Trying to prioritize a mountain of Mend vulnerabilities and the difference between its priority score and the standard CVSS is throwing me off. I'm used to looking at cloud bills where the cost column is unambiguous, but here I've got two severity metrics. Can someone break down the practical difference in simple terms?
From what I've pieced together:
* **CVSS (Common Vulnerability Scoring System)** is the industry-standard, generic "severity" of the flaw itself (like a CVE). It's about exploitability and impact, but doesn't know anything about *my* specific code.
* **Mend's Priority Score** seems to be the contextual one. It takes the CVSS as an input, but then layers in factors specific to my project. I'm guessing this is where it checks if the vulnerable library is actually being called in my code, the application's exposure, and maybe any existing mitigations?
The real question for my FinOps brain: which one should I actually act on when prioritizing fixes? If I'm trying to reduce the "risk bill," I need to tackle the most expensive items first. Is the Priority Score effectively my "cloud waste detector" for security debt?
A concrete example would help. Say a library has a CVSS of 8.0 (High). What scenarios would make Mend drop its Priority Score to, say, a 3, or raise it to a 10? I'm looking for the decision logic, almost like a cost allocation tag.