Calculate Common Vulnerability Scoring System (CVSS) v3.1 base scores. Assess vulnerability severity using standardized metrics for attack vector, complexity, impact, and more.
Try Example Vulnerabilities
You might also find these calculators useful
The Common Vulnerability Scoring System (CVSS) is the industry standard for assessing computer system security vulnerabilities. Our calculator implements the official CVSS v3.1 specification from FIRST.org to help security professionals accurately score vulnerabilities.
CVSS is used by the National Vulnerability Database (NVD), CVE, and security vendors worldwide for consistent vulnerability assessment.
CVSS scores help security teams prioritize which vulnerabilities to fix first based on severity and potential impact.
CVSS provides an open, standardized framework that works across all platforms and vendors.
Clear severity ratings (Critical, High, Medium, Low) make it easy to communicate risk to stakeholders.
CVSS (Common Vulnerability Scoring System) is a standardized method for rating the severity of security vulnerabilities. Scores range from 0.0 to 10.0, with higher scores indicating more severe vulnerabilities.
None (0.0): No impact. Low (0.1-3.9): Minor vulnerability. Medium (4.0-6.9): Moderate risk. High (7.0-8.9): Serious vulnerability requiring prompt attention. Critical (9.0-10.0): Extremely severe, requiring immediate action.
CVSS v3.1 is a minor update that clarifies scoring guidance and addresses common misconceptions. The formula is the same, but the specification provides better examples and clearer definitions.
Scope indicates whether a vulnerability impacts resources beyond its security scope. 'Changed' scope means the vulnerability can affect other components (e.g., a VM escape affecting the host). 'Unchanged' means impact stays within the vulnerable component.
The vector string (e.g., CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) encodes all metric values. AV=Attack Vector, AC=Attack Complexity, PR=Privileges Required, UI=User Interaction, S=Scope, C/I/A=Confidentiality/Integrity/Availability Impact.
CVSS provides consistency and comparability. Using a standard system means everyone—vendors, researchers, and security teams—can communicate about vulnerability severity in a common language.