diff --git a/osv/vulnerability.proto b/osv/vulnerability.proto
index ddf8ab3f1d3..ca3a7490b92 100644
--- a/osv/vulnerability.proto
+++ b/osv/vulnerability.proto
@@ -118,6 +118,7 @@ message Severity {
     UNSPECIFIED = 0;
     CVSS_V3 = 1;
     CVSS_V2 = 2;
+    CVSS_V4 = 3;
   }
   // The type of this severity entry.
   Type type = 1;
diff --git a/osv/vulnerability_pb2.py b/osv/vulnerability_pb2.py
index c3db0db8030..cfd062cc9ac 100644
--- a/osv/vulnerability_pb2.py
+++ b/osv/vulnerability_pb2.py
@@ -1,11 +1,12 @@
 # -*- coding: utf-8 -*-
 # Generated by the protocol buffer compiler.  DO NOT EDIT!
 # source: osv/vulnerability.proto
+# Protobuf Python Version: 4.25.0
 """Generated protocol buffer code."""
-from google.protobuf.internal import builder as _builder
 from google.protobuf import descriptor as _descriptor
 from google.protobuf import descriptor_pool as _descriptor_pool
 from google.protobuf import symbol_database as _symbol_database
+from google.protobuf.internal import builder as _builder
 # @@protoc_insertion_point(imports)
 
 _sym_db = _symbol_database.Default()
@@ -15,39 +16,39 @@
 from google.protobuf import timestamp_pb2 as google_dot_protobuf_dot_timestamp__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x17osv/vulnerability.proto\x12\x03osv\x1a\x1cgoogle/protobuf/struct.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"y\n\x06\x43ommit\x12\'\n\trepo_type\x18\x01 \x01(\x0e\x32\x14.osv.Commit.RepoType\x12\x10\n\x08repo_url\x18\x02 \x01(\t\x12\x0e\n\x06\x63ommit\x18\x03 \x01(\t\"$\n\x08RepoType\x12\x0f\n\x0bUNSPECIFIED\x10\x00\x12\x07\n\x03GIT\x10\x01\"8\n\x07Package\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x11\n\tecosystem\x18\x02 \x01(\t\x12\x0c\n\x04purl\x18\x03 \x01(\t\"P\n\x05\x45vent\x12\x12\n\nintroduced\x18\x01 \x01(\t\x12\r\n\x05\x66ixed\x18\x02 \x01(\t\x12\r\n\x05limit\x18\x03 \x01(\t\x12\x15\n\rlast_affected\x18\x04 \x01(\t\"\x8d\x01\n\x05Range\x12\x1d\n\x04type\x18\x01 \x01(\x0e\x32\x0f.osv.Range.Type\x12\x0c\n\x04repo\x18\x02 \x01(\t\x12\x1a\n\x06\x65vents\x18\x03 \x03(\x0b\x32\n.osv.Event\";\n\x04Type\x12\x0f\n\x0bUNSPECIFIED\x10\x00\x12\x07\n\x03GIT\x10\x01\x12\n\n\x06SEMVER\x10\x02\x12\r\n\tECOSYSTEM\x10\x03\"\xe1\x01\n\x08\x41\x66\x66\x65\x63ted\x12\x1d\n\x07package\x18\x01 \x01(\x0b\x32\x0c.osv.Package\x12\x1a\n\x06ranges\x18\x02 \x03(\x0b\x32\n.osv.Range\x12\x10\n\x08versions\x18\x03 \x03(\t\x12\x33\n\x12\x65\x63osystem_specific\x18\x04 \x01(\x0b\x32\x17.google.protobuf.Struct\x12\x32\n\x11\x64\x61tabase_specific\x18\x05 \x01(\x0b\x32\x17.google.protobuf.Struct\x12\x1f\n\x08severity\x18\x06 \x03(\x0b\x32\r.osv.Severity\"n\n\x08Severity\x12 \n\x04type\x18\x01 \x01(\x0e\x32\x12.osv.Severity.Type\x12\r\n\x05score\x18\x02 \x01(\t\"1\n\x04Type\x12\x0f\n\x0bUNSPECIFIED\x10\x00\x12\x0b\n\x07\x43VSS_V3\x10\x01\x12\x0b\n\x07\x43VSS_V2\x10\x02\"\x8a\x02\n\x06\x43redit\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x0f\n\x07\x63ontact\x18\x02 \x03(\t\x12\x1e\n\x04type\x18\x03 \x01(\x0e\x32\x10.osv.Credit.Type\"\xc0\x01\n\x04Type\x12\x0f\n\x0bUNSPECIFIED\x10\x00\x12\t\n\x05OTHER\x10\x01\x12\n\n\x06\x46INDER\x10\x02\x12\x0c\n\x08REPORTER\x10\x03\x12\x0b\n\x07\x41NALYST\x10\x04\x12\x0f\n\x0b\x43OORDINATOR\x10\x05\x12\x19\n\x15REMEDIATION_DEVELOPER\x10\x06\x12\x18\n\x14REMEDIATION_REVIEWER\x10\x07\x12\x18\n\x14REMEDIATION_VERIFIER\x10\x08\x12\x08\n\x04TOOL\x10\t\x12\x0b\n\x07SPONSOR\x10\n\"\xd1\x01\n\tReference\x12!\n\x04type\x18\x01 \x01(\x0e\x32\x13.osv.Reference.Type\x12\x0b\n\x03url\x18\x02 \x01(\t\"\x93\x01\n\x04Type\x12\x08\n\x04NONE\x10\x00\x12\x0c\n\x08\x41\x44VISORY\x10\x02\x12\x0b\n\x07\x41RTICLE\x10\x06\x12\r\n\tDETECTION\x10\t\x12\x0e\n\nDISCUSSION\x10\x08\x12\x0c\n\x08\x45VIDENCE\x10\x07\x12\x07\n\x03\x46IX\x10\x04\x12\x0e\n\nINTRODUCED\x10\n\x12\x0b\n\x07PACKAGE\x10\x05\x12\n\n\x06REPORT\x10\x03\x12\x07\n\x03WEB\x10\x01\"\xbb\x03\n\rVulnerability\x12\x16\n\x0eschema_version\x18\x12 \x01(\t\x12\n\n\x02id\x18\x01 \x01(\t\x12-\n\tpublished\x18\x0b \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12,\n\x08modified\x18\n \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12-\n\twithdrawn\x18\x0c \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x0f\n\x07\x61liases\x18\x08 \x03(\t\x12\x0f\n\x07related\x18\r \x03(\t\x12\x0f\n\x07summary\x18\x03 \x01(\t\x12\x0f\n\x07\x64\x65tails\x18\x04 \x01(\t\x12\x1f\n\x08\x61\x66\x66\x65\x63ted\x18\x11 \x03(\x0b\x32\r.osv.Affected\x12\"\n\nreferences\x18\x10 \x03(\x0b\x32\x0e.osv.Reference\x12\x32\n\x11\x64\x61tabase_specific\x18\x0f \x01(\x0b\x32\x17.google.protobuf.Struct\x12\x1f\n\x08severity\x18\x13 \x03(\x0b\x32\r.osv.Severity\x12\x1c\n\x07\x63redits\x18\x14 \x03(\x0b\x32\x0b.osv.Creditb\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x17osv/vulnerability.proto\x12\x03osv\x1a\x1cgoogle/protobuf/struct.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"y\n\x06\x43ommit\x12\'\n\trepo_type\x18\x01 \x01(\x0e\x32\x14.osv.Commit.RepoType\x12\x10\n\x08repo_url\x18\x02 \x01(\t\x12\x0e\n\x06\x63ommit\x18\x03 \x01(\t\"$\n\x08RepoType\x12\x0f\n\x0bUNSPECIFIED\x10\x00\x12\x07\n\x03GIT\x10\x01\"8\n\x07Package\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x11\n\tecosystem\x18\x02 \x01(\t\x12\x0c\n\x04purl\x18\x03 \x01(\t\"P\n\x05\x45vent\x12\x12\n\nintroduced\x18\x01 \x01(\t\x12\r\n\x05\x66ixed\x18\x02 \x01(\t\x12\r\n\x05limit\x18\x03 \x01(\t\x12\x15\n\rlast_affected\x18\x04 \x01(\t\"\x8d\x01\n\x05Range\x12\x1d\n\x04type\x18\x01 \x01(\x0e\x32\x0f.osv.Range.Type\x12\x0c\n\x04repo\x18\x02 \x01(\t\x12\x1a\n\x06\x65vents\x18\x03 \x03(\x0b\x32\n.osv.Event\";\n\x04Type\x12\x0f\n\x0bUNSPECIFIED\x10\x00\x12\x07\n\x03GIT\x10\x01\x12\n\n\x06SEMVER\x10\x02\x12\r\n\tECOSYSTEM\x10\x03\"\xe1\x01\n\x08\x41\x66\x66\x65\x63ted\x12\x1d\n\x07package\x18\x01 \x01(\x0b\x32\x0c.osv.Package\x12\x1a\n\x06ranges\x18\x02 \x03(\x0b\x32\n.osv.Range\x12\x10\n\x08versions\x18\x03 \x03(\t\x12\x33\n\x12\x65\x63osystem_specific\x18\x04 \x01(\x0b\x32\x17.google.protobuf.Struct\x12\x32\n\x11\x64\x61tabase_specific\x18\x05 \x01(\x0b\x32\x17.google.protobuf.Struct\x12\x1f\n\x08severity\x18\x06 \x03(\x0b\x32\r.osv.Severity\"{\n\x08Severity\x12 \n\x04type\x18\x01 \x01(\x0e\x32\x12.osv.Severity.Type\x12\r\n\x05score\x18\x02 \x01(\t\">\n\x04Type\x12\x0f\n\x0bUNSPECIFIED\x10\x00\x12\x0b\n\x07\x43VSS_V3\x10\x01\x12\x0b\n\x07\x43VSS_V2\x10\x02\x12\x0b\n\x07\x43VSS_V4\x10\x03\"\x8a\x02\n\x06\x43redit\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x0f\n\x07\x63ontact\x18\x02 \x03(\t\x12\x1e\n\x04type\x18\x03 \x01(\x0e\x32\x10.osv.Credit.Type\"\xc0\x01\n\x04Type\x12\x0f\n\x0bUNSPECIFIED\x10\x00\x12\t\n\x05OTHER\x10\x01\x12\n\n\x06\x46INDER\x10\x02\x12\x0c\n\x08REPORTER\x10\x03\x12\x0b\n\x07\x41NALYST\x10\x04\x12\x0f\n\x0b\x43OORDINATOR\x10\x05\x12\x19\n\x15REMEDIATION_DEVELOPER\x10\x06\x12\x18\n\x14REMEDIATION_REVIEWER\x10\x07\x12\x18\n\x14REMEDIATION_VERIFIER\x10\x08\x12\x08\n\x04TOOL\x10\t\x12\x0b\n\x07SPONSOR\x10\n\"\xd1\x01\n\tReference\x12!\n\x04type\x18\x01 \x01(\x0e\x32\x13.osv.Reference.Type\x12\x0b\n\x03url\x18\x02 \x01(\t\"\x93\x01\n\x04Type\x12\x08\n\x04NONE\x10\x00\x12\x0c\n\x08\x41\x44VISORY\x10\x02\x12\x0b\n\x07\x41RTICLE\x10\x06\x12\r\n\tDETECTION\x10\t\x12\x0e\n\nDISCUSSION\x10\x08\x12\x0c\n\x08\x45VIDENCE\x10\x07\x12\x07\n\x03\x46IX\x10\x04\x12\x0e\n\nINTRODUCED\x10\n\x12\x0b\n\x07PACKAGE\x10\x05\x12\n\n\x06REPORT\x10\x03\x12\x07\n\x03WEB\x10\x01\"\xbb\x03\n\rVulnerability\x12\x16\n\x0eschema_version\x18\x12 \x01(\t\x12\n\n\x02id\x18\x01 \x01(\t\x12-\n\tpublished\x18\x0b \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12,\n\x08modified\x18\n \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12-\n\twithdrawn\x18\x0c \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x0f\n\x07\x61liases\x18\x08 \x03(\t\x12\x0f\n\x07related\x18\r \x03(\t\x12\x0f\n\x07summary\x18\x03 \x01(\t\x12\x0f\n\x07\x64\x65tails\x18\x04 \x01(\t\x12\x1f\n\x08\x61\x66\x66\x65\x63ted\x18\x11 \x03(\x0b\x32\r.osv.Affected\x12\"\n\nreferences\x18\x10 \x03(\x0b\x32\x0e.osv.Reference\x12\x32\n\x11\x64\x61tabase_specific\x18\x0f \x01(\x0b\x32\x17.google.protobuf.Struct\x12\x1f\n\x08severity\x18\x13 \x03(\x0b\x32\r.osv.Severity\x12\x1c\n\x07\x63redits\x18\x14 \x03(\x0b\x32\x0b.osv.Creditb\x06proto3')
 
