CVSS 3.1 calculator
Choose the eight base metrics to get the CVSS 3.1 score, severity and vector string. The link updates as you go, so you can share the result.
Nothing leaves your browser: the score is calculated on this page.
How it works
The Common Vulnerability Scoring System (CVSS) rates the technical severity of a vulnerability from 0.0 to 10.0. Version 3.1 bases the score on eight metrics. Four describe how the vulnerability is exploited, one says whether the impact reaches beyond the vulnerable component (scope), and three describe the impact on confidentiality, integrity and availability. This calculator uses the formulas and the rounding rule from the FIRST CVSS v3.1 specification.
Reading the result
Scores map to severities: 0.1 to 3.9 is low, 4.0 to 6.9 medium, 7.0 to 8.9 high and 9.0 to 10.0 critical. The vector string records every choice, so others can see how you reached the score. It is also kept in the page address, so a copied link reproduces the result.
The base score describes the vulnerability, not the risk to your organisation. Exposure, existing controls, active exploitation and the value of the affected system all matter when you decide what to fix first.
Questions
Should I use CVSS 3.1 or 4.0?
CVSS 4.0 was published in 2023, but many advisories and vulnerability databases still use 3.1. Use the version your audience expects and always give the vector with the score.
What does Scope: Changed mean?
The vulnerable component and the affected component are under different security authorities, for example a guest escaping a virtual machine to reach the host. It raises the score.
Why does my score differ from the vendor’s?
Usually because of a different metric choice, often attack vector, privileges or scope. Compare the vector strings rather than the numbers.
Are temporal and environmental metrics supported?
Not yet. Vectors that include them still load; those metrics are ignored and only the base score is shown.
Need more than a tool can show?
A tool checks one thing. Our consultants look at the whole picture.
Penetration testingRelated articles
-
Cyber Resilience Act: a 2026 plan for product makers
What software and hardware teams should set up before CRA obligations apply: development evidence, vulnerability handling, updates and documentation.
-
CVSS, EPSS and KEV - how to prioritise vulnerabilities
Why a CVSS base score alone is a weak priority signal, how EPSS and the CISA KEV catalogue add threat context, and a simple order for patching.