CVSS SIG Past, Present & Future + CVSS v4.0 Beyond the Numbers

on YouTube ↗01h 16m

" summary

CVSS v4.0 ships (published 2023-11-01) with concrete changes: new supplemental metrics, reworked subsequent system impact fields, attack requirements and expanded user interaction (none/passive/active), plus threat metrics replacing parts of temporal. Tooling is being built — JS reference libraries, calculators and NVD JSON v5.1 testing — but adoption stalls on integration and APIs; Tenable and Qualys are early adopters. Real examples show scores dropping by automation: Heartbleed 9.3 → 8.1 with exploitability unproven (and → 6.3 when modified AV), and a clamav scenario reduced to 2.7.

AI-written summary · about

" chapters (9)

1. 0:00Introduction
2. 1:04CVSS SIG overview
3. 8:14SIG structure changes
4. 13:14CVSS v4.0 challenges
5. 20:26Future plans for v5.0
6. 32:12Why CVSS v4.0 matters
7. 49:00CVSS v4.0 metrics demo
8. 1:00:16Q&A
9. 1:14:43Closing remarks

" related talks

• 24mUpdates from the CVSS SIGNick Leali · CVE/FIRST VulnCon 2025
• 57mFIRST SIG UpdatesArt Manion, Aaron Kaplan, David Durvaux, Tom Millar, Dave Dugal, Rick Adrian, Nina Solha, Roderick Mooi, Mark Zajicek, Andreas Mühlemann, Olivier Caleff, Jeroen van der Hamm, Merike Kaeo · 34th Annual FIRST Conference 2022
• 40mCVSS Scores Are Dead. Let’s Explore 4 AlternativesAllan Liska · RSAC 2021
• 50mCVSS v4.0 By The NumbersNick Leali · CVE/FIRST VulnCon 2025
• 32mExploit Maturity: Your New Best Friend in CVSSShelby Cunningham · CVE/FIRST VulnCon 2025
• 39mCVE 101: The Unfolding Of A Zero Day AttackTheresa Mammarella · Jfokus 2023
• 27mAsk Not Whether CVSSv3.1 and v4 Scores are Inconsistent, But What Can You Do About ItMengyuan Zhang, Siqi Zhang · CVE/FIRST VulnCon 2025
• 51mWhen it Comes to Managing Risk, Context is KingLucas Tamagna-Darr · CVE/FIRST VulnCon 2025