CVSS IS DEAD TO US

Summary from the TLDR InfoSec newsletter

The curl team abandoned the CVSS system in favor of four security levels ranging from critical to low for use in their bug bounty system. They cited evidence from previous incidents, where CVSS calculators overstated the impact of a vulnerability that is only present in very niche configurations. One issue that the team notes is that even though the CVSS score is not mandatory in CVE filings, it is often added by CISA as an enrichment.