remotely exploitable (network), no authentication (PR:None), no user interaction (UI:None), and high impact on confidentiality/integrity/availability. That's typically unauthenticated RCE — patch NOW.
CVSS Base is only one face. Temporal adds context (is there a public exploit? a patch?), and Environmental tailors it to your infrastructure. Many teams only look at Base, but real prioritisation requires Temporal once you have in-the-wild evidence.