CVSS Calculator
Select the metrics, get the vector, the score and the severity — then the plain-English sentence that says what the score means. Four versions: 4.0, 3.1, 3.0 and 2.0.
A vector, not a number
A score on its own cannot be argued with: it comes down from on high and nobody knows where from. The vector, on the other hand, can be checked field by field. It is the string that precedes the number:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
It reads left to right like a sentence: attackable from the Internet, with no difficulty, no account, no click from the victim, and the flaw spills beyond the vulnerable component, taking read access, write access and availability with it. That is Log4Shell, and it scores 10.0. The calculator above writes out this translation under the score, on every click.
Make it a habit: in a ticket, a report or an exchange with a vendor, cite the vector. A number without its vector is not information, it is an opinion.
Which version to choose
The rule fits on one line: use the version your source publishes. The vector prefix always tells you which. If you are scoring a flaw yourself and nothing constrains you, use 3.1: it is the one everyone you work with can read.
| Version | Published | Use it when |
|---|---|---|
| 4.0 | 2023 | The record's vector starts with CVSS:4.0/. A growing number of vendors publish it alongside 3.1. |
| 3.1 | 2019 | Default. It is the version used by the NVD and by almost every CVE in circulation. |
| 3.0 | 2015 | You are reproducing a score dated 2015 to 2019. The metrics are those of 3.1. |
| 2.0 | 2007 | You are reading a record from before 2016. Only three severity bands. |
The score you get, and then what
CVSS answers a single question: how bad is the damage if this flaw is exploited? It has never claimed to answer the other two, which are what actually decide the order of fixes: is it exploited today? and how likely is it to be exploited tomorrow?
| Standard | What it tells you | Type |
|---|---|---|
| CVE | Which vulnerability (unique identifier) | Identification |
| CVSS | How severe it is (0 to 10) | Intrinsic severity |
| EPSS | Probability of exploitation within 30 days | Prediction |
| KEV | Exploitation already observed in the wild | Established fact |
In practice, the order that holds up over a working week is this: whatever is in the KEV catalog and runs in your estate is handled first; next, anything with an EPSS above 0.1; CVSS breaks the tie between two equally likely flaws. See how CVE monitoring targeted at your estate is built.
The four calculators
FAQ
Which CVSS version should I use?
The one your source publishes. If the record carries a vector starting with CVSS:4.0/, use 4.0; with CVSS:3.1/, use 3.1. If nothing is specified and you are scoring a flaw yourself, use 3.1: it is the version everyone you work with can read.
What is a CVSS vector?
It is the list of choices that produced the score, written in a reproducible form: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The number alone cannot be argued with; the vector can. That is what to cite in a ticket, a report or an exchange with a vendor.
Is the calculation done on your servers?
No. Everything runs in your browser: the vector you build is sent nowhere, and no sign-up is required. The “Copy link” button simply encodes the vector in the page address.
Does a high score mean it must be fixed urgently?
No. CVSS measures potential damage, not the likelihood of exploitation. A flaw rated 7.5 that is already exploited comes before a flaw rated 9.8 that nobody attacks. To decide, cross-check with EPSS and the KEV catalog.
Can I share a score calculated here?
Yes. The “Copy link” button produces an address that reopens the calculator on exactly your vector: paste it into a ticket, and the other person will see the same boxes checked as you.
Free plan, no card
Get only the CVEs that affect your actual estate.
Declare your components once. We alert you as soon as a flaw affects one of them, already prioritized by KEV and EPSS, on the channel of your choice. The first alert goes out at the next sync.
- Free, no credit card
- Built & hosted in France
- Export your data at any time