sysop@hub:~/tools/cvss-calculator$
cvss-calculator
Build or decode a CVSS 3.1 base score. Choose a value for each of the eight metrics, or paste a vector string from an advisory to see what it actually says. Everything is computed in your browser.
0.0
None
exploitability
impact
reading the number
| Score | Severity |
|---|---|
| 0.0 | None |
| 0.1 – 3.9 | Low |
| 4.0 – 6.9 | Medium |
| 7.0 – 8.9 | High |
| 9.0 – 10.0 | Critical |
The base score describes how bad a flaw is in the abstract, not how urgent it is for you. A 9.8 on a system nobody can reach matters less than a 7.5 that is being exploited in the wild on your internet-facing gateway. Use the score together with exploitation status (see exploited-now) and your own exposure. This page implements CVSS 3.1 base metrics only; temporal and environmental metrics and CVSS 4.0 are not covered.
Related: exploited-now / CISA KEV Patch Tuesday calendar glossary