There are various ways to score or calculate severity ratings of vulnerabilities. The Common Vulnerability Scoring System (CVSS) is an industry standard for performing these calculations

If we need to calculate Vulnerability Scoring by hand

The CVSS is often used together with the so-called Microsoft DREAD.

The categories are:

• Damage – how bad would an attack be?
• Reproducibility – how easy is it to reproduce the attack?
• Exploitability – how much work is it to launch the attack?
• Affected users – how many people will be impacted?
• Discoverability – how easy is it to discover the threat?

https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator