Operational guidance, not legal advice. This page distills named public sources (regulator guidance and industry practice). It is not a legal determination, not a notification decision, and not a substitute for your counsel, insurer, or a retained DFIR firm. Verify applicability and current deadlines for your facts and jurisdiction.
What is the difference between a CVE, a CWE, and a CVSS score?
Updated
A CVE is a unique identifier for one publicly disclosed vulnerability. A CWE classifies the type of underlying software weakness — a category, not an instance. A CVSS score rates the severity of a specific vulnerability using a standardized formula. All three come from different programs and answer different questions.
This page, last verified 10 September 2026, distills MITRE's CVE Program and CWE Program, and FIRST's CVSS specifications — v4.0 (the current version) and v3.1 (still the version most widely published on NVD as of this verification). It is not legal advice and does not determine that any scoring scheme applies to YOU.
Three programs, three jobs
Audience: an engineer or security lead trying to read a vulnerability report and knowing which number means what. This page is not legal advice. It does not start a clock. Reading it does not start a clock. This product does not patch YOUR estate — a named human still decides how to act on any CVE, CWE, or CVSS value.
CVE (Common Vulnerabilities and Exposures) is an identifier — 'CVE-2021-44228' names one specific disclosed vulnerability, nothing more. CWE (Common Weakness Enumeration) is a taxonomy — 'CWE-502' names a category of weakness ('Deserialization of Untrusted Data'), and many different CVEs can share the same CWE. CVSS (Common Vulnerability Scoring System) is a scoring formula — it takes characteristics of one CVE and produces a 0–10 severity number. A CVE record commonly cites both a CWE and a CVSS score, but the three are not interchangeable and are not maintained by the same body.
Comparison table
Last verified 10 September 2026 against MITRE's CVE Program and CWE Program pages and FIRST's CVSS v4.0 and v3.1 specification documents. Not legal advice.
| Term | What it identifies | Maintained by | Format |
|---|---|---|---|
| CVE | One specific, publicly disclosed vulnerability instance in a specific product or version. | The CVE Program, sponsored by CISA and coordinated through a network of CVE Numbering Authorities (CNAs). | CVE-YYYY-NNNNN (year of assignment, sequence number). |
| CWE | A category of software or hardware weakness that could lead to a vulnerability — the root-cause pattern, not the instance. | The CWE Program, sponsored by CISA and stewarded by MITRE, with community contributions. | CWE-NNN (a hierarchy of weakness classes, e.g. CWE-79 Cross-Site Scripting, CWE-502 Deserialization of Untrusted Data). |
| CVSS | A severity score for one specific vulnerability (typically one specific CVE), computed from a fixed set of metrics. | FIRST (Forum of Incident Response and Security Teams), a CVSS Special Interest Group. | A 0.0–10.0 numeric score plus a vector string, e.g. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. |
Annotated CVSS vector — illustrative example
The vector below is the publicly recorded NVD CVSS v3.1 base vector for CVE-2021-44228 (Log4Shell), a well-known, extensively documented vulnerability chosen because its scoring is public and stable. It is shown here as an illustrative teaching example, not as guidance for scoring any current or future CVE — read a vector directly from its CVE record or your scanner, not from this page, before acting on it. Last verified 10 September 2026. Not legal advice.
- Resulting base score for this example: 10.0, the maximum on the CVSS v3.1 scale — critical. This page does not compute a score for any other CVE; use the FIRST calculator or your scanner's output.
- CVSS v4.0 restructures several of these metrics (for example, Scope is retired and replaced by explicit Vulnerable System / Subsequent System impact metrics, and a new Attack Requirements metric is added). A vector written in v3.1 syntax is not directly comparable to a v4.0 vector without re-scoring under v4.0's rules.
