CVSS 3.1 calculator
Choose the metrics below and get the CVSS v3.1 base, temporal, and environmental score, its severity rating, and a shareable vector string. Everything runs in your browser — nothing you enter leaves this page.
Base metrics
The intrinsic, unchanging qualities of the vulnerability. These are required and produce the headline score.
How CVSS severity ratings work
A CVSS number maps to a qualitative severity band. Most teams use these bands to decide what to fix first — Critical and High vulnerabilities are the ones that typically demand immediate attention.
| Severity | Score range |
|---|---|
| None | 0.0 |
| Low | 0.1 – 3.9 |
| Medium | 4.0 – 6.9 |
| High | 7.0 – 8.9 |
| Critical | 9.0 – 10.0 |
CVSS questions, answered
What is a CVSS score?
CVSS (the Common Vulnerability Scoring System) is an open standard for rating the severity of a security vulnerability on a 0 to 10 scale. A higher number means a more serious flaw. The score is derived from a set of metrics describing how the vulnerability is exploited and what happens if it is.
What counts as a high CVSS score?
Scores of 9.0 to 10.0 are rated Critical and 7.0 to 8.9 are High — these are the ones most teams prioritise fixing first. 4.0 to 6.9 is Medium, 0.1 to 3.9 is Low, and 0.0 is None.
What is the difference between base, temporal, and environmental scores?
The base score reflects the intrinsic, unchanging traits of the vulnerability and is the number usually quoted (for example on a CVE record). The temporal score adjusts it for how the threat is evolving, such as whether working exploit code exists. The environmental score tailors it to your own systems and how important confidentiality, integrity, or availability are to you.
Is this the same as CVSS 4.0?
No. This calculator implements CVSS v3.1, which remains the most widely used version and the one behind most current CVE records. CVSS 4.0 uses a different metric set and scoring method; a 3.1 vector and a 4.0 vector are not interchangeable.
Does a high CVSS score mean I am definitely at risk?
Not on its own. CVSS measures the severity of a flaw, not your specific risk. Real risk also depends on whether the affected system is exposed, whether it holds sensitive data, and what compensating controls you have. The environmental metrics let you fold some of that context in, but a penetration test is how you find out what is actually exploitable in your environment.
How to read a CVSS vector string
The vector string is the score written out as its inputs, for example CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Two people with the same vector get the same score.
- AV Attack Vector: how close the attacker must be (network, adjacent, local, physical).
- AC Attack Complexity and PR Privileges Required: how hard it is, and whether a login is needed first.
- UI User Interaction: whether a person has to click or open something.
- S Scope: whether the flaw reaches beyond the component that has it.
- C, I, A Confidentiality, Integrity, Availability: how much of each is lost.
Common CVSS mistakes
- Treating the base score as your risk. The temporal and environmental groups exist so you can adjust for exploit availability and for your own systems.
- Marking Attack Complexity High because a firewall is in the way. The standard says target-specific mitigations belong in the environmental score.
- Treating the severity band as required. The standard makes it optional:
“The use of these qualitative severity ratings is optional, and there is no requirement to include them when publishing CVSS scores.”
Using v4.0 instead? Try the CVSS 4.0 calculator. A score ranks a flaw; whether an attacker can actually use it in your environment is what a penetration test answers.
Related tools and guides
Found something serious?
A score tells you how bad a flaw is in theory. A penetration test tells you what an attacker could actually do with it in your environment. Compare UK penetration testing companies in our directory.
Browse the directory