CVSS 4.0 + 3.1 Calculator
Build a CVSS vector and calculate Base, Threat, and Environmental severity locally.
CVSS turns a vulnerability into a number from 0 to 10 so that teams can argue about priorities with a shared vocabulary. The score comes from a handful of metrics about how the flaw is reached and what it costs you, and learning to pick those metrics honestly matters far more than the arithmetic.
How to use it
- Choose CVSS 4.0 or the legacy 3.1 view.
- Set the Base metrics; add Threat, Environmental, and Supplemental metrics when the context is known.
- Copy the vector string with the score so another person can reproduce your assessment.
What to take away
Attack Vector does most of the work
Network beats Adjacent beats Local beats Physical, and the gap is large. Reachability from the internet is the single biggest driver of a high score.
Scope change is the most misunderstood metric
Scope changes when the flaw lets you affect resources beyond the vulnerable component itself — a container escape, or a browser sandbox break. It pushes scores up sharply, so do not set it casually.
A base score is not a risk rating
CVSS base scores deliberately ignore your environment. A 9.8 on a system with no data and no network path may matter less to you than a 6.5 on your payment service. Use the score to start the conversation, not to end it.
Frequently asked questions
What counts as a critical CVSS score?
On the standard scale: 0.1–3.9 Low, 4.0–6.9 Medium, 7.0–8.9 High, and 9.0–10.0 Critical. Those bands are conventions for reporting, not laws — plenty of organisations remap them to their own SLAs.
What is a CVSS vector string?
A compact text form of every metric you picked, like CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. It lets anyone reproduce your exact score, so include it with the number in reports.
Should I be using CVSS 3.1 or 4.0?
CVSS 4.0 is the current standard and separates vulnerable-system from subsequent-system impacts. CVSS 3.1 remains useful when reading older reports. Always state the version and vector alongside the score.
Where this fits in the course
This security tool pairs with Path 10 — Fundamentals — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Vulnerability Report Writer — A guided form that forces good structure — title, severity, steps to reproduce, impact, remediation — then exports clean Markdown or a printable PDF.
- Incident Severity & SLA Calculator — Impact × urgency in, a priority tier and realistic remediation SLA out.
- Risk Register Builder — Add risks with likelihood and impact, get an auto-scored severity, and export the register as Markdown.
- Dependency / SBOM Risk Checker — Paste a dependency list and flag ones matching a known-vulnerable version range.