Direct comparison
CVE vs CVSS: Vulnerability ID vs Severity
Compare CVE and CVSS in cybersecurity: understand how vulnerability identifiers differ from numerical severity scoring systems and triage workflows.
Written and maintained by CASRAI Editorial Board
Last updated
Ask CASRAI · free to try
Ask about CVE vs CVSS: Vulnerability ID vs Severity
Ask your first 2 questions free below. Subscribers get 150 a day for $29 a month.
An AI assistant specialized in research administration. It cites the sources behind every answer, labels web answers and says when it can't answer.
Answers draw on CASRAI's guides and dictionary plus the federal and funder documents we index: Federal Register, Grants.gov, Regulations.gov and UKRI.
Works on this site and inside Claude, Cursor and the AI tools you already use.
Everything CASRAI publishes — this page, the dictionary, the guides and the news — stays free to read, with no account and no card.
How do CVE (Common Vulnerabilities and Exposures), CVSS (Common Vulnerability Scoring System) compare side by side?
The table below compares CVE (Common Vulnerabilities and Exposures), CVSS (Common Vulnerability Scoring System) across 11 procurement-relevant dimensions, from governing body through source.
Side-by-side comparison
| Dimension | CVE (Common Vulnerabilities and Exposures) | CVSS (Common Vulnerability Scoring System) |
|---|---|---|
| Governing Body | Operated by the MITRE Corporation and sponsored by the Cybersecurity and Infrastructure Security Agency (CISA). | Maintained and stewarded by FIRST.Org, Inc. (Forum of Incident Response and Security Teams). |
| Core Function | Serves as an authoritative, standardized dictionary and identification index for publicly known cybersecurity flaws. | Provides an open mathematical framework to communicate the technical characteristics and severity rating of vulnerabilities. |
| Standard Output | A unique identifier formatted as CVE-YYYY-NNNN+ accompanied by a standardized description and public reference links. | A numerical score from 0.0 to 10.0, a qualitative severity rating (None, Low, Medium, High, Critical), and a machine-readable vector string. |
| Scoring Methodology | Non-quantitative; does not score, rate, or rank vulnerabilities. Focuses solely on unambiguous identification. | Quantitative algorithm calculating Base metrics (Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, Impact) with optional Temporal and Environmental adjustments. |
| Metric Groups | Not applicable (categorized by CVE Numbering Authority, product, and publication date). | Composed of Base (intrinsic characteristics), Temporal/Threat (exploit maturity), and Environmental (local modified impact) metric groups. |
| Primary Data Role | Acts as the common lingua franca and primary key connecting disparate vulnerability databases, vendor patches, and threat feeds. | Quantifies technical risk severity to help organizations establish baseline patch prioritization thresholds. |
| Environmental Context | Static; the CVE record remains the same regardless of where the vulnerable software package is deployed. | Dynamic through Environmental metrics, allowing enterprise administrators to modify severity based on network topology and compensating controls. |
| Weakness Taxonomy Relationship | References underlying software flaw types mapped to Common Weakness Enumeration (CWE) categories. | Evaluates the observable impact resulting from the exploit of an underlying weakness, regardless of CWE classification. |
| Research Computing Workflow | Referenced in software bills of materials (SBOMs) and security compliance checklists to identify installed vulnerable libraries. | Utilized in risk management protocols to determine remediation deadlines and maintenance schedules under institutional security policies. |
| When to Choose / Use | Use CVE when cataloging software inventory, tracking patch releases, searching threat advisories, or referencing a specific flaw in audits. | Use CVSS when calculating vulnerability severity, setting operational SLA deadlines, or assessing technical exploitability across systems. |
| Source | CVE.org / MITRE Corporation CVE Program Overview (https://www.cve.org/About/Overview). | FIRST.Org CVSS Specification Document (https://www.first.org/cvss/v3.1/specification-document). |
Common questions
Common questions about CVE (Common Vulnerabilities and Exposures) vs CVSS (Common Vulnerability Scoring System)
What are the differences between CVE and CVSS in cybersecurity?
+
The fundamental difference is identification versus evaluation: Common Vulnerabilities and Exposures (CVE) assigns a unique, standardized identifier (such as CVE-2024-1234) to a publicly disclosed vulnerability, establishing a common catalog reference. In contrast, the Common Vulnerability Scoring System (CVSS) calculates a numerical score from 0.0 to 10.0 that measures the technical severity and exploitability of that specific flaw.
Going deeper
