fix(cvss): honor Exploit Maturity threat metric in CVSS v4.0 scoring [Backport release/0.5.z]

[mrrajan]

Backport of #2569 to release/0.5.z

Summary

Use calculated_full_score() instead of calculated_base_score() for CVSS v4.0 so the Exploit Maturity (E) threat metric is included in scoring. Fixes inflated scores for CVEs with E:P or E:U (e.g., 10.0 instead of 9.3 for CVE-2026-18236).

• Only the v4.0 From impl is changed; v2/v3 are unaffected
• No-op for CVEs without an E metric
• Adds 4 reproducer tests (E:P → 9.3, E:U → 9.1, E:A → 10.0, no-E → 10.0)
• Added use std::str::FromStr; import (already present on main but missing on 0.5.z)

Implements TC-5626

Original PR: #2569

Summary by Sourcery

Honor CVSS v4.0 Exploit Maturity in vulnerability scoring to prevent inflated scores and ensure correct severity classification.

Bug Fixes:

• Correct CVSS v4.0 scores that previously ignored the Exploit Maturity threat metric, avoiding inflated critical scores for certain CVEs.

Enhancements:

• Use the full CVSS v4.0 score (with fallback to parsing the vector string) when computing stored scores and severities, defaulting to the base score if full scoring is unavailable.

Tests:

• Add CVSS v4.0 regression tests covering exploit maturity variants (E:P, E:U, E:A) and vectors without E to verify expected scores and severities.

[sourcery-ai]

Reviewer's Guide

This backport fixes CVSS v4.0 scoring to include the Exploit Maturity (E) threat metric by switching to full-score calculation, adding a fallback re-parse path, updating severity derivation, and covering the behavior with targeted tests and a missing import on the 0.5.z branch.

File-Level Changes

Change	Details	Files
Use CVSS v4.0 full score (including Exploit Maturity) instead of base score and align severity with the adjusted score.	Replace calculated_base_score() usage with calculated_full_score() for CVSS v4.0 conversion to ScoreInformation. Add a fallback path that re-parses the v4.0 vector string and retries full-score calculation when the initial call returns None. Default to the CvssV4 base_score when no full score can be computed. Derive Severity from the full score value instead of the base score.	modules/ingestor/src/graph/cvss.rs
Ensure correct CVSS v4.0 scoring behavior for different Exploit Maturity values via tests.	Add tests verifying scores for vectors with E:P, E:U, E:A, and no E metric to prevent regressions and document expected behavior. Assert both numeric score and severity where relevant (Critical vs lower severities).	modules/ingestor/src/graph/cvss.rs
Add missing FromStr import required for CvssV4 parsing on the 0.5.z branch.	Introduce use std::str::FromStr; at the top of the CVSS graph module to enable v4_0::CvssV4::from_str usage.	modules/ingestor/src/graph/cvss.rs

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've left some high level feedback:

• The fallback to CvssV4::from_str(&cvss.vector_string) when calculated_full_score() returns None is non-obvious; consider adding a brief comment explaining the upstream/library behavior that requires reparsing the vector string.
• Right now a missing full score silently falls back to base_score; if this represents an unexpected state rather than a normal case, consider making the behavior explicit (e.g., via logging or a dedicated branch) to make future debugging easier.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The fallback to `CvssV4::from_str(&cvss.vector_string)` when `calculated_full_score()` returns `None` is non-obvious; consider adding a brief comment explaining the upstream/library behavior that requires reparsing the vector string.
- Right now a missing full score silently falls back to `base_score`; if this represents an unexpected state rather than a normal case, consider making the behavior explicit (e.g., via logging or a dedicated branch) to make future debugging easier.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[PhilipCattanach]

@rh-jfuller - James you reviewed the orginal PR. Could you give this backport your blessing too please?

[rh-jfuller]

LGTM