CVSS Calculator
Build, score and share a CVSS vector, v2 through v4.0, computed in your browser. Click a segment, or use the arrow keys, to change it.
Access VectorAVBase metric
Exploitable remotely over the network.
Computed in your browser: the vector never leaves this page. A CVSS score measures severity, not risk.
Every metric
The same vector in long form: each metric, its values and what the current one means. The optional groups adjust the score for threat and for your environment.
Base metrics
- Access VectorAV
Exploitable remotely over the network.
- Access ComplexityAC
No special conditions required.
- AuthenticationAu
No authentication required.
- Confidentiality ImpactC
Some information disclosed.
- Integrity ImpactI
Some data can be modified.
- Availability ImpactA
Reduced performance or disruption.
Score for your environment
The base score is severity in a vacuum. Pick where the asset sits and see how the score changes for you, then export the justification.
Switch to CVSS v3.0, v3.1 or v4.0 to score for an environment.
Severity is not exploitation
A CVSS score says how bad a flaw could be, not whether anyone is using it. Check a real CVE's exploitation likelihood (EPSS) and whether it is on CISA's Known Exploited Vulnerabilities list.
Only the CVE ID is sent. Your vector stays in this browser.
Compare, triage, publish
Compare two vectors metric by metric, for example a vendor's score against the NVD's, or translate one between CVSS v3.1 and v4.0. Translation follows the FIRST bridge rules and flags every metric that needs a human decision.
What is CVSS?
The Common Vulnerability Scoring System (CVSS) is an open, vendor-neutral standard for rating the severity of software vulnerabilities on a 0.0–10.0 scale. A vulnerability is described by a vector of metrics, how it is exploited and what it impacts, which a formula turns into a numeric score and a qualitative rating. It is maintained by FIRST and is the scoring system used by the NVD and most vulnerability databases.
Severity ratings
- Critical9.0 – 10.0—
- High7.0 – 8.97.0 – 10.0
- Medium4.0 – 6.94.0 – 6.9
- Low0.1 – 3.90.0 – 3.9
- None0.0—
CVSS versions
- v2.02007Three severity bands, no Scope or User Interaction. Still seen on older CVEs.
- v3.02015Adds Scope, Privileges Required, User Interaction and five severity bands.
- v3.12019Clarifies v3.0 — fixes rounding and the environmental impact formula.
- v4.02023Splits vulnerable vs subsequent system impact, adds Attack Requirements and the Threat group.
Frequently asked questions
What is CVSS?
CVSS (Common Vulnerability Scoring System) is an open standard for rating the severity of software vulnerabilities on a 0.0–10.0 scale. A vulnerability is described by a vector of metrics (how it is exploited, what it impacts), which a formula turns into a numeric base score and a qualitative rating from None to Critical.
What is the difference between CVSS v3.1 and v4.0?
CVSS v4.0 (2023) refines v3.1 with finer-grained metrics: it splits impact into the vulnerable system and subsequent systems, adds Attack Requirements (AT) and a renamed Exploit Maturity (Threat) group, and replaces the single formula with a MacroVector lookup. v3.1 (2019) was a clarification of v3.0 that fixed rounding and the environmental impact formula. Scores are not directly comparable across versions.
What do the base, temporal and environmental scores mean?
The base score reflects the intrinsic, version-independent severity of a vulnerability. The temporal score (called Threat in v4.0) adjusts it for the current state of exploitation. The environmental score tailors it to your own environment via security requirements and modified base metrics. Most published scores (e.g. on NVD) are base scores.
What severity rating corresponds to a CVSS score?
For CVSS v3.x and v4.0: 0.0 is None, 0.1–3.9 Low, 4.0–6.9 Medium, 7.0–8.9 High and 9.0–10.0 Critical. CVSS v2.0 uses three bands only: 0.0–3.9 Low, 4.0–6.9 Medium and 7.0–10.0 High.
How is the CVSS score calculated?
For v2 and v3 the score is a closed-form formula over the metric weights (exploitability and impact sub-scores combined and rounded). For v4.0 the metrics are reduced to an equivalence class ("MacroVector") whose score is looked up and then interpolated by the mean severity distance to the worst case. This calculator computes all of them in your browser, matching the official FIRST.org reference to the published one-decimal score.