CVSS versions
The Common Vulnerability Scoring System (CVSS) turns a vulnerability’s characteristics into a 0–10 severity score. The small version chip next to a CVE’s CVSS score tells you which revision NVD filed — and the versions are not directly comparable. We always display the newest version NVD provides.
CVSS v4.0
The current standard (2023). It splits impact into the vulnerable
system and subsequent systems, replaces the old
“Scope” metric with explicit metrics, and adds Attack Requirements
— producing more nuanced base scores. Vectors start CVSS:4.0/
and use metrics like VC/VI/VA and
SC/SI/SA.
CVSS v3.1
A 2019 clarification of v3.0 that fixed scoring ambiguities without changing the
formula, so most CVEs today carry v3.1. Vectors start CVSS:3.1/ with
the familiar AV/AC/PR/UI/S/C/I/A metrics. A v3.1 and a v4.0 score for
the same CVE can differ — they measure with different models.
CVSS v3.0
The 2015 release that introduced the modern base-metric model (Attack Vector, Scope, and separate Confidentiality/Integrity/Availability impacts). Superseded by v3.1; you’ll see it on older records that were never re-scored.