The Common Vulnerability Scoring System (CVSS) provides a way to capture the principal characteristics of a vulnerability and produce a numerical score reflecting its severity. The numerical score can then be translated into a qualitative representation (such as low, medium, high, and critical) to help organizations properly assess and prioritize their vulnerability management processes.
CVSS is a published standard used by organizations worldwide, and the SIG's mission is to continue to improve it.
CVSS is currently at version 4.0. Links on the left lead to CVSS version 4.0's specification and related resources.
A self-paced on-line training course is available for CVSS v4.0. It explains the standard without assuming any prior CVSS experience.
The CVSS Special Interest Group (SIG) is proud to announce the official publication of CVSS v4.0. The latest information on CVSS v4.0 can be found on our CVSS v4.0 landing page.
The SIG is composed of representatives from a broad range of industry sectors, from banking and finance to technology and academia. Organizations and individuals interested in joining the SIG, or observing progress via the CVSS SIG mailing lists, should complete the Request to Join form below.