CVSS 4.0 & 3.1 Calculator

The Common Vulnerability Scoring System expresses the technical severity of a vulnerability as a number from 0.0 to 10.0. It describes how the flaw can be exploited and what an attacker gains, independently of any one organisation. The CVSS rating bands are None (0.0), Low (0.1–3.9), Medium (4.0–6.9), High (7.0–8.9) and Critical (9.0–10.0).

Severity is not risk. A Critical CVSS base score on an isolated lab host may matter less than a Medium on an internet-facing identity provider. Combine the base score with exploitation evidence (the CISA KEV catalog, EPSS probability) and asset context before setting remediation deadlines.

The CVSS 3.1 calculator uses eight base metrics. Exploitability: Attack Vector (Network, Adjacent, Local, Physical), Attack Complexity, Privileges Required and User Interaction. Scope records whether exploitation affects components beyond the vulnerable one. Impact: Confidentiality, Integrity and Availability, each High, Low or None.

The base score combines an impact sub-score and an exploitability sub-score, then applies the specification’s round-up function to one decimal place. A changed scope increases the weights for Privileges Required and multiplies the total by 1.08, which is why S:C vectors so often land at 10.0.

CVSS v4.0 (November 2023) removes Scope and instead scores impact on the vulnerable system (VC, VI, VA) and on subsequent systems (SC, SI, SA) separately. It adds Attack Requirements (AT) for preconditions such as race conditions, splits User Interaction into Passive and Active, and adds a Threat metric, Exploit Maturity (E).

Scoring no longer uses a formula. The vector is mapped to a MacroVector of six equivalence classes (EQ1–EQ6). Each MacroVector has an expert-ranked score in a 270-entry lookup table, which is then refined by the vector’s distance from the highest-severity vector in its class. The nomenclature names which groups were used: CVSS-B (base), CVSS-BT (base + threat), CVSS-BE and CVSS-BTE.

• Exploit Maturity defaults to Attacked when not set, so an unscored threat never lowers a score.
• Supplemental metrics (Safety, Automatable, Recovery, Value Density, Response Effort, Urgency) add context but never change the score.
• Use v4.0 for new advisories; keep v3.1 where scanners and SLAs still expect it.

Score the worst reasonable case of the vulnerability, not a single deployment. Ask how the attacker reaches the component (AV), what must already be true (AC, AT), what access they need (PR) and whether a user must act (UI). Then rate the impact on the vulnerable component and on anything downstream.

Paste vectors from NVD, GitHub advisories or vendor bulletins into the parser to check their arithmetic: re-scoring a published vector is the fastest way to catch a typo. The parser rejects unknown values and reports any missing mandatory metrics.