The Common Vulnerability Scoring System (CVSS) is an open standard, maintained by FIRST.Org, for rating how severe a software vulnerability is. A CVSS score runs from 0.0 to 10.0 and comes with a vector string that records the metric values behind the score, so anyone can reproduce the result.
This free CVSS calculator supports CVSS v4.0 and CVSS v3.1. Choose a value for each metric and the score, severity rating and vector string update straight away. You can paste an existing vector to load it and copy the vector when you are done. Everything is calculated in your browser.
CVSS severity ratings
Rating
Score range
None
0.0
Low
0.1 – 3.9
Medium
4.0 – 6.9
High
7.0 – 8.9
Critical
9.0 – 10.0
CVSS 4.0 compared with CVSS 3.1
CVSS 4.0 adds Attack Requirements (AT), which covers deployment and execution conditions of the target, separate from Attack Complexity.
Scope is gone. Impact is scored separately for the vulnerable system (VC, VI, VA) and for subsequent systems (SC, SI, SA).
User Interaction has three values in CVSS 4.0 (None, Passive, Active) instead of two in CVSS 3.1 (None, Required).
CVSS 4.0 keeps one Threat metric, Exploit Maturity. CVSS 3.1 has three Temporal metrics: Exploit Code Maturity, Remediation Level and Report Confidence.
CVSS 4.0 adds Supplemental metrics such as Safety, Automatable and Recovery. They describe context and do not change the score.
CVSS 4.0 names scores by the metric groups used: CVSS-B, CVSS-BT, CVSS-BE and CVSS-BTE.
Questions and answers
Is the CVSS calculator free?
Yes. It is free to use and needs no account.
Which CVSS version should I use?
Use the version your organization or the vulnerability database asks for. CVSS 4.0 is the newest version of the standard, and CVSS 3.1 scores are still widely published.
Does the calculator store what I select?
No. Calculations run in your browser and your selections are not sent anywhere. Only your light or dark theme choice is saved in your browser.