basicsecurity.net
Proof, not just disclosure.

CVSS v3.1 vs v4.0 — across the known-exploited record.

Of the 1,667 known-exploited records, 18 carry both a CVSS v3.1 and a v4.0 base score — the only records where the two scales can be compared directly. CVSSv4 adoption is still sparse (5% of scored records), so this set is small but real, and every divergence below links to the cited record it came from.

01

Coverage

— who carries which scale
1,664
records with a CVSS
CVE.org / CISA-ADP / NVD
78
carry CVSSv4.0
5% of scored · CVE.org
18
carry BOTH v3.1 & v4.0
the comparison set
1546
v3.1
CVE.org
78
v4.0
CVE.org
69
v3.0 / v2.0
legacy · CVE.org

Basis · CVSS base scores as published by the CNA (CVE.org), CISA-ADP, or the NVD feed, captured per record. Version adoption is a coverage finding, not a filter.

02

How v4.0 re-scores v3.1

— on the 18 records carrying both
11
v4.0 scores LOWER
than the record's v3.1
5
v4.0 scores HIGHER
than the record's v3.1
2
unchanged
v4.0 == v3.1
0.64
mean |Δ|
absolute base-score gap

Where they diverge most

— |Δ| ≥ 1.5 base-score points; each links to its cited record
4.4 → 6.7
CVE-2025-21590
Δ +2.3 · CVE.org
5.3 → 6.9
CVE-2025-35939
Δ +1.6 · CVE.org

Basis · CVE.org CVSS metrics on each record. v3.1 and v4.0 measure different things, so a gap is expected; this is the empirical shift across this known-exploited set, not a claim that either is "right".