Every entry in our CVE watch carries a severity label of LOW, MEDIUM, HIGH, or CRITICAL. Those labels come from the Common Vulnerability Scoring System (CVSS), the industry-standard method for rating how serious a security flaw actually is. Understanding how the score is built makes the difference between reacting to every CVE and reacting to the ones that matter.
What CVSS actually measures
CVSS produces a number from 0.0 to 10.0, generated from a set of metrics grouped into three areas:
- Exploitability metrics: how the vulnerability is reached (over a network, locally, or physically), how complex the attack is, whether the attacker needs existing privileges, and whether user interaction is required.
- Impact metrics: what happens to confidentiality, integrity, and availability if the flaw is exploited successfully.
- Scope: whether a successful exploit stays contained to the vulnerable component or lets an attacker affect resources beyond it.
Newer CVSS versions add temporal and environmental metrics that account for things like available exploit code or how the affected system is actually deployed, but most published NVD scores you will see quoted are the base score, a snapshot of severity assuming default conditions.
Why the score bands matter
The 0–10 score is typically bucketed into four bands:
- Low (0.1–3.9): limited impact, usually requiring unusual conditions to exploit.
- Medium (4.0–6.9): a real issue, but one that is harder to reach or has partial impact.
- High (7.0–8.9): exploitable with moderate effort and meaningful consequences.
- Critical (9.0–10.0): typically remote, low-complexity, and capable of full compromise.
A critical score is a strong signal to prioritize patching, but it is not the whole story. A 9.8-rated flaw in software you do not run anywhere is lower risk to you than a 6.5 in your public-facing login page.
Reading a score in context
When a new CVE lands in the feed, three questions matter more than the raw number: is the affected software actually in your environment, is the vulnerable component exposed to untrusted input, and does a public exploit already exist. CVSS answers "how bad could this be in the worst case." Your own asset inventory has to answer "does this apply to me."
Where the data comes from
Our CVE watch pulls directly from the NVD (National Vulnerability Database) feed, so the severity label shown next to each disclosure reflects the published CVSS base score at time of ingestion. Filter by severity there to focus on what is actually worth your attention today.