CVE scoring and CVE security are essential for protecting modern software applications from emerging cyber threats. Identifying and prioritizing vulnerabilities effectively allows organizations to address the most critical risks first. CVE scoring provides a standardized way to rank vulnerabilities by severity, while CVE security practices ensure those risks are properly managed and mitigated.
In 2025, 48,185 CVEs were published, a 20.6% increase from 2024’s 39,962, and 38% were rated High or Critical severity. With volume growing this fast, having a strong CVE scoring and security strategy is no longer optional; it’s a necessity.
The bigger problem isn’t just volume, it’s that traditional analysis can’t keep pace with it. NIST’s NVD enriched nearly 42,000 CVEs in 2025, 45% more than any prior year, but that still wasn’t enough to keep up with rising submissions. As a direct result, only 28% of newly disclosed CVEs in 2025 received full NVD enrichment (CVSS score, CWE classification, CPE data), down sharply from 46.2% in 2024. These numbers highlight the growing urgency for organizations to have their own CVE security measures in place, rather than relying solely on NVD data arriving on time.
What Is CVE Scoring and Why It Matters for CVE Security?
CVE stands for Common Vulnerabilities and Exposures, a list of publicly disclosed cybersecurity vulnerabilities and exposures. Each entry in the CVE list gets a unique identifier called a CVE ID, which specifically references a vulnerability. The MITRE Corporation manages this system, standardizing how vulnerabilities are identified and cataloged. This ensures everyone in cybersecurity uses the same reference when discussing specific threats.
CVE scoring involves evaluating each CVE entry and assigning a numerical score based on its severity. This score helps organizations determine the priority level for addressing the vulnerability.
It allows them to allocate resources effectively and mitigate potential risks. The CVE scoring system evaluates factors like ease of exploitability. It also considers the impact on confidentiality, integrity, and availability (often referred to as the “CIA triad”). Additionally, it assesses the potential for remediation.
How NVD, the MITRE CVE List, and CVE Scoring Work Together
Understanding the connection between the National Vulnerability Database (NVD), the MITRE List, and CVE security is essential for grasping how vulnerabilities are managed in the cybersecurity ecosystem.
The MITRE CVE List starts by identifying vulnerabilities and assigning them a CVE ID. However, this list provides only the basic information about each vulnerability. The NVD, operated by the National Institute of Standards and Technology (NIST), enriches this data by providing detailed descriptions, references, and most importantly, CVE scoring through the Common Vulnerability Scoring System (CVSS).
NVD is a key resource because it serves as a repository of standards-based vulnerability data, which helps organizations understand the impact of a vulnerability more comprehensively. NVD includes not only CVSS scores but also in-depth information such as:
- Detailed descriptions of each vulnerability, including technical details and the context in which the vulnerability could be exploited.
- Impact metrics that show how the vulnerability could affect different parts of an organization’s system.
- Remediation information such as links to patches, advisories, and mitigations.
Because of its comprehensive nature, the NVD is the go-to source for organizations when they need to assess the real-world impact of a vulnerability and understand how to address it effectively.
CVSS: The Most Common CVE Scoring System in Cybersecurity
The most widely used method for CVE scoring is the Common Vulnerability Scoring System (CVSS), maintained and developed by the Forum of Incident Response and Security Teams (FIRST). CVSS provides a standardized way of measuring the severity of vulnerabilities, making it easier for organizations to prioritize which ones to address first.
Specifically, CVSS scores vulnerabilities on a scale from 0 to 10. Here, 0 represents no risk and 10 represents the highest severity level. Moreover, the scoring is based on four main metric groups:
Base Score:
This reflects the intrinsic characteristics of a vulnerability that are constant over time and across user environments. The base score considers factors like exploitability. This refers to how easy it is to exploit the vulnerability. It also evaluates the impact on confidentiality, integrity, and availability.
Temporal Score:
This adjusts the base score based on factors that change over time, like whether a fix is available or if an exploit is actively being used. Temporal metrics include exploit code maturity, remediation level, and report confidence.
Environmental Score:
This allows organizations to customize the CVSS score to reflect the impact of the vulnerability within their specific environment. It considers factors like the importance of the affected system and the potential collateral damage.
Supplemental Metric Group:
It is introduced in CVSS v4.0 and provides additional context that can influence the overall risk assessment. This includes considerations like safety requirements, automatable metrics (which measure how automation impacts exploitation), and unique characteristics that might not fit within the other metric groups. Although the overall CVSS score does not include these metrics, they offer valuable insights. As a result, they help organizations make more informed decisions about managing vulnerabilities.
The latest version, CVSS v4.0, introduces these enhancements to improve the accuracy and usability of vulnerability scoring. By refining the metrics, CVSS v4.0 captures the complexity and context of vulnerabilities more effectively. This ensures that the scores provide a more precise reflection of the actual risk.
Real-World Example: CVE-2021-44228 (Log4Shell)
To illustrate how CVE scoring works in practice, let’s look at CVE-2021-44228, commonly known as Log4Shell. This Apache Log4j 2 library vulnerability allows for remote code execution (RCE). As a result, an attacker could take control of an affected system.
