CVSS Calculator

It is the severity of a vulnerability considered on its own, from 0.0 to 10.0, derived from eight metrics describing how it is reached and what it damages. Base scores deliberately exclude your environment — the same flaw scores identically whether the affected service is internet-facing or switched off.

Because 10.0 additionally requires Scope: Changed. Reaching the ceiling means the impact escapes the vulnerable component into others — a container escape or hypervisor break — and it is the 1.08 multiplier on changed scope that pushes the score over 9.8. This is the most commonly misremembered part of the formula.

Whether the damage stays inside the thing that was vulnerable. If a bug in a web application lets an attacker read that application's data, scope is Unchanged. If it lets them break out of the container onto the host, or out of a sandbox into the browser, scope is Changed — a different security authority has been compromised, and the score rises sharply to reflect it.

The specification defines an explicit "Roundup" function that always rounds up to one decimal place, so 9.71 becomes 9.8 and never 9.7. It exists so every implementation produces byte-identical scores; a calculator using ordinary rounding disagrees with NVD on many vectors.

Not on its own. A base score of 9.8 on a service with no network route to it is less urgent than a 7.5 on your public login. That is what the Temporal and Environmental metrics are for, and why CertNotify weights findings by whether the asset is actually reachable rather than ranking by severity alone.

v4.0, published in 2023, splits the impact metrics into vulnerable-system and subsequent-system sets, adds Attack Requirements and safety metrics, and drops the old single Scope metric. Adoption is still partial — NVD and most vendor advisories publish v3.1 — which is why this calculator implements v3.1.

No. CVSS measures characteristics of a vulnerability, not activity against you, and not whether working exploit code exists. For that, look at CISA's Known Exploited Vulnerabilities catalogue and exploit-prediction scoring, which answer a different and often more urgent question.

No. The formula is a few lines of arithmetic and runs in this tab. The same implementation is checked against the copy used by our dependency scanner across all 5,184 metric combinations, so the number here is the number our scanner reports.