CVSS Calculator

The Base Score represents the intrinsic characteristics of a vulnerability that remain constant over time. The Temporal Score adjusts the Base Score based on factors that change over time, such as exploit availability and patch status. The Environmental Score further customizes the score based on your specific organizational security requirements and asset importance.

CVSS v3.1 uses five severity ratings: None (0.0), Low (0.1-3.9), Medium (4.0-6.9), High (7.0-8.9), and Critical (9.0-10.0). These ratings help security teams prioritize which vulnerabilities to address first, with Critical and High vulnerabilities typically requiring immediate attention.

Yes, this calculator generates a shareable URL that includes the complete CVSS vector string. You can copy this URL and share it with colleagues, security teams, or include it in vulnerability reports. The recipient will see the exact same metrics and scores when they open the link.

Attack Vector describes how a vulnerability can be exploited. Network (highest impact) means the attack can be launched remotely, Adjacent requires local network access, Local requires system access, and Physical requires physical device access. A Network attack vector typically results in higher scores because it allows remote exploitation without requiring proximity to the target.

The Scope metric indicates whether exploiting a vulnerability can affect resources beyond the vulnerable component. When Scope is Changed, the vulnerability can impact other components (like escaping a sandbox), which typically increases the overall score. When Unchanged, only the vulnerable component is affected.