Calculate a CVSS v3.1 Base score from the eight base metrics and get the numeric score, the severity rating, and the canonical vector string. The maths follows the FIRST.org specification exactly, including the scope-change formula and the roundup rule that trips up many implementations.
How to use it
- Select a value for each of the eight base metrics.
- The score, severity band and vector string update as you go.
- Copy the vector string to paste into a ticket, advisory or report.
Score a vulnerability as it exists in the affected component itself, assuming a reasonable worst case, not as it happens to be configured on one particular server. Environmental adjustments belong in the separate environmental metric group.
Understanding the eight base metrics
The base group splits into exploitability and impact. Attack Vector asks how far away the attacker can be, ranging from Network through Adjacent and Local to Physical. Attack Complexity is Low when the attack works reliably, and High only when conditions outside the attacker control must be met, such as winning a race or defeating ASLR. Privileges Required and User Interaction capture what the attacker must already hold and whether a victim must click something.
Scope is the metric most often misapplied. It changes only when the exploited component and the impacted component fall under different security authorities, for example a sandbox escape or a hypervisor breakout. Scope change both raises the impact weighting and alters the privileges-required values, which is why a scope-changed vector scores markedly higher. The three impact metrics, Confidentiality, Integrity and Availability, are then rated None, Low or High.
Score bands and the roundup rule
Scores map to bands: 0.0 is None, 0.1-3.9 Low, 4.0-6.9 Medium, 7.0-8.9 High and 9.0-10.0 Critical. If any impact metric is above None the base score is derived from exploitability and impact sub-scores; if all three impacts are None the score is 0.0 regardless of how easy the attack is. CVSS v3.1 also specifies a precise roundup that always rounds up to one decimal place using integer arithmetic, which removes the floating-point discrepancies that caused v3.0 tools to disagree by a tenth. This calculator implements that exact function, so a textbook vector such as AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H returns 9.8.
Frequently asked questions
Does a high CVSS score mean I must patch immediately?
Not on its own. CVSS Base measures intrinsic severity, not risk to you. It knows nothing about whether the asset is internet-facing, whether a working exploit exists, or whether compensating controls apply. Combine it with exploit intelligence such as KEV or EPSS and with your own asset context before setting a deadline.
Why does changing Scope raise the score so much?
Because a scope change means the vulnerability broke out of its security boundary and affected resources governed by a different authority. That is materially worse than compromising only the vulnerable component, so the formula weights impact more heavily and treats required privileges as less of an obstacle.
Is anything I enter recorded?
No. The calculation runs entirely in your browser, so vulnerability details you are scoring stay on your machine and are never sent to a server.
Related tools: Hash Analyzer, URL Scanner, CIDR / Subnet Calculator.