CVSS 4.0 Calculator

Score a vulnerability with the full CVSS 4.0 metric set - Base, Threat, Environmental and Supplemental - with the vector string and plain-language meaning of every choice.

Runs locally

Everything happens in your browser. What you paste or drop here is never uploaded, logged or stored.

Vector string

Paste a vector to load it, or pick values below. The two stay in sync.

What changed from CVSS 3.1

CVSS 4.0 is not a re-weighting of 3.1. Scope is gone, replaced by separate impact metrics for the vulnerable system (VC, VI, VA) and for subsequent systems (SC, SI, SA). A new base metric, Attack Requirements (AT), captures conditions such as a race window that 3.1 folded into complexity. User Interaction now distinguishes passive from active. A 3.1 vector cannot be converted to 4.0 mechanically; the vulnerability has to be re-assessed, and this calculator refuses 3.1 input rather than guessing.

The score is FIRST's, not ours

CVSS 4.0 does not have a formula you can type in. Every vector falls into one of 270 MacroVectors whose scores were set by expert comparison, and the final score is interpolated within that MacroVector. This page runs FIRST's own reference scoring code and lookup table, unchanged, in your browser. A calculator that re-implements the table risks a transcription error that nobody notices until two tools disagree about the same CVE.

The scores are also checked against a second, independent implementation. Our test suite runs more than 5,600 vectors from the Python cvss library's own tests through this page's scoring, and every one must match. That check caught a real defect: an older release of the reference code rounded values such as 5.65 down to 5.6 because of floating-point error. The current release rounds half up, as the specification requires, and that is the version used here.

Always publish the nomenclature

The specification asks for the score to be labelled by which metric groups were used: CVSS-B for base only, CVSS-BT with threat, CVSS-BE with environmental, and CVSS-BTE with both. A base score assumes the worst about exploitation and about your environment. Reporting a CVSS-B 9.3 as if it described your risk is the most common misuse of CVSS, and the label is what stops it.

Unset threat and environmental values are not neutral

When Exploit Maturity is left as Not Defined, the score assumes Attacked - the worst case. The same goes for the security requirements, which default to High. Setting E to Unreported when there is no known exploitation or proof of concept is how a base score turns into a realistic one.

Supplemental metrics describe, they do not score

Safety, Automatable, Recovery, Value Density, Response Effort and Provider Urgency carry useful context and are kept in the vector, but none of them changes the number. That is by design.

Frequently asked questions

Why does my score differ from the NVD's?

Usually because one of you scored threat or environmental metrics and the other did not. Compare the nomenclature before comparing the number. If both are CVSS-B and the vectors match, the scores will match - they come from the same table.

Is a higher score always more urgent?

No. CVSS measures severity, not risk. Exploitation evidence (EPSS, the CISA KEV list) and exposure in your environment often matter more for deciding what to patch first.

What does Safety (S) under Modified Subsequent Integrity mean?

MSI:S and MSA:S mark impact that could cause physical harm. They are the only environmental values that raise a vulnerability into the highest subsequent-system band.

Is anything sent to a server?

No. Parsing and scoring run in the page. The vector can be shared through the page address, which you control.

References

Related tools

What this tool can and cannot tell you. It reports what is present in the input you provide. It cannot see anything you did not give it, and a clean result means nothing was found in that input - not that the wider system is secure.

Security guidance here follows current published sources - OWASP, MDN, the relevant RFCs, NIST, CISA, FIRST and MITRE - which are linked beside the specific claims they support.