Scores update as you click
The ring, severity rating, and vector string recalculate on every change, so you can see how one metric moves the number.
Free tool · No sign-up
CVSS Calculator
Score a vulnerability with CVSS 4.0 or CVSS 3.1, read the severity, and take the vector string with you.
Every metric is explained in place, so you can work through an assessment without keeping the specification open in another tab. The score, the rating, and the vector all update as you click.
4.0 + 3.1 Both scoring versions
Base → Env Every metric group
Shareable Vector encoded in the URL
In-browser Nothing leaves your machine
Released in November 2023. Adds Attack Requirements, splits impact between the vulnerable and subsequent systems, and replaces Temporal metrics with Threat metrics.
Examples
Attack Vector AV
The context from which the vulnerability can be exploited.
Remotely exploitable across a network, up to and including the entire internet.
Attack Complexity AC
Whether the attacker must defeat security-hardening measures such as ASLR or signature checks.
No evasion of built-in mitigations is required. The attack works repeatably.
Attack Requirements AT
Deployment or runtime conditions outside the attacker’s control that must hold.
The attack succeeds against any vulnerable deployment, with no preconditions.
Privileges Required PR
The level of access the attacker holds before the attack begins.
No authentication or prior access is needed.
User Interaction UI
Whether a human other than the attacker must participate.
The vulnerability can be exploited without any user involvement.
Confidentiality VC
Loss of confidentiality on the vulnerable system.
No confidentiality is lost.
Integrity VI
Loss of integrity on the vulnerable system.
No integrity is lost.
Availability VA
Loss of availability on the vulnerable system.
No availability is lost.
Confidentiality SC
Loss of confidentiality on subsequent systems.
No confidentiality is lost beyond the vulnerable system.
Integrity SI
Loss of integrity on subsequent systems.
No integrity is lost beyond the vulnerable system.
Availability SA
Loss of availability on subsequent systems.
No availability is lost beyond the vulnerable system.
Exploit Maturity E
The likelihood that the vulnerability is being attacked today.
Insufficient threat intelligence. Scored the same as Attacked.
Confidentiality Requirement CR
The importance of confidentiality for the affected asset in your environment.
Scored the same as High.
Integrity Requirement IR
The importance of integrity for the affected asset in your environment.
Scored the same as High.
Availability Requirement AR
The importance of availability for the affected asset in your environment.
Scored the same as High.
Modified Attack Vector MAV
Overrides Attack Vector for your deployment.
Use the base Attack Vector.
Modified Attack Complexity MAC
Overrides Attack Complexity for your deployment.
Use the base Attack Complexity.
Modified Attack Requirements MAT
Overrides Attack Requirements for your deployment.
Use the base Attack Requirements.
Modified Privileges Required MPR
Overrides Privileges Required for your deployment.
Use the base Privileges Required.
Modified User Interaction MUI
Overrides User Interaction for your deployment.
Use the base User Interaction.
Modified Vulnerable Confidentiality MVC
Overrides confidentiality impact on the vulnerable system.
Use the base value.
Modified Vulnerable Integrity MVI
Overrides integrity impact on the vulnerable system.
Use the base value.
Modified Vulnerable Availability MVA
Overrides availability impact on the vulnerable system.
Use the base value.
Modified Subsequent Confidentiality MSC
Overrides confidentiality impact on subsequent systems.
Use the base value.
Modified Subsequent Integrity MSI
Overrides integrity impact on subsequent systems. Safety marks a risk to human life.
Use the base value.
Modified Subsequent Availability MSA
Overrides availability impact on subsequent systems. Safety marks a risk to human life.
Use the base value.
Safety S
Whether exploitation can cause physical harm to people.
No assessment provided.
Automatable AU
Whether an attacker can automate reconnaissance through exploitation.
No assessment provided.
Recovery R
How well the system recovers after the attack.
No assessment provided.
Value Density V
How much value the attacker gains from a single successful exploit.
No assessment provided.
Vulnerability Response Effort RE
How much work remediation demands from the consumer.
No assessment provided.
Provider Urgency U
The severity rating the provider attaches to the vulnerability.
No assessment provided.
Released in June 2019 and still the version behind most NVD records. Uses Scope to describe impact that crosses a security boundary, plus Temporal and Environmental modifiers.
Examples
Attack Vector AV
The context from which the vulnerability can be exploited.
Remotely exploitable across a network, up to and including the entire internet.
Attack Complexity AC
Conditions beyond the attacker’s control that must exist for the attack to succeed.
No special conditions. The attack can be repeated reliably.
Privileges Required PR
The level of access the attacker holds before the attack begins.
No authentication or prior access is needed.
User Interaction UI
Whether a human other than the attacker must participate.
The vulnerability can be exploited without any user involvement.
Scope S
Whether the vulnerability can affect resources beyond its security authority.
The impact stays inside the security authority of the vulnerable component.
Confidentiality C
Loss of confidentiality of the information managed by the impacted component.
No confidentiality is lost.
Integrity I
Loss of trustworthiness or veracity of the information.
No integrity is lost.
Availability A
Loss of availability of the impacted component itself.
No availability is lost.
Exploit Code Maturity E
The likelihood that the vulnerability can be attacked today.
Skipped in the score, equivalent to High.
Remediation Level RL
How complete the available fix is.
Skipped in the score, equivalent to Unavailable.
