CVSS v3.1 vs v4.0: what changed and what the score means
Reviewed November 11, 2026 · figures computed from 1,780 CISA-listed CVEs in the 0dayNews dataset at build time
CVSS (Common Vulnerability Scoring System) is a FIRST.org standard that rates how severe a vulnerability is on a 0.0 to 10.0 scale. It describes the technical severity of the flaw, not how likely it is to be attacked or how much it matters in your environment.
Severity bands
Both v3.1 and v4.0 map scores to the same qualitative bands: None (0.0), Low (0.1 to 3.9), Medium (4.0 to 6.9), High (7.0 to 8.9) and Critical (9.0 to 10.0). Severity labels on 0dayNews follow the source record and we do not re-score.
What v4.0 changed
FIRST released CVSS v4.0 in November 2023. The changes that matter most when you read a score:
- Metric groups. v4.0 has Base, Threat, Environmental and Supplemental groups. A score is labelled by what went into it: CVSS-B for base only, CVSS-BT with threat metrics, CVSS-BE with environmental, CVSS-BTE with both. A bare base score is a worst-case, context-free number.
- Attack Requirements. A new Attack Requirements metric captures preconditions on the target that are separate from attack complexity.
- User Interaction is split into None, Passive and Active rather than None and Required.
- Scope is gone. v3.1's Scope metric is replaced by separate impact ratings for the vulnerable system and for subsequent systems.
- Threat metrics include an Exploit Maturity metric, so exploitation evidence can be reflected in the score if someone fills it in.
Which version are you looking at?
CVE records can carry v2, v3.x and v4.0 scores, supplied by the CNA that assigned the ID, by NVD, or both, and they can disagree. Check the version and the scoring source before comparing two CVEs. Scores for the same flaw can legitimately differ between versions and between scorers.
Severity is not exploitation
Among the 1,763 CISA-listed CVEs where we hold a score, 1,134 (64%) are below 9.0 and 220 (12%) are below 7.0. A queue sorted by CVSS alone would push a large share of confirmed-exploited bugs down the list. That is why CVSS works best alongside KEV and EPSS; see how to combine them.