Moderate and Medium usually name the same band, 4.0 to 6.9 on the CVSS scale, but tools differ in which words they print, which score version they use and who supplied the rating. Before comparing two reports, check the label vocabulary, the score source and the version.
The same band, different words
The CVSS qualitative scale from FIRST is None, Low, Medium, High and Critical. GitHub's advisory database documents its four levels as Low, Medium/Moderate, High and Critical, so the word "Moderate" shows up in that world. The npm command line uses "moderate" in the values accepted by its audit-level setting: info, low, moderate, high, critical and none.
| Where | Words you may see |
|---|---|
| CVSS specification | None, Low, Medium, High, Critical |
| GitHub advisory database | Low, Medium/Moderate, High, Critical |
| npm audit level setting | info, low, moderate, high, critical, none |
So a label of moderate in one tool and medium in another usually refers to the same range. It is a naming difference, not a disagreement.
Where real disagreement comes from
Labels can differ for reasons that do change meaning.
- Score version. A record may carry a CVSS 3.0, 3.1 or 4.0 vector. GitHub says its database supports 3.1 and 4.0, and imported CVEs may also use 3.0. Different versions use different metrics, so a flaw can sit in different bands.
- Source of the rating. In the OSV schema a severity entry can name its source: NVD, CNA or SELF. Two tools reading two sources can show two labels.
- Vendor ratings. A Linux distribution may rate a flaw with its own scale. Debian's FAQ states it does not use external CVSS scores when triaging issues, so a distribution label may not line up with the CVSS label.
- Tool policy. Some tools lower or raise a score using their own signals, such as exploit data. If a tool states this, keep it in mind. If it does not, ask.
A checklist for comparing two reports
- Write down the label scale each tool uses.
- Find the vector string for the same finding in each report. If a vector is shown, compare it directly. The prefix tells you the version.
- Find the source of the rating, if the tool shows one.
- Note whether the tool adds its own signals.
- Compare the findings by identifier, not by label. An advisory ID or CVE ID is the stable anchor.
If the vectors match and only the words differ, you are done. If the vectors differ, decide which source you trust for this finding and record it.
What to put in a policy
If you gate builds on severity, say in the policy which scale the gate uses. A rule that says "block on high" is ambiguous when one tool prints "severe" or "high" and another prints "critical" for the same advisory. Define the rule in terms of a specific field, for example the CVSS base rating from a named source, and write down what happens when it is missing.
When you migrate from one scanner to another, map labels explicitly in a table and test the mapping on a sample of findings. A silent change in vocabulary is a common reason a gate suddenly blocks more or fewer builds.
Missing ratings
Some records have no severity. In OSV the severity field is optional. A scanner may show "unknown" or leave the column blank. Do not treat that as low. Treat it as unrated, and decide what to do with unrated findings in your policy: review them, or treat them at a default level you choose.
Safeguard's policies, gates and guardrails let you define which severity and other signals block a change, so the rule is written once and applied consistently. A free scan is at gold.safeguard.sh/scan.
Quick check
Is Moderate lower than Medium?
No. In the advisory database documentation Medium/Moderate is one level, between Low and High.
Why does one tool say High and another Medium for the same CVE?
The score version, the rating source or the tool's own adjustments may differ. Compare vector strings and sources before deciding which to trust.
Sources
- FIRST, CVSS v3.1 Specification Document
- GitHub Docs, About the GitHub Advisory database
- npm Docs, npm audit
- OpenSSF, OSV schema
- Debian, Security FAQ
Last reviewed: 19 October 2026.
