Skip to content
>_ITDITDWeb Security Platform

CVSS Calculator & Vector Reader

Paste a CVSS vector string (CVSS:3.1/AV:N/…) to compute the v3.x base score exactly per the specification and read what each metric means for you, in plain language. Everything runs in your browser.

Everything runs in your browser. Your input is never sent to a server.

Paste a vector string above to see the score and what each metric means.

How to use

  1. 1

    Paste the vector string from NVD or a vendor advisory (CVSS:3.1/… or CVSS:4.0/…).

  2. 2

    For v3.0 / v3.1, the base score and severity are computed and every metric is explained.

  3. 3

    For v4.0, each metric is explained (use the published score from NVD or the vendor).

  4. 4

    Finally, check 'the defender's reading' for the combinations that change your priority.

Why it matters

Two 9.8s are not the same job: whether it needs a login, user interaction, or special conditions changes what you should do today. Don't order your work by the number alone — read the vector. And CVSS rates how bad it would be if exploited, not whether it is being exploited now; check that with KEV and EPSS.

FAQ

QWill the result match NVD's number?
A

The v3.0 / v3.1 base score follows the FIRST specification (including the v3.1 Roundup function) and has been checked against real published CVEs. NVD and the vendor (CNA) sometimes assess different vectors, though, and then the numbers differ too.

QWhy no v4.0 score?
A

v4.0 scores come from a large lookup table plus interpolation, which is easy to get subtly wrong when reimplemented by hand. Rather than risk a wrong number, v4.0 vectors are explained metric by metric; use the score published by NVD or the vendor.

QIs my vector sent anywhere?
A

No. Parsing and scoring happen entirely in your browser; nothing is sent to a server.

Related