# Common Vulnerability Scoring System **Acronym:** CVSS **Entity class:** Vulnerability-severity standard ## Definition The **Common Vulnerability Scoring System (CVSS)** expresses technical characteristics and severity of software and hardware vulnerabilities through standardized metrics. It supplies one layer of prioritization; operational priority also depends on affected configurations, reachable attack paths, mission impact, and evidence of exploitation. ## Relationships - **record ecosystem:** [[wiki/Common Vulnerabilities and Exposures|CVE]] and [[wiki/National Vulnerability Database|NVD]]. - **complementary decision model:** [[wiki/Stakeholder-Specific Vulnerability Categorization|SSVC]]. - **exploitation evidence:** [[wiki/Known Exploited Vulnerabilities Catalog|KEV]]. - **architecture:** [[wiki/Continuous Vulnerability Intelligence|Continuous Vulnerability Intelligence]]. ## Sources / Provenance - Forum of Incident Response and Security Teams, [Common Vulnerability Scoring System v4.0 specification](https://www.first.org/cvss/v4.0/specification-document), 2023. - National Institute of Standards and Technology, [National Vulnerability Database](https://www.nist.gov/itl/nvd), accessed 2026-09-23. **As of:** 2026-09-23