- CVE ID: CVE-2021-44228
- CVSS Base Score: 10.0 (Critical)
- Attack Vector: Network (N) – Exploitable remotely.
- Attack Complexity: Low (L) – Straightforward to exploit.
- Privileges Required: None (N) – No privileges needed.
- User Interaction: None (N) – No user interaction is required.
- Scope: Changed (C) – Affects resources beyond its original scope.
- Confidentiality, Integrity, Availability Impact: High (H) – Complete compromise of confidentiality, integrity, and availability.
NVD provided a CVSS score of 10.0, indicating the highest level of severity. The widespread nature of this vulnerability, combined with the ease of exploitation, made it a top priority for remediation across the globe.
Challenges in CVE Scoring and Their Impact on CVE Security
While the Common Vulnerabilities and Exposures (CVE) system offers a standardized way to identify and track vulnerabilities, several limitations affect its effectiveness in managing risks.
CVE-2021-44228 (Log4Shell) illustrates these challenges:
- Limited Detail on Exploitation: CVE-2021-44228 provides a unique identifier but lacks comprehensive details on how attackers might exploit it. Although experts consider it critical, the CVE entry does not fully explain the exact methods attackers use or the specific configurations that increase vulnerability. This gap leaves organizations uncertain about the real-world risk.
- Variability in Reporting: CVE records vary widely in content and quality. Some, like CVE-2021-44228, offer detailed descriptions and technical information, while others remain brief or incomplete. This inconsistency challenges organizations when they try to assess a vulnerability’s risk based solely on its CVE entry.
- Lack of Contextual Relevance: CVE entries use a standardized format that might not reflect the specific context of different environments. For instance, CVE-2021-44228 impacts systems differently depending on a company’s infrastructure. This misalignment leads to inaccurate risk assessments if the CVE details don’t match the specific environment.
- Delay in Disclosure: There’s often a lag between discovering a vulnerability and adding it to the CVE database. During this gap, attackers might exploit vulnerabilities like CVE-2021-44228 before they become public, increasing the risk due to delays in awareness and remediation.
- Focus on Known Vulnerabilities: CVE entries cover only publicly disclosed vulnerabilities, which leaves zero-day vulnerabilities and undisclosed threats unaccounted for. Relying solely on CVE exposes organizations to emerging risks that the database has not yet cataloged.
- Inconsistent Quality of Entries: The quality of CVE entries varies depending on the source. Some, like CVE-2021-44228, receive regular updates with new details, while others remain static, leading to inconsistencies and potential gaps in data.
- The NVD Enrichment Backlog: Even after a CVE is published, there’s no guarantee it will be scored promptly. 54,914 CVEs from 2024–2025 remain in the NVD queue awaiting full analysis. In April 2026, NIST announced it will now only prioritize immediate enrichment for CVEs in CISA’s Known Exploited Vulnerabilities (KEV) catalog, software used within the federal government, and critical software as defined by Executive Order 14028. Everything else is enriched on a best-effort basis, meaning most organizations can no longer assume a CVSS score will be available when they need it most.
EPSS: Enhancing CVE Security for Comprehensive Vulnerability Management
CVE-2021-44228 also highlights where the Common Vulnerability Scoring System (CVSS), while robust, falls short. This shortcoming underscores the importance of the Exploit Prediction Scoring System (EPSS).
What is EPSS?
EPSS uses a data-driven framework to predict the likelihood of exploitation for vulnerabilities like CVE-2021-44228 within the next 30 days. Unlike CVSS, which measures potential impact, EPSS estimates the probability of exploitation based on historical data and trends.
Why EPSS Matters?
- Enhanced Prioritization: EPSS enables organizations to prioritize vulnerabilities based not just on severity but also on the likelihood of exploitation. For example, when security teams know that CVE-2021-44228 has a high probability of exploitation, they focus remediation efforts where they need it most.
- Proactive Defense: EPSS allows security teams to take preemptive actions against likely-to-be-exploited vulnerabilities, reducing the risk of successful attacks.
- Contextual Decision-Making: EPSS provides additional context that CVSS alone might miss, such as identifying vulnerabilities actively targeted by attackers. This leads to more informed and strategic decision-making.
- Resource Optimization: For organizations with limited resources, EPSS helps efficiently allocate efforts to vulnerabilities that pose the greatest threat, ensuring a more effective defense strategy.
Limitations of EPSS
Despite its advantages, EPSS has limitations. It relies on historical data, which might not always reflect the current threat landscape. Its short-term focus on predicting exploitation within 30 days may overlook long-term threats.
EPSS provides general insights without accounting for the specific context of individual environments. Finally, it depends on past exploitation patterns, which might not capture rapid changes in attack techniques or newly discovered vulnerabilities.
