Short answer: pick a value for each of the eight CVSS v3.1 base metrics, or paste a vector string, and the calculator shows the base score (0.0 to 10.0) and severity rating using the formulas in FIRST’s official specification. Everything runs in your browser.
| Impact subscore | 0.0 |
| Exploitability subscore | 0.0 |
Calculated on your device with the CVSS v3.1 base equations. Nothing is sent anywhere. This covers base metrics only; temporal and environmental metrics are not included.
CVSS v3.1 severity ratings
| Base score | Severity | Example vector |
|---|---|---|
| 0.0 | None | No impact on confidentiality, integrity or availability |
| 0.1 to 3.9 | Low | AV:P/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N (1.6) |
| 4.0 to 6.9 | Medium | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (6.1, typical reflected XSS) |
| 7.0 to 8.9 | High | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8) |
| 9.0 to 10.0 | Critical | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8, unauthenticated remote code execution) |
What each base metric means
- Attack Vector (AV): how close the attacker has to be. Network means over the internet; Physical means touching the device.
- Attack Complexity (AC): High when the attack depends on conditions the attacker cannot control, such as winning a race condition.
- Privileges Required (PR): the access the attacker needs before the attack. None is the worst case.
- User Interaction (UI): Required when a victim has to click, open or approve something.
- Scope (S): Changed when a flaw in one component lets the attacker affect another, such as escaping a virtual machine or sandbox.
- Confidentiality, Integrity, Availability (C/I/A): how much data can be read, changed or made unavailable.
CVSS is severity, not priority
A base score describes how bad a flaw is in general, not how urgent it is for you. FIRST's specification says so directly. Before you rank patches by score, check whether the flaw is in CISA's Known Exploited Vulnerabilities catalog, whether the system is reachable from the internet, and what the asset does. Our patch priority checklist walks through those questions, and vulnerability prioritization is a core topic in the CySA+ exam and Security+.
FIRST published CVSS v4.0 in November 2023, and some vendors and the NVD now show v4.0 scores alongside v3.1. Most advisories and scanners still publish v3.1 scores, which is what this calculator implements. To look up the official score for a specific CVE, search the NVD.
CVSS calculator FAQ
How is a CVSS v3.1 base score calculated?
FIRST's formula combines an exploitability subscore (attack vector, complexity, privileges, user interaction) with an impact subscore (confidentiality, integrity, availability), adjusts for scope, caps the result at 10 and rounds up to one decimal place.
What CVSS score is critical?
9.0 to 10.0 is Critical, 7.0 to 8.9 High, 4.0 to 6.9 Medium, 0.1 to 3.9 Low and 0.0 None.
Why does my result differ from the NVD score?
NVD analysts and vendors sometimes pick different metric values for the same flaw, and some records use CVSS v4.0. Paste the exact vector from the advisory to reproduce its score.
Should I patch by CVSS score alone?
No. Use CVSS for severity, then add whether the flaw is actively exploited (CISA KEV), whether the system is internet-facing, and how important the asset is.
Does this calculator support CVSS 4.0?
Not yet. It implements the CVSS v3.1 base metrics, which most advisories and scanners still publish. FIRST hosts an official CVSS 4.0 calculator.
Sources: FIRST, CVSS v3.1 Specification Document (equations in section 7, rating scale in section 5) and CVSS v4.0 Specification; NIST NVD Vulnerability Metrics. Accessed October 24, 2026.