A CVE filter has at least three different zero-like states: a vulnerability with a numeric CVSS score of 0, a query that returns zero matching findings, and a record with no score assigned at all. Treating them as one value can hide unassessed assets, misclassify unknown severity, and give decision-makers false confidence. A reliable design stores the finding result and assessment coverage as separate outputs, while preserving score provenance and explicit threshold rules.
Three states that look like zero but are not
The first design decision is to keep a score value, a result count and an assessment state in different fields. They answer different questions.
As an Amazon Associate I earn from qualifying purchases.
A numeric CVSS score of 0
CVSS v4.0 assigns numerical scores from 0 to 10. A numeric 0 is an actual assessment result at the bottom of that range; it is not missing data. Sonatype’s policy documentation describes a score of 0 as indicating “no exploitable risk.” That wording belongs to Sonatype’s policy and should not be presented as a universal CVSS definition.
Free tools Windows power users keep installed
One-click scans. No signup required.
A scored zero still has provenance. The record should retain the CVSS version, metric group, vector and scoring authority, so an analyst can understand how the value was produced. FIRST.Org’s CVSS v4.0 User Guide (version 1.2, dated 2025-11-16) recommends publishing both the score and its vector.
#1 Best Overall
Zero findings returned
“Zero findings” describes the output of a query: no records satisfied the selected filter during that run. It does not say that every relevant host, application, package or check was assessed. A query can return zero because the environment is clean for that threshold, because the query scope is narrow, or because part of the environment was never evaluated.
No score assigned
A null, missing or unassigned score means the system does not have a CVSS number for that record. Sonatype states the distinction directly: “A CVSS score of 0 indicates ‘no exploitable risk,’ while a null value means that no CVSS score has been assigned. These are not the same: null ≠ 0.” Converting null to numeric 0 turns unknown severity into an apparently reassuring result and makes low-severity reporting inaccurate.
CVSS severity is not the same as organizational risk
CVSS is useful for expressing vulnerability severity, but a base score is not a complete risk decision. FIRST’s guide says: “CVSS Base (CVSS-B) scores are designed to measure the severity of a vulnerability and should not be used alone to assess risk.” The Base group describes intrinsic characteristics of the vulnerability. CVSS v4.0 also defines Threat, Environmental and Supplemental metric groups, allowing context such as current threat activity and the affected organization’s environment to refine prioritization.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →A filter must therefore identify which score it consumes. “CVSS ≥ 7” is incomplete unless the interface says whether the value is a CVSS-B base score, a threat-informed score, an environmental score or another product-calculated value. Two systems can produce different results from the same CVE while both are behaving correctly if they use different metric groups or scoring authorities.
Rank #2
Thresholds need explicit boundary rules
Operators and edges are policy choices, not implementation details. Document whether a boundary is inclusive, how missing values behave, and what happens when a score is exactly at the cutoff.
- Inclusive lower bound:
score >= 7.0includes 7.0. - Exclusive upper bound:
score < 9.0excludes 9.0. - Unknown values: null or missing scores should be excluded, separately labeled or routed to an “unscored” view; they should not silently become 0.
- Version and metric: state the CVSS version and whether the filter uses Base, Threat, Environmental or another contextual value.
Sonatype provides one concrete policy example with complete, non-overlapping intervals. Its documented bands are policy bands, not mandatory industry definitions:
| Sonatype policy label | Numeric interval | Boundary treatment |
|---|---|---|
| Security-Critical | score ≥ 9 | 9 included |
| Security-High | score ≥ 7 and < 9 | 7 included, 9 excluded |
| Security-Medium | score ≥ 4 and < 7 | 4 included, 7 excluded |
| Security-Low | score ≥ 0 and < 4 | 0 included, 4 excluded |
Including 0 in that Low interval ensures that every numeric score is covered. It does not mean that an unassigned score belongs in Low. A separate null policy is required.
“No matches” is not proof of complete coverage
An empty result set is meaningful only alongside the state of the assessment that produced it. Coverage can be limited by asset discovery, product identification, software support, CPE mapping, enabled checks, data freshness, permissions and the query’s scope.
Rank #3
Coverage dimensions to expose
- Discovery: which hosts, cloud resources, applications and repositories were found.
- Scope: which discovered assets were included in this run and which were intentionally excluded.
- Identity: whether installed software was mapped to a product and version that the vulnerability service recognizes.
- Support: products or package types for which the service cannot provide vulnerability details.
- Checks: checks completed, skipped, failed or blocked by permissions.
- Freshness: the timestamp of the inventory and vulnerability data used for the result.
- Query scope: selected projects, environments, severities, CVSS versions and time windows.
Microsoft’s Defender documentation illustrates why inventory and vulnerability coverage are different. Software can appear in inventory without a CPE and therefore lack supported vulnerability-management information; removing the CPE filter can reveal more software in inventory. Defender inventory data is updated every three to four hours according to Microsoft’s 2026 documentation, but that product-specific cadence should not be generalized to other scanners.