-_builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, globals())
-_builder.BuildTopDescriptorsAndMessages(DESCRIPTOR, 'osv.vulnerability_pb2', globals())
+_globals = globals()
+_builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
+_builder.BuildTopDescriptorsAndMessages(DESCRIPTOR, 'osv.vulnerability_pb2', _globals)
 if _descriptor._USE_C_DESCRIPTORS == False:
-
   DESCRIPTOR._options = None
-  _COMMIT._serialized_start=95
-  _COMMIT._serialized_end=216
-  _COMMIT_REPOTYPE._serialized_start=180
-  _COMMIT_REPOTYPE._serialized_end=216
-  _PACKAGE._serialized_start=218
-  _PACKAGE._serialized_end=274
-  _EVENT._serialized_start=276
-  _EVENT._serialized_end=356
-  _RANGE._serialized_start=359
-  _RANGE._serialized_end=500
-  _RANGE_TYPE._serialized_start=441
-  _RANGE_TYPE._serialized_end=500
-  _AFFECTED._serialized_start=503
-  _AFFECTED._serialized_end=728
-  _SEVERITY._serialized_start=730
-  _SEVERITY._serialized_end=840
-  _SEVERITY_TYPE._serialized_start=791
-  _SEVERITY_TYPE._serialized_end=840
-  _CREDIT._serialized_start=843
-  _CREDIT._serialized_end=1109
-  _CREDIT_TYPE._serialized_start=917
-  _CREDIT_TYPE._serialized_end=1109
-  _REFERENCE._serialized_start=1112
-  _REFERENCE._serialized_end=1321
-  _REFERENCE_TYPE._serialized_start=1174
-  _REFERENCE_TYPE._serialized_end=1321
-  _VULNERABILITY._serialized_start=1324
-  _VULNERABILITY._serialized_end=1767
+  _globals['_COMMIT']._serialized_start=95
+  _globals['_COMMIT']._serialized_end=216
+  _globals['_COMMIT_REPOTYPE']._serialized_start=180
+  _globals['_COMMIT_REPOTYPE']._serialized_end=216
+  _globals['_PACKAGE']._serialized_start=218
+  _globals['_PACKAGE']._serialized_end=274
+  _globals['_EVENT']._serialized_start=276
+  _globals['_EVENT']._serialized_end=356
+  _globals['_RANGE']._serialized_start=359
+  _globals['_RANGE']._serialized_end=500
+  _globals['_RANGE_TYPE']._serialized_start=441
+  _globals['_RANGE_TYPE']._serialized_end=500
+  _globals['_AFFECTED']._serialized_start=503
+  _globals['_AFFECTED']._serialized_end=728
+  _globals['_SEVERITY']._serialized_start=730
+  _globals['_SEVERITY']._serialized_end=853
+  _globals['_SEVERITY_TYPE']._serialized_start=791
+  _globals['_SEVERITY_TYPE']._serialized_end=853
+  _globals['_CREDIT']._serialized_start=856
+  _globals['_CREDIT']._serialized_end=1122
+  _globals['_CREDIT_TYPE']._serialized_start=930
+  _globals['_CREDIT_TYPE']._serialized_end=1122
+  _globals['_REFERENCE']._serialized_start=1125
+  _globals['_REFERENCE']._serialized_end=1334
+  _globals['_REFERENCE_TYPE']._serialized_start=1187
+  _globals['_REFERENCE_TYPE']._serialized_end=1334
+  _globals['_VULNERABILITY']._serialized_start=1337
+  _globals['_VULNERABILITY']._serialized_end=1780
 # @@protoc_insertion_point(module_scope)