CVSS Calculator

Score a vulnerability in CVSS v3.1 or CVSS v4.0. Pick the metrics or paste a ready-made vector to fill the controls, and the score comes back with its severity band said in words.

This is generated in browser and is not sent to pah.moi servers.

The CVSS Calculator needs JavaScript to score in your browser. It is client-only. The same scoring, for either version, is available offline via the cvss-cli command-line tool, which auto-detects the version from a pasted vector.

About this tool3 paragraphs

Every applicable score is shown (Base, Temporal and Environmental for v3.1; CVSS-B, BT, BE and BTE for v4.0), each with its band and the vector string it came from, computed by the official formulas.

The verdict uses the most specific score you have set. Environmental overrides Temporal, and Temporal overrides Base. cvss-cli prints the same sentence.

A score is not a judgement of your actual risk. Deciding that is a separate job.

Use it locally This tool has a native command line twin. Build cvss-cli from the site's source with:

cargo build --release --bin cvss-cli

Source and licence terms