Calculate CVSS v3.1 and v4.0 vulnerability scores with the full base, temporal, and environmental metric groups.
CVSS Score Calculator turns vulnerability characteristics into standardized CVSS severity scores. Choose CVSS v3.1 or v4.0, complete the Base metrics, and optionally apply time-sensitive and deployment-specific values from the other metric groups. The most common mistake is treating the result as a complete risk or patch-priority decision. CVSS summarizes severity from the supplied metrics, but it does not independently know an asset's business value, compensating controls, or organizational risk tolerance.
A concrete input and expected output from the current implementation.
Input
CVSS 3.1: AV:N, AC:L, PR:N, UI:N, S:U, C:H, I:H, A:H; all Temporal and Environmental metrics: Not Defined
Expected output
Base: 9.8 (Critical); Temporal: 9.8 (Critical); Environmental: 9.8 (Critical)
Network access, low complexity, no required privileges, and no user interaction produce high exploitability, while all three impacts are High. Not Defined optional metrics use neutral or inherited values, so the adjusted scores remain 9.8.
Choose v3.1 or v4.0 before setting metrics. In v3.1, the Base group includes Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, and three impact measures. v4.0 has different definitions, including Attack Requirements and separate vulnerable-system and subsequent-system impacts, so metric values and vectors must remain within one version.
Base metrics describe intrinsic severity. CVSS v3.1 Temporal choices cover exploit-code maturity, remediation level, and report confidence, while Environmental choices apply local importance and modified conditions. CVSS v4.0 uses Threat and Environmental concepts instead of the v3.1 Temporal formula. Not Defined values preserve applicable defaults or inherit Base values rather than representing zero severity.
In CVSS v3.1, the Privileges Required weight depends on whether Scope is Unchanged or Changed. Changing Scope can therefore alter more than the impact portion of the calculation. This interaction belongs to the published v3.1 formula. CVSS v4.0 does not use the v3.1 Scope metric.
No. A CVSS result summarizes severity for the metrics entered. Patch order may also depend on asset criticality, exposure, active exploitation, compensating controls, and operational constraints. Apply Environmental and Threat or Temporal metrics where appropriate, and retain the versioned vector so reviewers can see the assumptions behind the score.
The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.