Updates from the CVSS SIG

on YouTube ↗24m

" summary

Recent SIG activity reports 5,000 CVSS v4 vectors in the CVE program, ~8,000 on GitHub, and 56 unique vendors producing v4 scores; a 2024 survey with 500+ responses shows 74% favorable impressions and 85% of v4-producing organizations saying the move is worth it. Work focuses on CVSS v4 adoption tooling (a public tool and calculators), expanded examples and FAQs, guidance for per-platform reassessments, and an enhanced user guide with a possible v4.1 in 2026.

AI-written summary · about

" chapters (9)

1. 0:00CVSS SIG updates
2. 1:09CVSS v4 developments
3. 3:43Vendor adoption in CVSS v4
4. 5:10Documentation updates for CVSS v4
5. 8:20Per-platform CVSS assessments
6. 11:53Schema challenges in CVSS scores
7. 15:232024 CVSS SIG survey results
8. 18:33Future CVSS v4 plans
9. 20:49Benefits of CVSS v4

" related talks

• 01h 16mCVSS SIG Past, Present & Future + CVSS v4.0 Beyond the NumbersNick Leali · CVE/FIRST VulnCon 2024 & Annual CNA Summit
• 57mFIRST SIG UpdatesArt Manion, Aaron Kaplan, David Durvaux, Tom Millar, Dave Dugal, Rick Adrian, Nina Solha, Roderick Mooi, Mark Zajicek, Andreas Mühlemann, Olivier Caleff, Jeroen van der Hamm, Merike Kaeo · 34th Annual FIRST Conference 2022
• 40mCVSS Scores Are Dead. Let’s Explore 4 AlternativesAllan Liska · RSAC 2021
• 52mThe Evolution of CVEs, Vulnerability Management, and Hybrid ArchitecturesSander Vinberg, Dr. Benjamin Edwards · RSA Conference 2023
• 58mWhy Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization StandardsYotam Perkal · CVE/FIRST VulnCon 2024 & Annual CNA Summit
• 39mCVE 101: The Unfolding Of A Zero Day AttackTheresa Mammarella · Jfokus 2023
• 15mKeynoteDavid Marques · IT Security Conference 2025
• 56mCVE Is The Worst Vulnerability Framework (Except For All The Others)Ben Edwards, Sander Vinberg · CVE/FIRST VulnCon 2024 & Annual CNA Summit