NKO DATA LABS
NKO Reality Check #002
Live — free checker, paid batches from €2,500

NKO Reality Check #002 · Vulnerability Severity Disagreement

We compared official severity scores for 2,000 real vulnerabilities. Where more than one source scored the same CVE, they disagreed on severity category 53% of the time — including 16 cases where the gap meant the difference between "fix eventually" and "fix now".

Every CVE can carry more than one official CVSS severity score — NVD's own analysts, the vendor's own PSIRT, GHSA (GitHub), and Authorized Data Publishers like CISA-ADP can each publish their own. We pulled 2,000 real CVEs published between 2026-07-15 and 2026-08-30 straight from NVD's own API. Only 188 (9.4%) had more than one independent score to compare — of those, 100 (53.2%) landed in a different severity category depending on which source you read, and 16 jumped two full categories at once (e.g. "Medium" on one side, "Critical" on the other).

What this is, and isn't. This is not "one organization is wrong" — it's a real, documented disagreement between independent, reasonable technical evaluations (in one of our examples, IBM's own PSIRT assumes a different access prerequisite than NVD does for the same flaw — both defensible, both official, both published). CVSS score fragmentation across organizations is a recognized, discussed problem in the security industry, not something we're claiming to have discovered — what we measured is how often it actually crosses a severity category in a real, dated sample, and by how much. We never say a source "got it wrong."

Check your own CVE — free, no account

Enter a CVE ID. We show every severity score we can find, its source, and whether they agree.

What we found, in numbers

2,000
real CVEs checked (NVD, 2026-07-15 to 2026-08-30)
188
had 2+ independent severity scores (9.4% — having more than one is the exception)
53.2%
of those 188 disagreed on severity category
16
jumped two full categories (e.g. Medium ↔ Critical)

Method

Ground truth for "how many independent scores exist": NVD's own API 2.0 record for each CVE, which already lists every CVSS score it has received, tagged with the real organization that submitted it (nvd@nist.gov, vendor PSIRTs, security-advisories@github.com for GHSA, CISA-ADP, etc.) — cross-referenced by CVE ID, never by text matching. CVSS v2 was excluded (0 of the 188 cases used it) because its severity bands aren't directly comparable to v3.x/v4.0; v3.0, v3.1 and v4.0 share the same official band cutoffs (Low 0.1-3.9, Medium 4.0-6.9, High 7.0-8.9, Critical 9.0-10.0), so comparing across those versions is valid.

We also checked whether the gap has a practical consequence beyond the category label: for 8 of these cases, we compared the full advisory — CVSS, CWE, affected-product scope — between GHSA and NVD field by field. In most cases the underlying data (weakness type, affected versions) was identical; the disagreement is specifically about how severe the same technical facts are judged to be, not about missing information. Full write-up, all 188 cases, and the 8-case field comparison: github.com/NKO-LLC-TECH/nko.

16 real cases where the category itself changes — plus contrast

16 real two-category jumps (highlighted), plus 2 one-category jumps and 2 cases of full agreement for contrast — every row links to the real NVD record so anyone can verify it independently.

CVEScores by sourceCategories seenGapEvidence

Batch checks

Free: up to 50 CVE IDs per request, no account, same engine as the single check above. Because NVD's own public API is rate-limited, batches are queued and processed in the background — you get a signed link to poll for the result. Paid: up to 10,000 CVEs for €2,500, delivered within 24-48h — every CVE's full source-by-source breakdown, agreement status, and category gap, ready to cross-reference against your own portfolio.

€2,500 — batch up to 10,000 CVEs

For checking a whole vulnerability portfolio at once — built for security-rating platforms, vulnerability management tools, and cyber-insurance underwriting, not single lookups. Same textarea above works for this — paste your list, confirm, pay, get a signed link to your results within 24-48h. No "contact sales" — this is the price.