The Consensus Engine
Two authorities score the same vulnerability.
They disagree
of
the time.
When NVD and GitHub Advisory both assign a CVSS score to the same CVE, their scores differ more often than they agree — and the disagreement isn't random. It follows predictable patterns across vulnerability types, scoring organizations, and individual CVSS metrics.
of dual-scored CVEs conflict
CVEs cross severity band boundaries
average score gap
The problem is growing.