Understanding CVEs and CVSS Scores

If you follow security news for more than a week, you'll run into strings like CVE-2024-3094and scores like “CVSS 9.8 Critical.” They look precise and official — and they are useful — but they're also widely misunderstood. Here's what they actually mean and, more importantly, what they don't.

What a CVE is

CVE stands for Common Vulnerabilities and Exposures. A CVE ID is nothing more than a unique catalog number for a specific, publicly disclosed security flaw — think of it as an ISBN for a vulnerability. The format is CVE-[year]-[number], where the year is when the ID was reserved (not necessarily when the bug was found or fixed). The system is run by MITRE with a network of “CNAs” (CVE Numbering Authorities) — companies like Microsoft and Google that can assign IDs for their own products.

Crucially, a CVE ID is an identifier, not a rating.It tells you “this particular flaw exists and here's a name everyone can use for it.” It says nothing, by itself, about how bad the flaw is. That's what CVSS is for.

Where the score comes from

After a CVE is published, it's typically analyzed by the U.S. National Vulnerability Database (NVD), which attaches a CVSS(Common Vulnerability Scoring System) score. There's a lag: a fresh CVE can sit “awaiting analysis” for days or weeks with no score, which is why our CVE Tracker shows some entries without a number yet.

How the base score is built

The number you usually see (0.0–10.0) is the CVSS base score. It's calculated from a handful of characteristics of the vulnerability itself:

• Attack Vector — can it be exploited over the network, or does it need local/physical access? Remote is worse.
• Attack Complexity— does it “just work,” or does the attacker need special conditions?
• Privileges Required and User Interaction — does the attacker need to already be logged in, or does a victim need to click something?
• Scope — can the flaw affect components beyond the vulnerable one?
• Confidentiality, Integrity, Availabilityimpact — the classic “CIA triad”: can an attacker read data, change data, or take the system down?

Those roll up into the familiar severity bands:

• 9.0–10.0 — Critical
• 7.0–8.9 — High
• 4.0–6.9 — Medium
• 0.1–3.9 — Low

What the score does NOT tell you

This is where a lot of headlines go wrong. A CVSS base score measures theoretical severity in the abstract. It does not tell you:

• Whether anyone is actually exploiting it.A 9.8 that no one has weaponized can be less urgent than a 7.5 that's under active mass exploitation.
• Whether you're exposed.A critical flaw in software you don't run is a 0 for you.
• How valuable the affected asset is. The same bug on a test box and a production database are very different problems.

How to prioritize in practice

Seasoned defenders combine the base score with two other signals:

• CISA's KEV catalog (Known Exploited Vulnerabilities) — a curated list of CVEs that are confirmed exploited in the wild. If a CVE is on KEV, it jumps the queue regardless of its score.
• EPSS(Exploit Prediction Scoring System) — a data-driven probability that a given CVE will be exploited in the next 30 days. Great for triaging the long tail of “high” bugs.

A useful mental model: CVSS tells you how bad it could be, KEV/EPSS tell you how likely it is, and your own asset inventory tells you whether it's your problem. You need all three to prioritize well.

Putting it together

When you see a CVE in a headline, don't stop at the number. Ask: is it in software I run? Is it being exploited? What would an attacker actually get? Our CVE Tracker is built to help with the first question — it groups every CVE currently being reported on across our sources, with its NVD score, so you can see what the security world is actually paying attention to right now.