How to calculate a CVSS v3.1 score
The Common Vulnerability Scoring System (CVSS) is an open standard, maintained by FIRST.org, for communicating the severity of software vulnerabilities on a 0.0–10.0 scale.
- Paste an existing CVSS v3.1 vector string above, or select values using the metric buttons below it.
- Read the Base Score and severity rating — the Base metrics alone are enough to produce a score.
- Optionally expand Temporal and Environmental metrics to refine the score for the current state of exploitation, patch availability, or your own environment.
For example, the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — a network-exploitable vulnerability with low complexity, no privileges or user interaction required, and a total loss of confidentiality, integrity, and availability — produces a Base Score of 9.8 (Critical).
CVSS v3.1 severity ratings
A numeric CVSS score maps to one of five qualitative severity ratings, defined in Table 14 of the official CVSS v3.1 Specification Document:
| Rating | Score |
|---|---|
| None | 0.0 |
| Low | 0.1–3.9 |
| Medium | 4.0–6.9 |
| High | 7.0–8.9 |
| Critical | 9.0–10.0 |
Why does this calculator implement a specific "Roundup" algorithm?
The official CVSS v3.1 Specification Document includes an entire appendix devoted to this exact problem. Naive "round up to one decimal place" logic can produce wrong, platform-dependent scores because of ordinary floating-point representation error — the specification's own example: in JavaScript, 0.1 + 0.2 evaluates to 0.30000000000000004, not 0.3, and a naive rounding function would incorrectly round that up to 0.4. The specification prescribes an exact algorithm, based on integer arithmetic, to avoid this: multiply the input by 100,000, round to the nearest integer, and perform the "already at a clean boundary" check using only integer operations. This calculator implements that exact algorithm rather than a naive one.
Frequently asked questions
Is my vector string or vulnerability data sent anywhere?
No. All parsing and scoring happens locally in your browser using the equations published in the CVSS v3.1 specification — nothing is uploaded or sent to any server.
Does this calculator support CVSS v4.0 or v2.0?
Not currently. This calculator implements CVSS v3.1 specifically. CVSS v4.0 (the current standard as of its November 2023 release) uses a fundamentally different scoring mechanism — a large lookup table of pre-computed severity groupings rather than a closed-form equation — and CVSS v3.1 remains widely used in existing vulnerability databases, security tooling, and remediation workflows. The NVD currently supports CVSS v2.0, v3.x, and v4.0. A vector beginning with CVSS:3.0 is explicitly rejected rather than silently scored with v3.1 rules, since v3.0 uses a different Modified Impact formula and Roundup definition that can produce a different result.
Why is my Environmental Score sometimes different from my Base Score, even with no Environmental metrics set?
Because the two use genuinely different formulas, not because something is misconfigured. Not Defined (X) has no user-specified modifying effect, but what that means depends on which kind of metric it is: for Temporal metrics (E, RL, RC) and Security Requirements (CR, IR, AR), Not Defined uses the specification's own neutral/default value for that metric; for Modified Base metrics (MAV, MAC, MPR, MUI, MS, MC, MI, MA), Not Defined instead falls back to the corresponding Base metric's own value. Either way, the Environmental Score's overall formula has a different structure from the Base Score's (it uses its own Modified Impact sub-score, with its own 0.915 cap, and, when Scope is Changed, a different exponent and an extra factor not present in the Base formula at all). For most combinations of Base metrics, this produces an identical result once every Temporal/Environmental metric is Not Defined — but not always. For example, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H produces a Base Score of 9.6 and a genuinely different Environmental Score of 9.7, with every Environmental metric still at Not Defined. This calculator always shows all three scores, with a note when a group hasn't been customized, rather than hiding a score that's still genuinely computed.
Sources
- CVSS v3.1 Specification Document — FIRST.org (the authoritative source for every formula and constant this calculator uses)
- CVSS v3.1 User Guide — FIRST.org
- CVSS v3.1 Calculator — FIRST.org's own reference implementation
Last reviewed: . All calculation happens locally in your browser — nothing is uploaded.