CVSS Calculator
What the Base metrics measure
Each Base metric answers one question about the vulnerability itself, independent of who runs the software. The Base score is the number that NVD and vendors publish.
| Group | Metrics | Question it answers |
|---|---|---|
| Exploitability | AV, AC, AT (4.0), PR, UI | How easy is it to trigger the vulnerability? Remote, reliable, unauthenticated, and no victim action scores highest. |
| Impact on the vulnerable system | C, I, A (3.x) or VC, VI, VA (4.0) | What can the attacker read, change, or take offline on the system that has the bug? |
| Reach beyond the component | S (3.x) or SC, SI, SA (4.0) | In 3.x, does the impact cross a security authority boundary, for example a sandbox escape or a guest that affects the hypervisor? In 4.0, what can the attacker read, change, or take offline on a subsequent system? |
How to use the CVSS calculator
- Select CVSS 4.0 or CVSS 3.1. New advisories should use 4.0. Many vendors and NVD still publish 3.1 vectors.
- Paste a vector string or enter a CVE ID in the field at the top. The calculator loads the NVD vector from the Strix CVE Database.
- Or set each Base metric in the cards below. Every metric shows the question it answers. The score appears when all Base metrics are set.
- Open the Threat, Environmental, or Supplemental groups to score the vulnerability for your own environment.
- Use the list of changes that move the score most to settle a disagreement about one metric. Then copy the vector, the Markdown summary, or the link to this exact configuration.
Worked examples
Real vulnerabilities with the NVD CVSS 3.1 vector and our CVSS 4.0 mapping of the same facts. Open one to see every metric filled in.
| Vulnerability | Why it scores this way | CVSS 3.1 | CVSS 4.0 |
|---|---|---|---|
| XZ Utils backdoorCVE-2024-3094 | Supply-chain backdoor in liblzma. It gives an unauthenticated remote attacker code execution inside sshd, so the impact reaches beyond the library. | 10.0 | 10.0 |
| regreSSHionCVE-2024-6387 | Signal handler race condition in OpenSSH. Remote root without credentials, but the attacker must win a race that takes hours, so Attack Complexity is High. | 8.1 | 9.2 |
| Dirty PipeCVE-2022-0847 | Linux kernel page cache bug. Any local user can overwrite read-only files and become root, but the attacker needs a shell first. | 7.8 | 8.5 |
| Reflected XSS | Script injected through a URL parameter and executed in the victim's browser. The victim must open the link, and the impact lands in the browser, not the server. | 6.1 | 5.1 |
CVSS 4.0 metric groups
CVSS 4.0 has four metric groups. Base metrics describe the vulnerability itself and do not change over time. Threat metrics adjust the score for the current exploit maturity. Environmental metrics adjust the score for one deployment. Supplemental metrics add context such as Safety and Automatable, and they do not change the numeric score.
The nomenclature next to the score shows which groups you used. CVSS-B is Base only. CVSS-BT adds Threat. CVSS-BE adds Environmental. CVSS-BTE uses all three.
Severity bands
| Severity | Score range |
|---|---|
| None | 0.0 |
| Low | 0.1 – 3.9 |
| Medium | 4.0 – 6.9 |
| High | 7.0 – 8.9 |
| Critical | 9.0 – 10.0 |
Score a real CVE
Every page in the Strix CVE Database has a link that opens its NVD vector in this calculator. Use it to adjust the Environmental metrics for your own deployment, or to compare the CVSS 3.1 and CVSS 4.0 views of the same vulnerability.
Scoring follows the FIRST CVSS v3.1 and v4.0 specifications. The CVSS 4.0 implementation is a port of the FIRST.Org reference calculator (BSD-2-Clause). CVSS is owned by FIRST.Org, Inc.
Frequently asked questions
Keep exploring
Start testing in minutes
Connect your GitHub repos and domains, and get fully set up in a few clicks.