CVSS
The Common Vulnerability Scoring System, which classifies vulnerability severity into four levels—low, medium, high, and critical—and serves as the standard framework in the security field for assessing the danger level of vulnerabilities.
Core Facts
Under the CVSS scoring standard, scores of 7.0–8.9 are classified as high severity and 9.0–10.0 as critical, and the standard is maintained by the FIRST organization.
The CVSS Common Vulnerability Scoring System ranges from 0 to 10 and comprehensively considers dimensions such as attack vector, attack complexity, whether user interaction is required, and the impact on confidentiality, integrity, and availability.
After a vulnerability enters the NVD (National Vulnerability Database), it is assigned a CVSS score (0–10), where the Critical level corresponds to 9.0–10.0.
Timeline (last 90 days)
Projects in the industry have already attempted to use CVSS or custom P0–P3 severity grading standards to automatically classify issues reported by AI, with high-severity issues entering a fast track and low-severity issues being merged into batch tasks or ignored.
The vulnerability was named SneakPeek by Noma Security, and Anthropic scored it at CVSS v4.0 8.7 (high severity).
CVE entries provide structured information such as PoC (proof-of-concept code), affected version ranges, and CVSS severity scores.
This privilege escalation vulnerability has been registered as CVE-2026-88959, the registry gives it a CVSS score of 8.7, making it high severity, and it was published one month before the experiment, later than the training cutoff of both models.
NVIDIA assigned the vulnerability a CVSS severity score of 8.2/10, classifying it as High severity.
The CVSS vector for this vulnerability is: attack vector network, attack complexity low, no privileges required, no user interaction required, with only availability highly impacted, and no data leakage or privilege escalation involved.
This weighted scoring approach is consistent with the logic of CVSS (Common Vulnerability Scoring System) in the information security field, as both reject measuring risk by the number of vulnerabilities.
The CVSS score of this vulnerability, combined with "scope change," means its impact breaks out of the security boundary of the affected component itself and causes high impact on confidentiality, integrity, and availability.
Prioritizing Live Patching for critical vulnerabilities with a CVSS score of 9.0 or above is a relatively sound strategy.
CVSS provides a quantitative score from 0 to 10, and a CVSS score above 9.0 is typically labeled as Critical.
15 more timeline events
All Facts (20)
Under the CVSS scoring standard, scores of 7.0–8.9 are classified as high severity and 9.0–10.0 as critical, and the standard is maintained by the FIRST organization.
80%VerifiedThe CVSS Common Vulnerability Scoring System ranges from 0 to 10 and comprehensively considers dimensions such as attack vector, attack complexity, whether user interaction is required, and the impact on confidentiality, integrity, and availability.
75%VerifiedAfter a vulnerability enters the NVD (National Vulnerability Database), it is assigned a CVSS score (0–10), where the Critical level corresponds to 9.0–10.0.
75%VerifiedCVSS provides a quantitative score from 0 to 10, and a CVSS score above 9.0 is typically labeled as Critical.
65%VerifiedCVSS (Common Vulnerability Scoring System) is maintained by FIRST; the current mainstream version is CVSS 3.1, and vulnerabilities with a score below 4.0 are classified as low severity.
65%UnverifiedProjects in the industry have already attempted to use CVSS or custom P0–P3 severity grading standards to automatically classify issues reported by AI, with high-severity issues entering a fast track and low-severity issues being merged into batch tasks or ignored.
50%UnverifiedThe vulnerability was named SneakPeek by Noma Security, and Anthropic scored it at CVSS v4.0 8.7 (high severity).
50%UnverifiedCVE entries provide structured information such as PoC (proof-of-concept code), affected version ranges, and CVSS severity scores.
50%UnverifiedThis privilege escalation vulnerability has been registered as CVE-2026-88959, the registry gives it a CVSS score of 8.7, making it high severity, and it was published one month before the experiment, later than the training cutoff of both models.
50%UnverifiedNVIDIA assigned the vulnerability a CVSS severity score of 8.2/10, classifying it as High severity.
50%UnverifiedThe CVSS vector for this vulnerability is: attack vector network, attack complexity low, no privileges required, no user interaction required, with only availability highly impacted, and no data leakage or privilege escalation involved.
50%UnverifiedThis weighted scoring approach is consistent with the logic of CVSS (Common Vulnerability Scoring System) in the information security field, as both reject measuring risk by the number of vulnerabilities.
50%UnverifiedThe CVSS score of this vulnerability, combined with "scope change," means its impact breaks out of the security boundary of the affected component itself and causes high impact on confidentiality, integrity, and availability.
50%UnverifiedPrioritizing Live Patching for critical vulnerabilities with a CVSS score of 9.0 or above is a relatively sound strategy.
50%UnverifiedRed-team evaluations led by competitors carry an inherent risk of conflict of interest, and the AI safety field lacks a unified evaluation framework analogous to CVSS.
50%UnverifiedTraditional vulnerability scanning tools score on a per-repository or per-asset basis (e.g., CVSS scores) and cannot answer whether an attacker can chain multiple low-severity vulnerabilities into a complete attack chain.
50%UnverifiedWith a perfect CVSS score of 10, a score of 9.8 falls in the extremely high range of the 'Critical' level, meaning the vulnerability can be remotely triggered over the network, requires virtually no interaction, and has an extremely broad impact.
50%UnverifiedTypical tiered standards for bug bounty programs usually reference the CVSS (Common Vulnerability Scoring System).
50%UnverifiedCVSS is maintained by the FIRST organization and provides a severity score of 0–10 for vulnerabilities; OWASP maintains the Top 10 vulnerability classification list.
50%UnverifiedThe original CVSS corpus supports translation from 21 languages into English.
50%