Common Vulnerability Scoring System (CVSS)

CVSS is an open standard for rating the severity of security vulnerabilities on a 0.0–10.0 scale. conda-cve.tech displays severities from public vulnerability advisories; it does not calculate scores itself.

What you see in a scan report

Colored badges — Critical, High, Medium, Low, or Unknown.
Numeric score — e.g. High (7.5) is the CVSS v3 base score when provided.
Sort order — CVEs are listed highest severity first; packages with CVEs are ordered by their worst CVE.

Severity ratings (CVSS v3.1)

Critical High Medium Low Unknown

Rating	Base score	Typical meaning
Critical	9.0 – 10.0	Severe impact, often easy to exploit remotely; patch urgently.
High	7.0 – 8.9	Serious compromise or high impact; prioritize remediation.
Medium	4.0 – 6.9	Meaningful but more constrained impact or harder exploitation.
Low	0.1 – 3.9	Limited impact; fix in normal maintenance windows.
Unknown	—	Advisory has no CVSS score yet — not the same as “safe.”

MODERATE from some databases is shown as Medium.

Base score vs. environmental risk

The base score describes the vulnerability in isolation. It does not know whether your service is on the public internet, behind a firewall, or unused in your image. A Critical CVE in an unused library may be irrelevant; a Medium CVE on an exposed admin port may be urgent for you.

CVSS also defines temporal (exploit availability, patch status) and environmental (your asset value, exposure) scores. Those are rarely returned by the APIs conda-cve.tech returns; use the linked CVE advisory pages for deeper analysis.

What base metrics describe (v3.1, simplified)

Vector strings encode factors such as:

Attack Vector — must the attacker be on the network, adjacent, local, or physical?
Attack Complexity — are special conditions required to exploit?
Privileges Required — none, low, or high privileges before attack?
User Interaction — must a user be tricked into an action?
Scope — can impact spread beyond the vulnerable component?
C / I / A impact — effect on confidentiality, integrity, and availability.

Limitations in conda-cve.tech

Severity is only as complete as published advisory data for your locked versions.
Empty CVE lists are trustworthy only when coverage.checked is true.
CVSS prioritizes advisories; it does not replace dependency review or penetration testing.

Official references

← Back to scanner