CVSS (the Common Vulnerability Scoring System, maintained by FIRST) is an open standard for expressing the technical severity of a vulnerability as a number from 0.0 to 10.0. It gives everyone a shared, repeatable way to say how bad a finding is, so 'high severity' means roughly the same thing across reports and tools.
The most common base-score metrics describe how a vulnerability is exploited and what it affects: the attack vector (network, adjacent, local, physical), attack complexity, privileges required, user interaction, scope, and the impact on confidentiality, integrity and availability. Together they give the base score from 0 to 10. Vexaro scores findings with CVSS 3.1. FIRST also publishes CVSS v4.0 (released in 2023), so a report should state which version it uses.
CVSS 3.1 maps the number to qualitative bands: None (0.0), Low (0.1-3.9), Medium (4.0-6.9), High (7.0-8.9) and Critical (9.0-10.0). These bands are what most people mean when they call a finding 'critical' or 'medium', and they let you sort a report by priority at a glance.
The base score captures the intrinsic severity, which doesn't change over time. Two optional metric groups refine it. Temporal reflects factors like exploit maturity, and Environmental adjusts the score for your environment: an issue on an internal-only system, for example, may matter less than the same issue exposed to the internet. A good report doesn't stop at the base number; it translates severity into business risk in context.
CVSS measures the severity of a software vulnerability. It is not a risk score on its own, and it isn't designed for pure configuration or compliance-posture findings, which are better rated against a benchmark's own severity. Treat the base score as a consistent starting point, then weigh exploitability and impact in your context. A good pentest report uses it exactly this way.
CVSS (the Common Vulnerability Scoring System) is an open standard maintained by FIRST for expressing the technical severity of a vulnerability as a number from 0.0 to 10.0, so 'high severity' means roughly the same thing across reports and tools. Vexaro scores findings with CVSS 3.1. FIRST also publishes v4.0, so a report should state which version it uses.
CVSS 3.1 maps the base score to qualitative bands: None (0.0), Low (0.1-3.9), Medium (4.0-6.9), High (7.0-8.9) and Critical (9.0-10.0). These bands are what most people mean when they call a finding 'critical' or 'medium', and they let you sort a report by priority at a glance.
No. CVSS measures the technical severity of a vulnerability, not risk on its own, and it isn't designed for pure configuration or compliance-posture findings. The base score is a consistent starting point. Temporal and Environmental metrics (such as whether a system is internal-only or exposed to the internet) help translate it into business risk in context.