Once upon a time I wrote a CVSS 2/3 library for Python[1] (more have appeared now, this[2] looks nicer). CVSS is really complex and seemingly arbitrary. Take a

Once upon a time I wrote a CVSS 2/3 library for Python[1] (more have appeared now, this[2] looks nicer). CVSS is really complex and seemingly arbitrary. Take a look at this (rather horrible) code to calculate a CVSS score from another library[3]. Yes, the code is disgusting, but even if you abstract it away nicely it boils down to: do some maths with some arbitrary numbers[4], then perform a bunch of conditions, and you (hopefully) get 3 numbers spat out. I don't like it. There are bugs in the 'official' calculator around floating point numbers, the spec had several typos in the calculations (one being an extraneous negative symbol!) and the naming system for the components is needlessly complex. There are surely simpler, less magical ways to score, compare and rate vulnerabilities? 1. https://github.com/ctxis/cvsslib https://github.com/ctxis/cvsslib 2. https://github.com/skontar/cvss https://github.com/skontar/cvss 3. https://github.com/toolswatch/pycvss3/blob/master/lib/pycvss3.py#L32 https://github.com/toolswatch/pycvss3/blob/master/lib/pycvss... 4. https://www.first.org/cvss/specification-document#7-1-Base-Metrics-Equations https://www.first.org/cvss/specification-document#7-1-Base-M...