Hello all, The StarlingX Security team is planning to adopt CVSS v3 (moving from CVSS v2) for the monthly StarlingX CVE scans in stx.8.0 as part of the Debian transition. CVSS v3 is a more recent version of the CVSS spec and is a move in the right direction. The StarlingX CVE policy has been updated accordingly: https://wiki.openstack.org/wiki/StarlingX/Security/CVE_Support_Policy See the last slide for the proposed CVE fix criteria. Regards, Ghada stx security PL