@msw CVSS has some pretty fundamental conceptual issues, which I’ve written about in the past[1]

In theory you “should” be able to handle this through the temporal score component, but nobody does because people don’t have time, energy or inclination to think.

Worse, it’s basically baked into stuff like SOC2, PCI-DSS, regulatory reviews etc etc. It might never die.

Disclaimer: while I work for a bank these are just my own views.

[1] https://theoryof.predictable.software/articles/a-closer-look-at-cvss-scores/