Veracode currently translates CVSS scores (numbers) into a proprietary set of severities (text) whenever you view the results from your Software Composition Analysis (SCA) upload scans (i.e., SCA scans that happen during Static pre-scan). For details, review this table in the help center. Soon, however, customers will be able to choose whether their organization uses the NVD severities for their upload scans or continues to use the default Veracode-proprietary severities. Since SCA agent scans show only the NVD severities, adding this feature to SCA upload scans will provide consistency between the two products and is one step towards our goal of unifying the products in 2023.