HostedScan uses CVSS v3 scores, except for in rare cases of older vulnerabilities which have not yet been assigned a v3 score and only have a v2.
