cvss
Safeguard articles tagged "cvss" — guides, analysis, and best practices for software supply chain and application security.
62 articles
When One CVE Has Three Scores, Taking the Highest Is Not Caution
NVD says 9.9. The vendor says 7.0. CVSS v4 says 6.3. Collapsing that to 9.9 does not make you conservative — it discards the disagreement, which was the most informative thing you had.
A CVSS 5.3 That Cisco Rated High: Static Credentials in Firewall Management Center
CVE-2026-20316 scores 5.3. Cisco rated its security impact High anyway, and CISA added it to the KEV catalogue. On a firewall management appliance, the base score measures the wrong thing.
NVD vs CVE: What's the Difference?
CVE is the list of vulnerability identifiers; the NVD is the enriched database built on top of it. They are related but run by different programs, and confusing them leads to real mistakes.
When CVSS Scoring Misleads Severity Context
Only 2-6% of published CVEs are ever exploited in the wild, yet a much larger share carry CVSS 7.0+ scores — a gap that quietly wrecks patch prioritization.
What Is Vulnerability Management? A Complete Explanation
Vulnerability management is the continuous, cyclical process of identifying, prioritizing, remediating, and verifying security weaknesses across your software and systems. Here's the full lifecycle and how to run it without drowning in findings.
Common Configuration Scoring System (CCSS) explained
NIST published CCSS in December 2010 to score misconfigurations the way CVSS scores bugs — most cloud teams have never applied it.
CVSS 4.0 vs. 3.1: what actually changed, and why your priority list should too
CVSS 4.0 killed the Scope metric, added Attack Requirements, and split scoring into CVSS-B/BT/BE/BTE labels — here's what that means for triage.
Exploitability vs. breakability: a practical rubric for vulnerability triage
CVSS says a flaw could be bad. CISA's KEV catalog, now past 1,300 entries, says one actually was exploited. Most teams still triage as if the two are the same.
Prioritizing vulnerabilities by real-world risk, not raw CVSS score
Kenna/Cyentia found just 2.6% of 2019's tracked CVEs were ever actively exploited — yet most teams still triage backlogs by CVSS score alone.
Using EPSS scores for vulnerability remediation prioritization
EPSS predicts exploitation probability for every CVE on a 0-1 scale, updated daily. Paired with CVSS, it turns a 1,000-ticket backlog into a short, defensible list.
CWE vs. CVE vs. CVSS: The Vocabulary Every AppSec Team Gets Wrong
One CWE weakness class can spawn thousands of CVEs, and a single CVE can now carry two different CVSS scores at once — most teams still use the terms interchangeably.
CVSS, EPSS, and KEV Explained: A Prioritization FAQ
CVSS measures severity, EPSS estimates exploitation likelihood, and CISA KEV lists what is actively exploited. Here is how the three differ and how to use them together.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.