Severity is the degree of the problem. This allows differentiation between a critical security flaw versus a slight annoyance with a work-around.