A report should be able to say, for example, “No findings matched CVSS-B ≥ 7.0; assessment coverage is partial because some products are unsupported and some hosts were not assessed.” If the system cannot quantify omissions, it should say “coverage unknown” rather than implying a clean environment.
Use a typed data model instead of coercing values
Store score state explicitly. A practical model distinguishes a scored value from an unscored record and keeps the evidence needed to interpret it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
{
"score": {
"state": "scored",
"value": 7.5,
"version": "CVSS 4.0",
"metric_group": "Base",
"vector": "vector supplied with the record",
"source": "scoring authority"
},
"finding_match": true,
"assessment": {
"state": "partial",
"assets_discovered": 120,
"assets_in_scope": 118,
"checks_completed": 114,
"unsupported_items": 4,
"not_assessed": 2,
"data_timestamp": "run timestamp"
}
}For an unassigned score, use a state such as unscored with a reason: no score published, unsupported version, parsing failure or pending enrichment. Do not store value: 0 for those cases. NVD’s FAQ notes that CVE records are enriched from references and information available at enrichment time, and that supported score versions and assessments can differ. That is another reason to preserve source and version rather than flattening every score into one column.
Design the interface around two independent outputs
The primary result should show the threshold and the matching finding count. A separate coverage badge or panel should show whether the assessment was complete.
Recommended result layout
- Filter: “CVSS-B ≥ 7.0, CVSS v4.0, Base metric.”
- Finding result: “0 findings matched.”
- Assessment state: Complete, partial, failed or unknown.
- Coverage details: discovered and in-scope assets, completed checks, unsupported software, skipped checks and data timestamp.
- Unscored queue: a link or count for records with null or missing scores.
“Assessment complete with no matching findings” is materially different from “No findings matched; assessment partial.” The former supports a stronger conclusion about the assessed scope. Neither statement should claim that vulnerabilities do not exist outside that scope.
Implementation procedure for a safe CVE threshold filter
- Choose the score field. Name the CVSS version, metric group and scoring authority. If several scores exist, define precedence instead of selecting whichever value is easiest to query.
- Normalize score state. Parse numeric scores into a bounded numeric type. Keep null, missing, rejected and unassigned records in explicit nonnumeric states.
- Define operators. Write the predicate in documentation and code, such as
score >= 7.0 AND score < 9.0. Specify how exact cutoffs are handled. - Define unknown behavior. Decide whether unscored records are excluded from the numeric result and shown in a separate count, or whether the query can request them directly. Never count them as Low.
- Calculate the finding result. Return the matching list and count for the selected scope. Permit a valid count of zero.
- Calculate coverage independently. Gather discovery, scope, support, check and freshness metrics from the same run. A coverage failure must not be represented as an empty findings array.
- Attach provenance. Persist the query, threshold, CVSS version, metric group, vectors where available, data timestamp and source identifiers with the report.
- Render explanatory copy. State whether zero means no threshold matches, a numeric score, or no assigned score. Use a warning when coverage is partial or unknown.
Failure modes that create misleading zeroes
Null-to-zero conversion
A database default, spreadsheet formula or API serializer may turn a missing score into 0. The fix is a nullable numeric field plus a separate state enum, with validation that rejects an unscored record carrying a numeric zero.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOverlapping or gapped bands
Rules such as “High ≥ 7” and “Medium ≤ 7” classify 7 twice. Conversely, “Medium > 4 and < 7” leaves 4 out. Use one inclusive edge and one exclusive edge, and test every cutoff.
Hidden score substitution
A product may silently substitute a CVSS v3 score when a CVSS v4 score is absent, or use a contextual score in one screen and a base score in another. Display the consumed version and metric group beside the result, and record fallback behavior in the policy.
Empty array interpreted as clean
An API response containing [] cannot communicate whether discovery failed, checks were skipped or nothing matched. Return an assessment status and coverage object alongside the findings array.
Stale inventory presented as current
Show the data timestamp and refresh state. A recent query over stale inventory is not equivalent to a recent assessment of the current environment.
How to phrase reports and alerts
Use wording that names the predicate and the assessment state:
- “No findings matched CVSS-B ≥ 7.0 for the selected scope. Assessment complete at the recorded timestamp.”
- “No findings matched CVSS-B ≥ 7.0. Assessment coverage: partial; unsupported or unassessed items are listed below.”
- “Three findings matched. Two additional records have no CVSS score assigned and were excluded from the numeric threshold.”
Avoid “zero vulnerabilities,” “all clear” or “no exploitable risk” unless the statement is explicitly limited to a documented scored record or completed scope. A numeric score of 0 can be reported as a score; it cannot be used to describe an empty assessment.
Quick Recap
Checks for policy and engineering reviews
- Can a user distinguish numeric 0, null and zero matches without opening raw data?
- Does every threshold show its operator, cutoff, CVSS version and metric group?
- Are score vectors and scoring authorities retained where available?
- Are unsupported products, skipped checks and unassessed assets visible?
- Does the report show data freshness and the exact query scope?
- Do automated tests cover 0, values just below and above each cutoff, 10, null and malformed scores?
- Can an incomplete assessment be distinguished from a completed assessment with no matching findings?
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
