CVSS (Common Vulnerability Scoring System)

CVSS translates a vulnerability's characteristics — how it is exploited, what access it requires, what impact it has on confidentiality, integrity, and availability — into a single numeric score, generally bucketed into Low, Medium, High, and Critical severity ranges. Two vulnerabilities with wildly different technical details can end up with similar CVSS scores if their real-world impact is comparable, which is exactly the point: it gives triage queues a consistent way to sort work. Venstap attaches CVSS scoring to findings so that severity-based triage, dashboard breakdowns, and prioritization work consistently whether a finding came from an automated nuclei template or a manual pentest note.