Errata Gathered, Appraised & Documented
How Secur0’s triage team scores the harder CVSS 4.0 calls, one vulnerability class at a time. Each leaf holds the vectors for a class’s realistic scenarios, the per-metric reasoning, and where the line sits: why it isn’t scored higher, and the case where it would be.
Scores are derived from the vectors, never hand-typed. These are judgment calls, made in the open and revised as we go.
The folder tree on the left is the taxonomy. Start with Cross-Site Scripting, or search. If you think a call is wrong, bring a vector and a case. We do change our minds.