flawopen.com/Severity explained
CVSS (Common Vulnerability Scoring System) turns a vulnerability's severity into a number from 0.0 to 10.0. The number alone doesn't tell you how urgent it is for your app — you need the pieces that make it up, not just the final digit.
A 9.8 on a vulnerability in a library you don't actually use anywhere reachable by untrusted input is not urgent for you, whatever the number says. A 6.5 on something processing every incoming request with no authentication in front of it might matter more in practice than the number suggests. CVSS scores exploitability and technical impact in the abstract — not your specific deployment, your specific data sensitivity, or what's actually reachable from the internet in your setup.
Network-reachable (worst case) vs. requiring local access vs. requiring physical access. A network-reachable flaw scores higher because far more attackers can attempt it.
"None" scores higher than "requires an authenticated account" — an unauthenticated flaw is exploitable by literally anyone who can reach the endpoint.
Scored separately for confidentiality (can they read data they shouldn't), integrity (can they change data), and availability (can they take the system down). A vulnerability that hits all three scores much higher than one that only affects one.
Usually, but check reachability first — an unreachable 9.8 in code your app never executes is lower real-world priority than a reachable 6.5 in your actual request path.
No — whether it's actively being exploited in the wild (check CISA's KEV catalog), whether it's reachable in your specific deployment, and what data is actually exposed all matter as much or more than the raw score.