Calculate CVSS v3.1 base scores and assess vulnerability severity using standardized metrics for attack vector, complexity, impact, and more.
Try Example Vulnerabilities
You might also find these calculators useful
Calculate risk severity scores using ISO 27001 and NIST frameworks
Estimate the financial impact of a data breach
Assess third-party vendor security and compliance risk
Assess software dependency security risks and vulnerabilities
The Common Vulnerability Scoring System (CVSS) is the industry standard for assessing computer system security vulnerabilities. Our calculator implements the official CVSS v3.1 specification from FIRST.org to help security professionals accurately score vulnerabilities.
The Common Vulnerability Scoring System (CVSS) is an open industry standard for rating the severity of software security vulnerabilities on a scale from 0.0 to 10.0. The Base score is derived from metrics describing how a vulnerability can be exploited (attack vector, attack complexity, privileges required, user interaction, and scope) and its impact on confidentiality, integrity, and availability. These combine through a defined formula into a numeric score that maps to qualitative ratings: None (0.0), Low (0.1–3.9), Medium (4.0–6.9), High (7.0–8.9), and Critical (9.0–10.0). Optional Temporal and Environmental metrics can adjust the Base score for exploit maturity and an organization's specific context, helping teams prioritize which vulnerabilities to patch first.
A security analyst scores a newly discovered flaw to decide how urgently it must be patched relative to other open issues.
An IT team recomputes the CVSS score for a reported CVE using their own environmental factors to gauge real exposure.
An auditor documents severity ratings for each finding to meet regulatory or client security requirements.
A researcher justifies the severity of a submitted vulnerability to support the payout tier in a disclosure report.
CVSS is used by the National Vulnerability Database (NVD), CVE, and security vendors worldwide for consistent vulnerability assessment.
CVSS scores help security teams prioritize which vulnerabilities to fix first based on severity and potential impact.
CVSS provides an open, standardized framework that works across all platforms and vendors.
Clear severity ratings (Critical, High, Medium, Low) make it easy to communicate risk to stakeholders.
CVSS (Common Vulnerability Scoring System) is a standardized method for rating the severity of security vulnerabilities. Scores range from 0.0 to 10.0, with higher scores indicating more severe vulnerabilities.
None (0.0): No impact. Low (0.1-3.9): Minor vulnerability. Medium (4.0-6.9): Moderate risk. High (7.0-8.9): Serious vulnerability requiring prompt attention. Critical (9.0-10.0): Extremely severe, requiring immediate action.
CVSS v3.1 is a minor update that clarifies scoring guidance and addresses common misconceptions. The formula is the same, but the specification provides better examples and clearer definitions.
Scope indicates whether a vulnerability impacts resources beyond its security scope. 'Changed' scope means the vulnerability can affect other components (e.g., a VM escape affecting the host). 'Unchanged' means impact stays within the vulnerable component.
The vector string (e.g., CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) encodes all metric values. AV=Attack Vector, AC=Attack Complexity, PR=Privileges Required, UI=User Interaction, S=Scope, C/I/A=Confidentiality/Integrity/Availability Impact.
CVSS provides consistency and comparability. Using a standard system means everyone—vendors, researchers, and security teams—can communicate about vulnerability severity in a common language.