Software Securityhome
Fix a findingSearch
Tools

CVSS v4.0 calculator

Score a vulnerability with CVSS v4.0: choose the metrics or paste a vector, and get the score, severity and vector string, computed exactly as FIRST’s reference calculator does.

LOCAL UTILITY / 05

Score a vulnerability

Choose a value for each metric, or paste a vector string. The score updates as you go and is computed in this browser with the scoring data of FIRST’s reference calculator.

For example CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

0.0None

CVSS-B score · MacroVector002201

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N

Loading the calculator… If this remains visible, refresh the page.

Base metrics

Required. The intrinsic characteristics of the vulnerability.

Exploitability

Attack Vector (AV)
Attack Complexity (AC)
Attack Requirements (AT)
Privileges Required (PR)
User Interaction (UI)

Vulnerable system impact

Confidentiality (VC)
Integrity (VI)
Availability (VA)

Subsequent system impact

Confidentiality (SC)
Integrity (SI)
Availability (SA)
Threat metrics

Optional. Exploit Maturity: Not defined counts as Attacked, the worst case.

Exploit Maturity (E)
Environmental metrics

Optional. Your security requirements and the base metrics as they apply in your environment. Not defined security requirements count as High.

Security requirements

Confidentiality Requirement (CR)
Integrity Requirement (IR)
Availability Requirement (AR)

Modified base metrics

Attack Vector (MAV)
Attack Complexity (MAC)
Attack Requirements (MAT)
Privileges Required (MPR)
User Interaction (MUI)
Vulnerable System Confidentiality (MVC)
Vulnerable System Integrity (MVI)
Vulnerable System Availability (MVA)
Subsequent System Confidentiality (MSC)
Subsequent System Integrity (MSI)
Subsequent System Availability (MSA)
Supplemental metrics

Optional. Extra context recorded in the vector; they never change the score.

Safety (S)
Automatable (AU)
Recovery (R)
Value Density (V)
Vulnerability Response Effort (RE)
Provider Urgency (U)

Practice with FIRST’s examples

Score one of 36 worked examples from FIRST’s CVSS v4.0 examples document with the metrics above, then compare your vector and score with FIRST’s, metric by metric. The summaries are this site’s; FIRST’s write-up of each example explains every metric.

Examples, vectors and scores: FIRST CVSS v4.0 Examples, Document Version 1.8. CVSS is owned by FIRST and used by permission.

What is checked

  • The 11 Base metrics, Exploit Maturity, the 14 Environmental metrics and the 6 Supplemental metrics of CVSS v4.0
  • Vector strings: the CVSS:4.0 prefix, every Base metric, the specified order, no repeats and valid values
  • The score, its qualitative severity (None, Low, Medium, High, Critical) and its nomenclature (CVSS-B, CVSS-BT, CVSS-BE or CVSS-BTE)
  • The MacroVector, the equivalence classes the score is interpolated from

Source specifications

Licence of the scoring data

Scoring data and method ported from the FIRST CVSS v4.0 reference calculator, copyright (c) 2023 FIRST.ORG, Inc., Red Hat, and contributors, under the BSD-2-Clause licence.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Guides and practice

All tools
Guide

Prioritize vulnerabilities by exploitation, exposure and impact

Rank vulnerabilities with CISA KEV, EPSS, CVSS 4.0 vectors and SSVC decision points, adjust for presence, reachability and asset value, and turn the result into due dates. Covers NVD's 2026 enrichment changes and CISA BOD 26-04.

Guide

Triage new dependency vulnerability findings

Turn a weekly batch of Dependabot, OSV-Scanner or npm audit findings into a short list of distinct, shipped, reachable issues, each routed to one outcome: fix, not affected, accept or escalate.

Guide

Use VEX without losing vulnerability evidence

Produce and consume precise vulnerability status statements tied to the product, version, justification and evidence.

Find your next answer

Type to search. Search runs in your browser.

Searches run in your browser, but the host can infer them from the index files they load. The address shows your search so you can bookmark or share it.