Free tool · No signup · Runs 100% in your browser
CVSS Calculator — v4.0, v3.1 & v3.0
Score any vulnerability in seconds. Pick the metrics below and get the Base, Temporal and Environmental scores, the severity rating and a copy-ready vector string — for CVSS 4.0, 3.1 and 3.0. Verified against FIRST's official reference vectors.
How CVSS scoring works
CVSS rates a vulnerability from 0.0 (None) to 10.0 (Critical) using three metric groups. Base metrics describe intrinsic exploitability (Attack Vector, Attack Complexity, Privileges Required, User Interaction) and impact (Confidentiality, Integrity, Availability — split into vulnerable-system and subsequent-system in v4.0). Threat / Temporal metrics capture exploit maturity and fix availability, which change over time. Environmental metrics tune the score to your deployment: how much you depend on the affected system and how the base metrics shift in your network.
CVSS 4.0 vs 3.1 vs 3.0 — which version?
New Attack Requirements metric, Passive vs Active user interaction, and separate subsequent-system impact. Macrovector + severity-distance interpolation replace the old formulas. Best for OT, safety-critical and modern web/API bugs.
The industry workhorse. Same metrics as v3.0 with clarified definitions and integer-safe RoundUp rounding that fixes floating-point edge cases. Still required by many bug-bounty programs and scanners.
Legacy. Identical metrics and weights to v3.1; only the rounding differs (original naive RoundUp). Scores agree with v3.1 on virtually all real vectors — kept for historical NVD entries and old reports.
Frequently asked questions
What is a CVSS score?
The Common Vulnerability Scoring System (CVSS) is the open standard, maintained by FIRST, for rating the severity of software vulnerabilities on a 0.0–10.0 scale. It turns the technical properties of a bug — how it is reached, what access it needs, what it breaks — into one comparable number plus a severity label (None, Low, Medium, High, Critical).
Should I use CVSS v4.0, v3.1 or v3.0?
Use CVSS v4.0 for new assessments: it adds Attack Requirements, separates vulnerable-system from subsequent-system impact, and scores OT, safety-critical and granular-privilege cases far better. Use v3.1 when a disclosure program (many bug bounty and VDP programs still do) or your scanner baseline requires it. v3.0 is legacy — kept here for historical vectors. Severity bands are identical across all three versions.
What is a CVSS vector string?
A compact, machine-readable encoding of every metric choice, e.g. CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Paste one into the Load box above and the calculator reconstructs the exact scores. Vector strings are what scanners, NVD entries and bug-bounty reports exchange.
What is the difference between Base, Temporal and Environmental scores?
The Base score captures intrinsic properties of the vulnerability and never changes. The Temporal score adjusts for things that change over time: exploit-code maturity, available fixes and report confidence. The Environmental score adjusts for your deployment: how important the affected system is to you (security requirements) and how the base metrics shift in your environment (modified metrics). Triage on Base; plan remediation on Environmental.
How accurate is this calculator?
The scoring engine is a direct port of FIRST’s official reference calculators and was differential-tested against them: 41,270 official v4.0 reference vectors score identically to the reference implementation, and 3,005 v3.1 vectors (including temporal and environmental metrics) match the official v3.1 calculator exactly.
Do I need an account? Is my data stored?
No account, no storage. All scoring runs locally in your browser — vectors never leave your machine. BountyForge uses the same engine to score findings in its autonomous pentest reports.
Get findings that come pre-scored
BountyForge's AI pentest engine hunts XSS, SSRF, SQLi, IDOR and auth-bypass bugs in isolated sandboxes — every verified finding ships with a CVSS vector, severity and PoC, ready for your disclosure platform or ticketing queue.