Balancing CVE and EPSS for Optimal Vulnerability Management
To manage vulnerabilities effectively, organizations must understand and address the limitations of both CVSS and EPSS. Integrating these tools gives a more comprehensive view of the vulnerability landscape. This approach balances severity with the likelihood of exploitation, leading to better prioritization, informed decision-making, and improved cybersecurity outcomes.
Tackles the Challenge of Prioritizing Critical Vulnerabilities
Throughout this blog, we’ve explored the intricacies of CVE scoring, the crucial role of the National Vulnerability Database (NVD), and how tools like the Exploit Prediction Scoring System (EPSS) add depth to vulnerability management by predicting the likelihood of exploitation. However, managing vulnerabilities effectively requires more than just understanding these concepts—it demands a comprehensive approach that adapts to your organization’s specific security needs.
Out of approximately 176,000 known vulnerabilities, over 19,000 carry a CVSS score of 9.0–10.0, signifying critical risks. Yet, the majority—about 77.5%—fall within a mid-range score of 4.0 to 8.0. This wide distribution highlights the challenge: of prioritizing which vulnerabilities to address first and how to do so with limited resources while maintaining a robust defense.
Xygeni’s Software Composition Analysis (SCA) solution addresses this challenge by integrating CVE scoring with EPSS and other contextual tools, giving you a complete picture of your vulnerability landscape. Our solution thoroughly scans your codebase across multiple sources, including NPM, GitHub, and OWD, ensuring you don’t miss any potential security threats.
How Xygeni’s SCA Solution Turns CVE Scoring Into Action
Out of the 48,185 CVEs published in 2025, 38% were rated High or Critical severity, and the average CVSS score for the year was 6.60. That’s a lot of “critical” and “high” labels competing for the same limited remediation resources, and that’s before accounting for the fact that only 28% of 2025 CVEs received full NVD enrichment in the first place.
Xygeni’s Software Composition Analysis (SCA) solution addresses this challenge by integrating CVE scoring with EPSS and additional contextual signals, giving you a complete picture of your vulnerability landscape, independent of whether NVD has gotten around to enriching a given CVE yet. It scans your codebase across npm, GitHub, and other open-source registries, so nothing slips through unnoticed.
Here’s how it complements your vulnerability management strategy:
- CVE Scoring + EPSS Integration. Combining severity (CVSS) with exploitation likelihood (EPSS) means your team fixes what’s actually being exploited in the wild first, not just what scores highest on paper.
- Reachability Analysis. Xygeni doesn’t stop at “this CVE exists in your dependency tree.” It determines whether the vulnerable code path is actually reachable in your application, cutting noise dramatically and focusing remediation on exploitable risk.
- Contextual Awareness. By pulling from multiple advisory sources and scoring systems at once, Xygeni adapts to your organization’s specific environment instead of applying a one-size-fits-all severity score.
- Continuous Monitoring & Real-Time Alerts. New CVEs and new EPSS scores are published constantly. Xygeni monitors continuously, so a vulnerability that was low-priority yesterday, and becomes actively exploited today, doesn’t go unnoticed.
The result: with over a third of new CVEs already flagged High or Critical, and NVD enrichment falling further behind every year, manually triaging every finding isn’t realistic. Xygeni helps your team focus on the small fraction that’s both severe and genuinely exploitable in your environment.
Request a Demo or start a Free to see how Xygeni turns CVE scoring into a prioritized, actionable vulnerability management strategy.
FAQs
What’s the difference between CVE, CVSS, and NVD?
A CVE is a unique identifier for a specific vulnerability. CVSS (Common Vulnerability Scoring System) is the scoring framework used to rate that vulnerability’s severity from 0 to 10. The NVD (National Vulnerability Database) is the repository, maintained by NIST, that enriches each CVE with its CVSS score, descriptions, and remediation references.
What is EPSS, and how is it different from CVSS?
EPSS (Exploit Prediction Scoring System) estimates the probability that a vulnerability will be exploited in the next 30 days, based on real-world exploitation data. CVSS measures potential severity if exploited; EPSS measures the likelihood of exploitation. Using both together gives a far more accurate prioritization signal than either alone.
Why isn’t a high CVSS score enough to prioritize a vulnerability?
A CVSS score reflects theoretical severity, not real-world risk. A “critical” 9.8-scored vulnerability that’s unreachable in your specific codebase, or has no known active exploitation, may be lower priority than a “medium” one that attackers are actively exploiting right now. That’s why pairing CVSS with EPSS and reachability analysis matters.
How many CVEs are published each year?
CVE volume has grown consistently year over year, with tens of thousands of new vulnerabilities disclosed annually. Given this scale, manual triage isn’t realistic for most organizations, which is why automated, context-aware prioritization (CVSS + EPSS + reachability) has become essential.
What is CVE-2021-44228 (Log4Shell), and why is it used as an example?
Log4Shell is a critical remote code execution vulnerability in Apache Log4j 2, scored 10.0 (the maximum) on CVSS. It’s widely used as a teaching example because it combines network-based exploitability, no privileges required, and no user interaction, illustrating exactly what “critical” looks like under the CVSS framework.