Report Confidence RC
How confident you are that the vulnerability exists as described.
Skipped in the score, equivalent to Confirmed.
Confidentiality Requirement CR
The importance of confidentiality for the affected asset.
Scored the same as Medium.
Integrity Requirement IR
The importance of integrity for the affected asset.
Scored the same as Medium.
Availability Requirement AR
The importance of availability for the affected asset.
Scored the same as Medium.
Modified Attack Vector MAV
Overrides Attack Vector for your deployment.
Use the base Attack Vector.
Modified Attack Complexity MAC
Overrides Attack Complexity for your deployment.
Use the base Attack Complexity.
Modified Privileges Required MPR
Overrides Privileges Required for your deployment.
Use the base Privileges Required.
Modified User Interaction MUI
Overrides User Interaction for your deployment.
Use the base User Interaction.
Modified Scope MS
Overrides Scope for your deployment.
Use the base Scope.
Modified Confidentiality MC
Overrides confidentiality impact for your deployment.
Use the base value.
Modified Integrity MI
Overrides integrity impact for your deployment.
Use the base value.
Modified Availability MA
Overrides availability impact for your deployment.
Use the base value.
What it does
Built for the way vulnerabilities actually get triaged
Base metrics answer how bad the flaw is. Threat and environmental metrics answer how bad it is for you.
Threat and temporal metrics
Factor in exploit maturity, remediation level, and report confidence to move from a CVSS-B score to CVSS-BT.
Environmental modifiers
Override any base metric and set security requirements to reflect the controls that already exist in your environment.
Vectors in and out
Paste a vector from an advisory to load it, or copy a link that reopens the calculator on exactly the same selection.
Reference implementation parity
The v4.0 MacroVector tables and the v3.1 formulas come straight from the FIRST specification, so scores match the official calculators.
No account, no telemetry
Everything runs client-side. Vectors you type are never sent to a server, which matters when you are triaging an unpublished bug.
Severity ratings
How a score maps to a rating
Both CVSS 4.0 and CVSS 3.1 use the same qualitative scale, which is what most policies and SLAs are written against.
None 0.0
Low 0.1 – 3.9
Medium 4.0 – 6.9
High 7.0 – 8.9
Critical 9.0 – 10.0
4.0 vs 3.1
What changed in CVSS 4.0
CVSS 4.0 arrived in November 2023. Most of the changes exist to reduce the number of vulnerabilities that all land on 9.8.
Topic CVSS 3.1 CVSS 4.0
Attack conditions Attack Complexity covers both attacker effort and environmental luck. Attack Complexity covers evasion of mitigations; a separate Attack Requirements metric covers race conditions and deployment state.
User interaction A single Required value. Split into Passive and Active, so a drive-by render scores differently from a deliberate import.
Impact beyond the component One Scope flag switches the whole formula. Three dedicated Subsequent System metrics, each scored independently.
Threat context Temporal metrics: Exploit Code Maturity, Remediation Level, Report Confidence. A single Exploit Maturity metric. The other two were dropped because almost nobody set them.
Safety and triage context Not modelled. Safety values on subsequent impact, plus supplemental metrics such as Automatable, Recovery, and Value Density.
Naming Base, Temporal, and Environmental scores. CVSS-B, CVSS-BT, CVSS-BE, and CVSS-BTE, so the vector says which groups were assessed.
FAQ
Common questions about CVSS
What is a CVSS score?
CVSS is the Common Vulnerability Scoring System maintained by FIRST. It turns a set of technical characteristics into a number from 0.0 to 10.0 and a qualitative rating from None to Critical. The score describes the severity of a vulnerability, and the vector string records every metric that produced it.
Should I use CVSS 4.0 or CVSS 3.1?
Use CVSS 4.0 for new assessments. It is the current specification and it describes modern software far better. Keep CVSS 3.1 available for anything that has to line up with existing NVD records, vendor advisories, or contractual SLAs, because most published CVEs still carry a 3.1 vector.
What do CVSS-B, CVSS-BT, CVSS-BE, and CVSS-BTE mean?
They are the CVSS 4.0 nomenclature for how much of the standard was applied. CVSS-B is base metrics only. CVSS-BT adds threat metrics such as Exploit Maturity. CVSS-BE adds environmental metrics. CVSS-BTE includes both. This calculator shows the correct label for whatever you have selected.
Is a CVSS score the same as risk?
No. CVSS measures the severity of a vulnerability in isolation. Risk also depends on whether the vulnerable code is reachable, whether the asset is exposed, what data it holds, and whether an exploit exists. Use the environmental and threat metrics to narrow the gap, then combine the result with reachability and asset context.
How is a CVSS 4.0 score calculated?
CVSS 4.0 groups every possible vector into equivalence classes called a MacroVector. Each MacroVector has a score taken from a lookup table published by FIRST. The final score starts from that value and subtracts a proportional distance between the vector you selected and the most severe vector in the same MacroVector. This calculator uses the official lookup tables, so the results match the FIRST calculator.
Can I share a score with someone else?
Yes. The vector string is written into the page URL as you make changes, and the copy button next to the score copies a link that reopens the calculator with the same selection. You can also paste any CVSS 4.0 or 3.1 vector into the load field to import it.
Beyond the score
A CVSS score tells you severity, not what to fix first
Corgea reads your code to work out whether a finding is reachable, then writes the fix and opens the pull request. Severity is the starting point, not the answer.