CVSS Calculator — v4.0, v3.1, v3.0 & v2.0 Score Calculator
Calculate CVSS base, temporal and environmental scores for every CVSS version with this universal CVSS calculator — v4.0 (the latest version), v3.1, v3.0 and v2.0 on a single page. Paste a CVSS vector string (e.g. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) or click the metrics to build one interactively — the score updates live. No download, no app to install: it runs in any modern browser on Windows, macOS or Linux. Implements the published FIRST equations, verified against official reference vectors. 100% client-side: your vectors never leave your browser.
Note: CVSS v2.0 is legacy (superseded by v3.0 in 2015). It has no Critical rating band, and unlike v3 it uses ordinary rounding. Kept here for historical score reproduction.
How CVSS scoring works (the actual formulas, explained)
CVSS scores are not estimates — they are deterministic functions of the metric values, published by FIRST. This section explains step by step how CVSS scores are calculated for each version. Understanding the formula helps you score consistently and spot calculator bugs.
CVSS v3.1 / v3.0
ISCBase = 1 − (1−C) × (1−I) × (1−A) Scope Unchanged: Impact = 6.42 × ISCBase Scope Changed: Impact = 7.52 × (ISCBase − 0.029) − 3.25 × (ISCBase − 0.02)^15 Exploitability = 8.22 × AV × AC × PR × UI (PR uses 0.68/0.5 when Scope is Changed) BaseScore = Roundup( min(Impact + Exploitability, 10) ) [×1.08 if Scope Changed] TemporalScore = Roundup( BaseScore × E × RL × RC ) Environmental: same pipeline with modified metrics (MAV…MSA, CR/IR/AR)
Roundup is the classic implementation trap: it means the smallest number with one decimal place greater than or equal to the input — so 4.02 becomes 4.1, not 4.0. Many third-party calculators get this wrong by using normal rounding.
CVSS v4.0
v4.0 abandoned closed-form equations. Metrics are mapped to six MacroVector equivalence classes (EQ1–EQ6, e.g. exploitability level, impact level), the MacroVector is scored via the official FIRST lookup table, and the final score is interpolated by severity distance within the MacroVector. Supplemental metrics (Safety, Automatable, Recovery, Value Density, Response Effort, Provider Urgency) never affect the score. This calculator embeds the official lookup table and interpolation algorithm.
CVSS v2.0
Impact = 10.41 × (1 − (1−C)(1−I)(1−A)) Exploitability = 20 × AV × AC × Au BaseScore = round( ((0.6×Impact) + (0.4×Exploitability) − 1.5) × f(Impact) ) [f=0 if Impact=0 else 1.176] TemporalScore = round( BaseScore × E × RL × RC ) EnvironmentalScore = round( (AdjustedTemporal + (10−AdjustedTemporal) × CDP) × TD )
v2 uses ordinary rounding to one decimal — another reason v2 and v3 scores for “the same” vulnerability differ.
CVSS severity rating scale
| Rating | v4.0 / v3.x score | v2.0 score |
|---|---|---|
| None | 0.0 | 0.0 |
| Low | 0.1 – 3.9 | 0.1 – 3.9 |
| Medium | 4.0 – 6.9 | 4.0 – 6.9 |
| High | 7.0 – 8.9 | 7.0 – 10.0 |
| Critical | 9.0 – 10.0 | — (does not exist in v2) |
CVSS v3.1 vs v4.0 — what actually changed
| Aspect | v3.1 | v4.0 |
|---|---|---|
| Scope concept | Single Scope metric (Unchanged/Changed) | Split into vulnerable-system impact (VC/VI/VA) and subsequent-system impact (SC/SI/SA) |
| New base metrics | — | Attack Requirements (AT); User Interaction gains Active (A) alongside Passive (P) |
| Threat metrics | Exploit Code Maturity, Remediation Level, Report Confidence | Only Exploit Maturity (E); RL/RC removed |
| Math | Closed-form equations with Roundup | MacroVector lookup table + interpolation |
| Extra context | — | Supplemental metrics: Safety, Automatable, Recovery, Value Density, Response Effort, Provider Urgency |
| Score labels | Base / Temporal / Environmental | CVSS-B / CVSS-BT / CVSS-BE / CVSS-BTE |
Scores are not comparable across versions — a 7.5 in v3.1 and a 7.5 in v4.0 mean different things. Always publish the version with the score.
