The Limitations of the CVSS Framework CVSS base scores only represent the severity of a vulnerability. They do not consider the risk that severity poses to your specific environment or provide a true cyber risk score. Without that key risk context, it is possible to prioritize vulnerability remediation effectively.