Free CVSS Calculator
Paste a CVSS vector to get its score and severity, see every metric in words, or export the JSON record.
What is a CVSS Calculator?
CVSS, the Common Vulnerability Scoring System, turns a vulnerability’s characteristics into a score from 0 to 10. Security advisories publish it as a vector such as CVSS:3.1/AV:N/AC:L/…. This calculator scores those vectors and explains what each part means.
It scores CVSS 4.0, 3.1, 3.0 and 2.0 with the ae-cvss-calculator library, which follows FIRST’s specifications. Base, threat or temporal, and environmental scores are shown when the vector defines them, with severity bands, the 4.0 nomenclature, every metric in words, and the JSON record NVD and CVE use.
Key Features
Four Versions
CVSS 4.0, 3.1, 3.0 and 2.0, recognised from the vector itself.
Every Score
Base, impact and exploitability, temporal or threat, and environmental where defined.
Metrics in Words
Each metric and value named, from Attack Vector to Provider Urgency.
JSON Record
The CVSS JSON schema output, as vulnerability databases publish it.
Nothing Uploaded
Vectors are scored in your browser, so unpublished findings stay private.
Perfect for everyone
- Security engineers
- Vulnerability managers
- Penetration testers
- Bug bounty hunters and developers triaging advisories
How to Use the CVSS Calculator
Paste a vector from an advisory or build one yourself.
Get the Vector
From an NVD entry, a vendor advisory, a scanner report or your own assessment.
Paste It
The version is read from the prefix; 2.0 vectors have none.
Read the Score
Score shows the effective score and severity, with each sub-score.
Check the Metrics
Metrics explains every value, and JSON exports the record.
Vectors, Scored
Each row is a CVSS vector as advisories publish it, and each answer is this calculator’s output in the mode on the chip. The first is the vector behind many critical remote code execution advisories.
“CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H”
“CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N”
“CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C/CR:H/IR:M/AR:L”
“CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C/CR:H/IR:M/AR:L”
“CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N”
“AV:N/AC:L/Au:N/C:P/I:P/A:P”
“CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U”
“CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H”
“CVSS:3.1/AV:N/AC:L/PR:N/UI:N”
“CVSS:5.0/AV:N/AC:L”
The CVSS 3.1 Base Metrics
Eight base metrics describe a vulnerability itself. Learn them and most vectors read at a glance.
AV, Attack Vector
How far away the attacker can be: network, adjacent, local or physical.
“What is AV:N?”
AC, Attack Complexity
Whether conditions outside the attacker’s control must line up.
“What does AC:H mean?”
PR, Privileges Required
What access the attacker needs first: none, low or high.
“Which is worst for defenders?”
UI, User Interaction
Whether a user must do something, such as click a link.
“What is UI:R?”
S, Scope
Whether the impact reaches beyond the vulnerable component.
“What raises the score?”
C, I and A
Impact on confidentiality, integrity and availability: high, low or none.
“What does C:H mean?”
Severity Bands
None 0.0, Low 0.1 to 3.9, Medium 4.0 to 6.9, High 7.0 to 8.9, Critical 9.0 to 10.0.
“Is 9.0 High or Critical?”
Temporal Metrics
Exploit maturity, remediation level and report confidence lower the base score.
“Can temporal metrics raise it?”
Environmental Metrics
Your own security requirements and modified base metrics adjust it for you.
“Who sets them?”
The Vector
All metrics as KEY:VALUE pairs after the version prefix.
“What starts a 3.1 vector?”
What Changed in CVSS 4.0
FIRST published CVSS 4.0 in 2023 to fix long-standing complaints about 3.1. The vector looks familiar but reads differently, and the same flaw often scores differently.
Attack Requirements
A new AT metric covers conditions in the target, separate from Attack Complexity.
Passive and Active Interaction
User Interaction splits into Passive and Active, depending on what the user must do.
Vulnerable and Subsequent Systems
Scope is gone. Impacts are scored separately for the vulnerable system and systems beyond it.
Threat Metrics
Temporal metrics shrink to Exploit Maturity, with values such as Attacked and Unreported.
Supplemental Metrics
Safety, Automatable, Recovery and others add context without changing the score.
Nomenclature
CVSS-B, BT, BE and BTE say which metric groups a score includes.
Using Scores Well
A score is a summary of severity, not of risk. These habits keep CVSS useful when you prioritise patches and write advisories.
Severity Isn’t Risk
A critical flaw in a system you don’t run matters less than a medium one in your login page.
Add the Environment
Environmental metrics fit the score to your systems. Without them it’s the vendor’s view.
Watch for Exploitation
Exploit maturity and lists such as CISA KEV say more about urgency than the base score.
Compare Like With Like
A 3.1 score and a 4.0 score for the same flaw can differ, so note the version.
Publish the Vector
Always share the vector with the score, so others can see and adjust each choice.
Rescore When Facts Change
A new exploit or a vendor fix changes threat metrics, so update the score.
When to Use a CVSS Calculator
Whenever a vulnerability needs a defensible score.
Triaging Advisories
Read the vector behind an NVD score to see why it’s critical.
Writing Reports
Score a penetration test finding and show the vector behind it.
Bug Bounty Submissions
Back a severity claim with a vector the triager can check.
Patch Prioritisation
Adjust base scores with environmental metrics for your own estate.
Learning CVSS
See how each metric moves the score in 3.1 and 4.0.
CVSS Pitfalls
Mistakes that produce misleading scores.
Scoring the Worst Case
Score the vulnerability as it is, not what an attacker might chain it with.
Misreading Scope
In 3.1, S:C only applies when impact crosses a security boundary, which is rarer than it seems.
Network by Default
AV:N needs exploitation across the network. A local file parser is often AV:L.
Mixing Versions
Pasting 3.1 metric names into a 4.0 vector, or the reverse, gives an invalid vector.
Rounding by Hand
CVSS 3.x rounds up to one decimal in a specific way, so let the calculator do it.
Ignoring 2.0 Bands
CVSS 2.0 has no Critical band. NVD rated 7.0 and above as High.