Real-world examples (verified vectors)
| CVE | Vector | Score | Rating |
|---|---|---|---|
| CVE-2021-44228 (Log4Shell) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | 10.0 | Critical |
| CVE-2020-1472 (Zerologon, NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | 10.0 | Critical |
| CVE-2020-1472 (Zerologon, vendor CNA) | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | 5.5 | Medium |
| CVE-2017-0144 (EternalBlue) | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | 8.1 | High |
| CVE-2014-0160 (Heartbleed) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | 7.5 | High |
| CVE-2014-3566 (POODLE) | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N | 3.4 | Low |
| CVE-2022-41741 (NGINX mp4) | CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | 7.3 | High |
| Heartbleed (v2) | AV:N/AC:L/Au:N/C:P/I:N/A:N | 5.0 | Medium |
Paste any of these vectors into the calculator above to reproduce the score. Note the Zerologon rows: the same CVE scored 10.0 by NVD and 5.5 by the vendor — CVSS involves analyst judgment, which is exactly why the vector string must always accompany the score.
How to use this CVSS calculator
- Pick a version tab — v4.0 for new assessments, v3.1 to match NVD data, v2.0 for legacy scores.
- Either paste a vector string and press Parse, or click the metric pills to build a vector interactively — the score, severity rating and canonical vector update live.
- Refine with temporal & environmental metrics (v3/v4): set Exploit Maturity once exploit code appears, and set security requirements (CR/IR/AR) plus modified metrics for your environment to get a prioritized score.
- Copy the vector and publish it with the score — a bare number without its vector is not a valid CVSS assessment.
- Looking for a reverse CVSS calculator (score → vector)? There is no unique answer — many different metric combinations produce the same score. The practical workflow: build candidate vectors with the metric pills above and watch the live score until it matches your target.
CVSS best practices
- Always publish the vector with the score. A bare “7.5” is meaningless without its metrics — and the version.
- Use the latest version (v4.0) for new assessments; keep v3.1 only where you must match existing NVD data.
- Apply temporal and environmental metrics before prioritizing: re-score when exploit code appears (set Exploit Maturity), and tune security requirements (CR/IR/AR) to your environment.
- Never compare scores across versions. A 7.5 in v3.1 and a 7.5 in v4.0 are different measurements.
- Prefer the official FIRST calculator for disputes — this page is verified against it, but FIRST is canonical.
CVSS in spreadsheets, scripts and APIs
There is no API on this page — it is a client-side web tool. But the formulas above translate directly:
- Excel & spreadsheets: the v2 and v3 equations are closed-form; each metric value is a constant, so a base-score calculator is a single row of formulas — usable as a reusable Excel template. Remember v3's Roundup (
=CEILING(x-0.05,0.1)style logic, notROUND). - Python: a v3.1 base scorer is ~30 lines; v4.0 needs the official FIRST lookup table plus the interpolation algorithm (both published by FIRST).
- CVE data at scale: use the NVD API to fetch vectors for many CVEs, then score locally — never send vulnerability data to an untrusted third-party calculator.
Comparison: this calculator vs the official tools
| This page | first.org calculator | NVD calculator | |
|---|---|---|---|
| Versions on one page | v4.0 + v3.1 + v3.0 + v2.0 | One page per version | v4.0 / v3.x / v2 (separate) |
| Vector-string parser | Yes | Yes | Yes |
| Temporal & environmental | Yes, all versions | Base-focused UI | Minimal |
| Per-metric explainers | Yes, with examples | Spec text only | No |
| Educational content | Formulas, CVE examples, FAQ | Specification documents | No |
| Canonical reference | No — use FIRST for disputes | Yes | Yes (for NVD data) |
Comparison as of October 2026 — interfaces change; verify against the current pages. When a score is disputed, the FIRST calculator is authoritative.
Frequently asked questions
What is a CVSS calculator?
A CVSS calculator computes a Common Vulnerability Scoring System score (0.0–10.0) from metrics describing a vulnerability — exploitability (attack vector, complexity, privileges, user interaction) and impact (confidentiality, integrity, availability). The standard is maintained by FIRST.org. This page implements the published FIRST equations for v4.0, v3.1, v3.0 and v2.0, verified against official reference vectors.
How do you calculate a CVSS score?
Assign every base metric a value, then apply the version's formula. For v3.1: Impact = 6.42 × ISC (or the scope-changed variant), Exploitability = 8.22 × AV × AC × PR × UI, BaseScore = Roundup(min(Impact + Exploitability, 10)). v4.0 maps metrics to a MacroVector and looks the score up in the official FIRST table with interpolation. Click the metrics above or paste a vector string — the page does the math.