| Metric | Value in this example | What that value means |
|---|---|---|
| Attack Vector (AV) | N — Network | Exploitable remotely over a network; the attacker does not need local or physical access. |
| Attack Complexity (AC) | L — Low | No specialized conditions beyond normal network reachability are needed to exploit it. |
| Privileges Required (PR) | N — None | The attacker needs no prior authentication or account access on the vulnerable system. |
| User Interaction (UI) | N — None | No action from a victim user is needed to trigger the vulnerability. |
| Scope (S) | C — Changed | Exploitation can affect resources beyond the vulnerable component's own security scope. |
| Confidentiality Impact (C) | H — High | A successful exploit can result in total loss of confidentiality of affected data. |
| Integrity Impact (I) | H — High | A successful exploit can result in total loss of integrity of affected data. |
| Availability Impact (A) | H — High | A successful exploit can result in total loss of availability of the affected component. |
CVSS v4.0 is current; v3.1 is still widely published
FIRST published CVSS version 4.0 on 1 November 2023, and it is the current specification as of this verification. CVSS v3.1, published in 2019, remains extremely widely used in practice: as of last verification, NVD's own CVE enrichment continues to publish CVSS v3.x scores for most CVEs, and many scanners and CVE records still emit v3.1 vectors alongside or instead of v4.0 ones. Both versions coexist in the ecosystem; a v3.1 vector on a CVE record is not stale or wrong, it is simply an earlier specification. Last verified 10 September 2026. Not legal advice.
| Aspect | CVSS v3.1 (2019) | CVSS v4.0 (2023, current) |
|---|---|---|
| Metric groups | Base, Temporal, Environmental. | Base, Threat, Environmental, and a new Supplemental group (Safety, Automatable, Recovery, Value Density, Vulnerability Response Effort, Provider Urgency). |
| Scope metric | Present (Unchanged / Changed). | Retired. Replaced with explicit metrics for impact to the Vulnerable System (VC/VI/VA) and Subsequent Systems (SC/SI/SA). |
| New Base metrics | Not present. | Attack Requirements (AT); User Interaction split into Passive/Active. |
| Temporal metrics | Exploit Code Maturity, Remediation Level, Report Confidence. | Renamed Threat metric group; simplified to Exploit Maturity (E). Remediation Level and Report Confidence retired. |
| Adoption as of last verification | Still the version most widely published by NVD and most scanners as of 10 September 2026. | The current FIRST specification, with growing but not yet universal scanner and database adoption as of last verification. |
Base-score limitations
A CVSS base score is intentionally narrow. It is an intrinsic-severity estimate assuming default (highest-severity) Threat and Environmental values, computed the same way regardless of whether exploit code exists, whether the vulnerability is being exploited, or how exposed your specific asset is. Last verified 10 September 2026. Not legal advice.
- A base score does not tell you whether anyone is exploiting the vulnerability. The vulnerability-vs-exploit-vs-risk guide on this site covers that distinction, and the CISA KEV and FIRST EPSS guides on this site cover the signals that do speak to exploitation.
- A base score does not account for your asset's actual network exposure, compensating controls, or business context. Two organizations running the same CVSS-9.8 CVE can have very different real risk, as the worked example on the vulnerability-vs-exploit-vs-risk guide shows.
- CVSS v3.1's Temporal metrics and v4.0's Threat metrics exist precisely to layer exploit-maturity and remediation-level context onto the base score — but most published CVE-record scores show the base score alone, with Threat/Environmental metrics left at their assumed defaults unless a specific organization re-scores them.
- A high base score is not, by itself, a scanner-verified statement that your specific instance is reachable or unpatched with certainty; it is the CVE's published characteristics.
Authoritative scheme vs scanner-assigned score
Not every CVSS number you see comes from the same authority. Distinguishing them matters when two tools disagree about the same CVE. Last verified 10 September 2026. Not legal advice.
- When a scanner's score and NVD's published score disagree for the same CVE, that is usually a difference in which metrics were customized (often Environmental), not an error in the CVSS formula itself.
- This page does not adjudicate which score is 'correct' for YOUR environment. Re-scoring Environmental metrics for your own asset context is exactly what those metrics exist for.
| Source of the score | What it represents | Kind of text |
|---|---|---|
| CVSS specification (FIRST) | The formula and metric definitions themselves — how any score is supposed to be computed. | Authoritative specification. Not a score for any particular CVE. |
| NVD CVSS score on a CVE record | NIST's National Vulnerability Database enrichment, or a CNA's own submitted score, applied to that specific CVE. | Widely treated as the reference score for that CVE, but it is one organization's application of the CVSS formula, not a law. |
| Scanner-assigned or vendor-assigned score | A commercial scanner or software vendor's own computed or adjusted CVSS score for a finding, sometimes re-scoring Environmental metrics for a customer's context. | A vendor's application of the same formula, which can legitimately differ from NVD's published score, especially where Environmental metrics are customized. |
What to do now
As of last verification on 10 September 2026, CVSS v4.0 is current and v3.1 remains widely published. The list below is operational, not a determination that any scheme applies to YOU.
