Hardening and auditing

CVSS and CVE

Also called CVE, common vulnerabilities and exposures, CVSS score, severity, base score, critical high medium low, prioritisation

A CVE names a specific known vulnerability; its CVSS score rates how severe it is, so findings can be prioritised.

A CVE (Common Vulnerabilities and Exposures) is a stable identifier for one specific flaw — CVE-2024-6387 is the OpenSSH "regreSSHion" bug — so everyone refers to the same thing. CVSS (Common Vulnerability Scoring System) rates its severity from 0 to 10 from factors like how it is reached (network vs local), how hard it is to exploit, and what it costs you (confidentiality, integrity, availability); the number maps to Low / Medium / High / Critical. A scan can return hundreds of findings, so the score is how you decide what to fix first: a network-reachable Critical before a local Low. The score is a guide, not a verdict — context (is the service exposed? is there a mitigation?) still decides urgency.

See it on real machines

Learn it on real machines.