Which of the following is used to quantitatively measure the criticality of a vulnerability?

CVSS (Common Vulnerability Scoring System) is the correct answer because it provides a standardized, quantitative method for rating the severity and characteristics of software vulnerabilities. It uses a set of metrics to generate a numerical score reflecting the criticality of a vulnerability, allowing organizations to prioritize remediation efforts. CVE (Common Vulnerabilities and Exposures) is a dictionary of publicly known cybersecurity vulnerabilities and exposures, providing a common identifier for each, but it does not quantitatively measure criticality. CIA (Confidentiality, Integrity, Availability) is a security triad representing the fundamental goals of information security, not a vulnerability scoring system. CERT (Computer Emergency Response Team) is a group that handles computer security incidents, but it is not a system for quantitatively measuring vulnerability criticality.