basicsecurity.net
Proof, not just disclosure.

CVSS v3.1 vs v4.0 — across the known-exploited record.

Of the 1,768 known-exploited records, 31 carry both a CVSS v3.1 and a v4.0 base score — the only records where the two scales can be compared directly. CVSSv4 adoption is still sparse (7% of scored records), so this set is small but real, and every divergence below links to the cited record it came from.

01

Coverage

— who carries which scale
1,763
records with a CVSS
CVE.org / CISA-ADP / NVD
115
carry CVSSv4.0
7% of scored · CVE.org
31
carry BOTH v3.1 & v4.0
the comparison set
1621
v3.1
CVE.org
115
v4.0
CVE.org
74
v3.0 / v2.0
legacy · CVE.org

Basis · CVSS base scores as published by the CNA (CVE.org), CISA-ADP, or the NVD feed, captured per record. Version adoption is a coverage finding, not a filter.

02

How v4.0 re-scores v3.1

— on the 31 records carrying both
17
v4.0 scores LOWER
than the record's v3.1
11
v4.0 scores HIGHER
than the record's v3.1
3
unchanged
v4.0 == v3.1
0.66
mean |Δ|
absolute base-score gap

Where they diverge most

— |Δ| ≥ 1.5 base-score points; each links to its cited record
4.4 → 6.7
CVE-2025-21590
Δ +2.3 · CVE.org
6.7 → 8.4
CVE-2026-110936
Δ +1.7 · CVE.org
5.3 → 6.9
CVE-2025-35939
Δ +1.6 · CVE.org

Basis · CVE.org CVSS metrics on each record. v3.1 and v4.0 measure different things, so a gap is expected; this is the empirical shift across this known-exploited set, not a claim that either is "right".