CVSS Calculator

Score a vulnerability in CVSS v3.1 or CVSS v4.0. Pick the metrics or paste a ready-made vector to fill the controls, and the score comes back with its severity band said in words.

This is generated in browser and is not sent to pah.moi servers.

The CVSS Calculator needs JavaScript to score in your browser. It is client-only. The same scoring, for either version, is available offline via the cvss-cli command-line tool, which auto-detects the version from a pasted vector.

About this tool3 paragraphs

Every applicable score is shown (Base, Temporal and Environmental for v3.1; CVSS-B, BT, BE and BTE for v4.0), each with its band and the vector string it came from, computed by the official formulas.

The verdict is stated on the most refined score the vector supports: Environmental refines Temporal refines Base, so the last one you set is the one an analyst acts on. cvss-cli prints the same sentence.

The assessment of actual risk for any of these elements is entirely separate from what a score might say.

Use it locally This tool has a native command line twin. Build cvss-cli from the site's source with:

cargo build --release --bin cvss-cli

Source and licence terms