Confirmation about the source of score value in image detail page

[xingzhang-suse]

Hi Fabrizio,
About CVE Score Display Logic
The fields nvd.v3score, redhat.v3score, and ghsa.v3score exist under the cvss object with different scores. Since NVD is our primary data source, I currently display the score based on the following priority: nvd.v3score → redhat.v3score → ghsa.v3score.
In some CVEs, there is no cvss object, but the severity field is still present (and not none).
Could you please confirm if this display logic is correct, and whether it’s expected that a CVE can have a severity value but no associated score?

[xingzhang-suse]

Answers from Flavio from Slack
https://suse.slack.com/archives/C08GX5XJ996/p1759907382554269?thread_ts=1759900625.194909&cid=C08GX5XJ996

Could you please confirm if this display logic is correct, and whether it’s expected that a CVE can have a severity value but no associated score?

The display logic is fine. It can also happen that some CVEs do not have a CVSS object associated with that.
In some image reports, there are multiple results entries with different class values. On the UI, we currently merge all results into a single CVE table for display.

[fabriziosestito]

@xingzhang-suse if this is resolved, let's mark this answer as accepted, see https://docs.github.com/en/discussions/collaborating-with-your-community-using-discussions/participating-in-a-discussion#marking-a-comment-as-an-answer