CVSS Calculator

About this tool

The Common Vulnerability Scoring System rates how serious a software vulnerability is from 0 to 10. A CVSS vector such as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H lists the metrics behind the score: how the attacker reaches the flaw (attack vector, complexity, privileges, user interaction), whether it spreads beyond the vulnerable component (scope), and the damage to confidentiality, integrity and availability. This calculator reads a vector or lets you click each metric, and applies the formulas from the FIRST specification to give the base score, the temporal score (exploit maturity, fix availability, report confidence) and the environmental score (how much the flaw matters in your own setup, with modified metrics). Both CVSS 3.1 and 3.0 are supported, including the rounding difference between them. Scores are checked against NVD for real CVEs and against a reference implementation on thousands of random vectors. CVSS 4.0 vectors are not supported yet. The score measures technical severity, not the chance you will be attacked: pair it with the exploitation data in CVE Lookup.

How to use it

1. Paste a vector, or choose a value for each base metric.
2. Read the base score and its severity (None, Low, Medium, High, Critical).
3. Open Temporal or Environmental metrics to adjust the score for exploit maturity or for your own systems.
4. Press Copy vector to reuse the vector in a report.

Common problems

My score is different from the one in NVD

Check that the version matches: 3.0 and 3.1 round slightly differently. Also check whether NVD shows the base score or you added temporal or environmental metrics, which change the result.

The tool rejects my CVSS 4.0 vector

Only versions 3.0 and 3.1 are supported. Vectors starting with CVSS:4.0 use a different scoring method.

Temporal and environmental scores look the same as the base score

They are equal until you set at least one of their metrics. Not defined (X) means no change.