- When reading a CVE record, check which CVSS version the vector string uses — the 'CVSS:3.1' or 'CVSS:4.0' prefix — before comparing it to another CVE's score.
- Do not average or directly compare a v3.1 score against a v4.0 score for two different CVEs as if they are on identical scales; the metric definitions changed.
- Treat CWE as a way to spot patterns across many findings (for example, 'we have a recurring CWE-502 problem in this service'), not as a severity signal by itself.
- Layer exploitation evidence (KEV) and exploitation probability (EPSS) on top of the CVSS base score before setting remediation priority — the how-to-prioritize guide on this site covers that combination.
Where this shows up in ShipReady Metrics
Signed-in app → Security → Findings surfaces the CVE identifier, CWE classification where a source provides one, and CVSS score for each finding ingested from connected scanners (Dependabot, code scanning, secret scanning, DAST, and first-party SAST where configured), with cross-source deduplication so the same CVE reported by two tools is not counted twice.
The product does not assign CVE IDs, does not maintain the CWE taxonomy, and does not compute its own CVSS score independent of the source that reported it — those are MITRE's and FIRST's programs, not this product's. It also does not patch YOUR estate. A named human still decides how to act on any score.
This page does not document a public demo URL. There is no public vulnerability-management demo path.
Primary sources (last verified 10 September 2026)
Every claim on this page is taken from one of these. MITRE's CVE Program; MITRE's CWE Program; FIRST's CVSS v4.0 Specification Document (published 1 November 2023); FIRST's CVSS v3.1 Specification Document (published 2019); NVD's published CVSS enrichment on individual CVE records. These are not a complete world list. Not legal advice.
The vulnerability-vs-exploit-vs-risk guide on this site is the definitions page. The what-is-KEV guide on this site is the exploitation-evidence page. The how-to-prioritize guide on this site combines all three signals into a decision order. A dedicated what-is-vulnerability-management pillar is not on this site yet. Naming it is not a link.
Frequently asked questions
Is a CVE the same as a CVSS score?
No. A CVE is an identifier for one specific disclosed vulnerability. A CVSS score is a separate severity rating computed for that CVE using a standardized formula. A CVE record commonly has a CVSS score attached, but the identifier and the score are maintained by different programs (MITRE's CVE Program versus FIRST's CVSS).
Should we use CVSS v3.1 or v4.0?
CVSS v4.0 is the current FIRST specification as of this verification. CVSS v3.1 remains very widely published, including by NVD, so in practice you will see both for the foreseeable future. Do not treat a v3.1 score as outdated by itself; check which version a vector string uses before comparing scores across CVEs.
Does a high CVSS score mean we are being actively exploited?
No. CVSS scores intrinsic technical severity assuming worst-case Threat and Environmental conditions. It does not measure whether anyone is exploiting the vulnerability. The CISA KEV catalog and FIRST EPSS are the signals that speak to exploitation; the what-is-KEV guide and the how-to-prioritize guide on this site cover combining all three.
What does a CWE identifier actually tell us that a CVE doesn't?
A CWE classifies the underlying category of weakness — for example, 'Cross-Site Scripting' or 'Deserialization of Untrusted Data.' Many distinct CVEs can share the same CWE. It is useful for spotting a recurring pattern of weakness across your codebase, which a single CVE cannot show you by itself.
Is the CVSS example vector on this page a guide to scoring our own vulnerabilities?
No. It is an illustrative, publicly documented example (CVE-2021-44228, Log4Shell) chosen because its scoring is stable and well recorded, used here purely to walk through what each CVSS metric means. Score your own findings using the FIRST calculator or your scanner's output, not by copying this example.
Published by ShipReady Metrics, an evidence-based technology and compliance intelligence platform. This guide is educational and vendor-neutral.