What is a CVE and What Does a CVSS 10.0 Score Actually Mean?

Whenever you run npm audit, check a GitHub Dependabot alert, or read a security advisory, you encounter two standardized acronyms: CVE (e.g., CVE-2026-110264) and CVSS (e.g., Score: 9.8 Critical).

For many developers, these look like bureaucratic serial numbers. In reality, they form the universal language that keeps global internet infrastructure from collapsing. Let's demystify how CVEs are assigned and how CVSS scores are mathematically calculated.

1. What is a CVE (Common Vulnerabilities and Exposures)?

Launched by the MITRE Corporation in 1999, CVE is a global dictionary of publicly disclosed cybersecurity vulnerabilities.

Before CVE existed, if a memory corruption bug was found in OpenSSL, five different security vendors would give it five different internal names, making it impossible for system administrators to know if they were patching the same bug.

Today, every verified vulnerability receives a single, globally unique identifier formatted as CVE-YYYY-NNNNN:

• YYYY: The year the vulnerability was assigned or disclosed.
• NNNNN: A unique sequential serial number issued by a CNA (CVE Numbering Authority) such as GitHub, Google, Red Hat, or Microsoft.

2. What is CVSS (Common Vulnerability Scoring System)?

While a CVE gives a bug its name, CVSS measures its severity on a scale from 0.0 to 10.0.

3. Anatomy of a 10.0 Score: The 5 Conditions of Total Takeover

A vulnerability doesn't get a 9.8 or 10.0 score because someone felt dramatic. It is computed from a vector string like:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

For a flaw to hit 9.8 or 10.0, five nightmare conditions must align simultaneously:

1. Attack Vector = Network (AV:N): Exploitable remotely over the public internet.
2. Attack Complexity = Low (AC:L): Deterministic exploit; no complex timing or lucky heap layout needed.
3. Privileges Required = None (PR:N): The attacker does NOT need a user account, password, or API token.
4. User Interaction = None (UI:N): Zero phishing required; nobody has to click a link.
5. Impact = High (C:H/I:H/A:H) + Scope Changed (S:C): Complete loss of Confidentiality (read all secrets), Integrity (modify any file/code), and Availability (crash the server), escaping the vulnerable component into the host OS or container!