CVSS Score Calculator
Build CVSS v4.0 and v3.1 vectors and calculate base severity scores instantly with plain-language metric explanations.
Loading tool...
What is CVSS Score Calculator?
CVSS Score Calculator is a free online tool for building Common Vulnerability Scoring System vectors and computing base scores under both CVSS v4.0 and v3.1. It implements the official FIRST scoring — the v4.0 MacroVector lookup with severity-distance interpolation and the classic v3.1 equations — and explains every metric value in plain language as you select it, so you can defend the numbers in your pentest reports and vulnerability triage.
Key Benefits
- Scores match the official FIRST calculator exactly
- Both current (v4.0) and legacy (v3.1) standards in one tool
- Plain-language hints make CVSS approachable for junior engineers
- Import any existing vector to tweak metrics and compare scores
- Zero data leaves your browser
Common Use Cases
- •Score findings consistently across a pentest report
- •Triage scanner and bug-bounty findings by severity
- •Translate old NVD v3.1 vectors into the v4.0 scale
- •Teach junior analysts how each CVSS metric changes the score
Score a Vulnerability with CVSS
- Choose the version: Toggle between CVSS v4.0 (11 base metrics plus optional E/CR/IR/AR) and v3.1 (8 base metrics) — pick the version your organization or advisory uses.
- Set each metric: Work through the dropdowns: for v4.0 that is AV, AC, AT, PR, UI, the vulnerable-system impacts VC/VI/VA and subsequent SC/SI/SA — each value shows a plain-language description.
- Read the score and vector: The result card shows the score out of 10 with its severity badge (None, Low, Medium, High, or Critical), the full vector string with a copy button, and a plain-language breakdown of every metric.
- Or import an existing vector: Paste a vector such as CVSS:4.0/AV:N/... or CVSS:3.1/AV:N/... into the import box and press Import — all selectors sync to it instantly, and everything runs locally in your browser.
Key Features
- Dual-version support: CVSS v4.0 MacroVector scoring and v3.1 equations
- Verified against the official FIRST reference calculator
- Plain-language explanation for every metric value you select
- Paste any CVSS vector to import, edit, and re-score it
- Live vector string with one-click copy for reports and advisories
- Runs entirely in your browser — no telemetry, no sign-up
Frequently Asked Questions
Which CVSS versions does the calculator support?
Both CVSS v4.0 (base metrics AV/AC/AT/PR/UI plus vulnerable-system impacts VC/VI/VA and subsequent impacts SC/SI/SA, with optional E/CR/IR/AR) and v3.1 (the eight base metrics) — switch versions at the top of the tool.
How are severity bands defined?
Scores follow the standard FIRST bands: 0.0 None, 0.1 to 3.9 Low, 4.0 to 6.9 Medium, 7.0 to 8.9 High, and 9.0 to 10.0 Critical. The v4.0 engine uses the official macroVector lookup table from the FIRST reference implementation.
Can I import an existing vector string?
Yes — paste a vector such as CVSS:4.0/AV:N/AC:L/... or CVSS:3.1/AV:N/... into the import field and press Import; every metric selector updates to match, and you can tweak individual metrics from there.
Is scoring done through an online service?
No — the lookup and interpolation algorithm runs entirely in your browser, so vectors containing sensitive system details never leave your machine, and results appear instantly with a plain-language breakdown of each metric.