Read the prefix of the vector string. CVSS:3.1/ means version 3.1, CVSS:4.0/ means version 4.0, and a CVSS:3.0/ prefix means the older 3.0. A bare number with no vector hides the version, so open the details and find the string before you compare scores.
Spotting the version
The vector always begins with the label CVSS and a colon, then the version, then a slash.
| Prefix | Version | Tell-tale metrics |
|---|---|---|
| CVSS:3.0/ | 3.0 | Older version, still seen on some imported records |
| CVSS:3.1/ | 3.1 | Eight base metrics: AV, AC, PR, UI, S, C, I, A |
| CVSS:4.0/ | 4.0 | Eleven base metrics, including AT, VC, VI, VA, SC, SI, SA |
Both specifications state the prefix format. In 3.1 it is CVSS:3.1/ followed by metric pairs. In 4.0 it is CVSS:4.0/. If a vector has no AT and no S, but has SC, SI and SA, you are looking at 4.0.
A quick example of each shape:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Why one flaw can have several
Different sources score at different times and with different versions. GitHub's advisory database supports CVSS 3.1 and 4.0, and imported CVEs may also use 3.0. In the OSV schema, the severity array holds typed entries: CVSS_V3 for versions from 3.0 up to but not including 4.0, and CVSS_V4 for 4.0 onward. A single record can therefore carry both a v3 and a v4 entry, each with an optional source.
So if two tools show different scores for the same advisory, check whether they read different versions first.
What to do when versions disagree
- Compare vectors, not numbers. Two vectors from different versions are different descriptions.
- Do not average or convert scores between versions. The metric sets differ, so treat the numbers as separate descriptions.
- Pick one version as your reference for gating and say so in policy. You might keep 3.1 as the reference while 4.0 coverage grows, then switch once most records carry it. That is a team choice, not a rule.
- Keep the second version as supporting evidence. The 4.0 vector adds Attack Requirements and separate impact fields for the vulnerable and subsequent systems, which can help you reason about blast radius.
The nomenclature in 4.0
The 4.0 specification asks that a numeric score be labelled with the metrics used: CVSS-B for base, CVSS-BT for base and threat, CVSS-BE for base and environmental, and CVSS-BTE for all three. It states that this nomenclature should be used wherever a numerical CVSS value is displayed or communicated. If your scanner prints a bare 9.8 with no label, you cannot tell which kind it is.
Bands stay the same
Despite the differences in metrics, both versions use the same qualitative bands: Low 0.1 to 3.9, Medium 4.0 to 6.9, High 7.0 to 8.9, Critical 9.0 to 10.0. The 4.0 specification says the boundaries were chosen to be backwards compatible with 3.x. The numbers inside the bands come from different formulas.
A one-line habit
Whenever you paste a CVSS score into a ticket, paste the vector with it. Six months later, someone can tell what you meant.
Safeguard's SBOM and dependency scanning keep advisory identifiers and vectors alongside each finding, so you can see which record a rating came from. A free scan is at gold.safeguard.sh/scan.
Quick check
Can I convert a 3.1 score to a 4.0 score?
Not reliably. The metric sets differ, so treat the scores as separate descriptions and compare the vectors instead.
What does CVSS-B mean next to a score?
It means the score uses base metrics only. CVSS-BT, CVSS-BE and CVSS-BTE add threat, environmental, or both.
Sources
- FIRST, CVSS v3.1 Specification Document
- FIRST, CVSS v4.0 Specification Document
- GitHub Docs, About the GitHub Advisory database
- OpenSSF, OSV schema
Last reviewed: 19 October 2026.
