If the "textbook" definition of risk scoring is Risk = Likelihood x Impact, then a Severe (5) impact and an Almost Certain (5) likelihood should have a score of 25, right?  The answer isn't quite so simple...

Unless you've been hiding under a rock for the past three weeks, you're probably familiar with CVE-2019-0708, also ...