What is a CVSS vector string and how do I read one?
A vector string is the compact form of the metric values, e.g. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H: version prefix first, then METRIC:VALUE pairs — AV:N = Attack Vector Network, C:H = Confidentiality High. Paste any vector into the calculator to parse it.
What is the difference between CVSS v3.1 and v4.0?
v4.0 replaced Scope with separate vulnerable-system (VC/VI/VA) and subsequent-system (SC/SI/SA) impacts, added Attack Requirements (AT) and active user interaction, kept only Exploit Maturity as the threat metric, and changed the math to a MacroVector lookup table with interpolation. Scores are not comparable across versions.
Which CVSS version should I use?
v4.0 for new assessments (current FIRST standard). v3.1 to match existing NVD data. v2.0 only for historical comparisons — it is legacy.
What do the CVSS severity ratings mean?
v3.x/v4.0: None 0.0, Low 0.1–3.9, Medium 4.0–6.9, High 7.0–8.9, Critical 9.0–10.0. v2.0 has no Critical band. The rating buckets the numeric score; it adds no new information.
What is the difference between base, temporal and environmental CVSS scores?
Base = intrinsic properties. Temporal = adjusted for time-varying factors (exploit maturity, remediation level, report confidence). Environmental = adjusted for your environment (security requirements CR/IR/AR, modified base metrics). NVD usually publishes base scores only.
Why do NVD and the vendor publish different CVSS scores for the same CVE?
Analyst judgment differs. CVE-2020-1472 (Zerologon): NVD 10.0 Critical vs Microsoft 5.5 Medium — different metric choices. Always publish the vector string with the score.
Does a CVSS score measure risk?
No — it measures technical severity. Risk also needs asset value, exposure and threat context, which CVSS does not capture. Use the score as one input to vulnerability management, not a risk rating alone.
Is CVSS v2 still used?
Rarely — superseded by v3.0 in 2015. It remains in legacy databases and some compliance checklists. The v2 tab here reproduces historical scores (note: no Critical band, ordinary rounding).
What do CVSS-B, CVSS-BT, CVSS-BE and CVSS-BTE mean?
v4.0 nomenclature for the metric groups used: B = base only, BT = base + threat, BE = base + environmental, BTE = all three. Shown next to every v4.0 score above.
What are supplemental metrics in CVSS v4.0?
Safety, Automatable, Recovery, Value Density, Response Effort, Provider Urgency — context that never changes the numeric score by design.
How is this calculator different from the official FIRST calculator?
FIRST's is the canonical reference (one page per version, minimal prose). This page combines v4.0/v3.1/v3.0/v2.0 with a vector parser, per-metric explainers, temporal/environmental sections and educational content. Scoring engines implement the published FIRST equations, verified against official reference vectors. Comparison as of October 2026.
Is my vector data sent to a server?
No — everything runs in your browser. Confirm in DevTools' Network tab: zero requests. Nothing you paste or click leaves your device.
Where can I find the CVSS score of a CVE?
The NVD (nvd.nist.gov) publishes CVSS base scores and vector strings for most CVEs — search the CVE ID there, copy its vector, and paste it here to reproduce the score or add your own temporal/environmental metrics. Vendors such as Cisco and Microsoft publish their own vectors in security advisories (occasionally differing from NVD, as the Zerologon example above shows). Vulnerability scanners such as Tenable and Qualys, bug-bounty platforms such as HackerOne and Intigriti, GitLab's security dashboard, MITRE's CVE dictionary entries, and CISA's Known Exploited Vulnerabilities catalog all reference CVSS vectors and scores; the OWASP risk-rating methodology builds on similar scoring ideas.
Can I use CVSS scores in a spreadsheet or script?
Yes — v2/v3 formulas are closed-form (see above) and fit in a spreadsheet row or ~30 lines of Python. v4.0 needs FIRST's lookup table + interpolation. This page has no API; it is a client-side tool.
Why is CVSS v3 rounding special?
v3 uses Roundup: the smallest one-decimal number ≥ the input, so 4.02 → 4.1. Normal rounding here is the most common third-party calculator bug. v2 uses ordinary rounding; v4.0 rounds the interpolated result normally.
What does a CVSS score of 10.0 mean?
Maximum severity: remotely exploitable with no privileges or user interaction and total impact — e.g. Log4Shell (CVE-2021-44228). It still does not equal risk: a 10.0 on an unreachable test system matters less than a 7.0 on your internet-facing payment server.