SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-cvss-threat-metrics-change

In CVSS v4.0, which metric group covers characteristics that change over time, such as exploit code becoming available?

The Threat group. Base stays constant, while Threat reflects current exploit activity.

Start playing free

  1. Base
  2. Threat ✔
  3. Supplemental

Why: CVSS v4.0 has four groups: Base, Threat, Environmental and Supplemental. Base is intrinsic and constant. Threat changes over time, such as when exploit code appears.

Huh, didn't know that: CVSS v3.1 had a Temporal group instead of Threat, plus Base and Environmental.

The dad joke
CVSS Base says, 'I never change.' CVSS Threat says, 'Check the news.'
Like this card?
Play the game

References

Answer: Threat. CVSS v4.0 has four groups: Base, Threat, Environmental and Supplemental. Base is intrinsic and constant. Threat changes over time, such as when exploit code appears.

  1. FIRST CVSS v4.0 Specification Document www.first.org/cvss/v4.0/specification-document
    the Threat group reflects the characteristics of a vulnerability that change over time
    Checked 2026-10-10.
  2. FIRST CVSS v4.0 Specification Document www.first.org/cvss/v4.0/specification-document
    CVSS consists of four metric groups: Base, Threat, Environmental, and Supplemental.
    Checked 2026-10-10.
  3. FIRST CVSS v3.1 Specification Document www.first.org/cvss/v3.1/specification-document
    CVSS consists of three metric groups: Base, Temporal, and Environmental.
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyOn the CVSS qualitative severity scale, which Base Score range is rated Critical?Security & PrivacyIn CVSS, which Attack Vector value scores highest because the attacker can be anywhere on the internet?Security & PrivacyIn CVSS v4.0, what effect do Supplemental metrics have on the final score?

That's stuff everyone should know.