Vulnerabilities & CVSS Scoring
How RiskShelter identifies CVEs across your attack surface and helps you prioritize what to fix first.
Not all vulnerabilities deserve the same urgency. RiskShelter scores every finding using CVSS v3.1 so your team has a consistent, objective basis for prioritization.
Severity levels
| Severity | CVSS Score | What it typically means |
|---|---|---|
| Critical | 9.0 – 10.0 | Remote code execution, unauthenticated database access, known in-the-wild exploits. Fix within 24 hours. |
| High | 7.0 – 8.9 | Privilege escalation, authentication bypass, public-writable storage. Fix within 7 days. |
| Medium | 4.0 – 6.9 | Missing security headers, version disclosure, outdated minor software versions. Fix within 30 days. |
| Low / Info | 0.1 – 3.9 | Verbose server banners, minor SSL config issues. Track and schedule. |
What each finding includes
Every vulnerability in the Vulnerabilities tab links to its CVE entry, identifies the exact asset where it was detected (subdomain, IP, port), explains the risk in plain language, and provides specific remediation steps, not just a link to a changelog.
Compliance mapping
Findings are automatically tagged with the compliance controls they affect. A public database port maps to SOC 2 CC6.1 (logical access) and ISO 27001 A.8.20 (network security). An expired certificate maps to CC6.7 (data transmission security) and A.8.24 (cryptography). This makes it straightforward to pull together evidence for audits without extra work.