What counts as a high CVSS score?

None is 0.0, Low is 0.1 to 3.9, Medium is 4.0 to 6.9, High is 7.0 to 8.9, and Critical is 9.0 to 10.0. A score of 9.0 or above almost always means an unauthenticated attacker can reach the vulnerability over a network and fully compromise whatever it touches.

What is the difference between base, temporal and environmental scores?

The base score describes the vulnerability itself and does not change, which is why it is the number that gets published. The temporal score adjusts it for whether exploit code is circulating and whether a patch shipped, and it can only go lower. The environmental score re-weights everything for one deployment, letting you record that availability barely matters on this asset, or that your build is only reachable internally.

Does a CVSS 9.8 mean I have to fix it today?

Not on its own. CVSS grades the vulnerability, not your exposure to it. A 9.8 in a dependency whose vulnerable function your code never calls can be less urgent than a 6.1 in the authentication path in front of your customer data. Use the base score to describe severity, and evidence that the thing is reachable to decide order.

Should I use CVSS v3.1 or CVSS v4.0?

Use whichever version the record you are matching uses. CVSS v4.0, published by FIRST in November 2023, splits impact into effects on the vulnerable system and on downstream systems, and replaces the temporal group with a threat group. There is no conversion between them, so a v3.1 score and a v4.0 score for the same vulnerability are not comparable. This calculator implements v3.1, which is what existing advisories and scanner output overwhelmingly carry.

What changed between CVSS v3.0 and v3.1?

No metrics or weights changed, so a v3.0 vector scores the same under v3.1 in almost every case. The revision rewrote several definitions for clarity, particularly Scope and Privileges Required, and replaced the rounding function: v3.0 rounded up in floating point, which occasionally pushed a score a tenth too high, while v3.1 defines its Roundup on integers. This calculator uses v3.1 rounding and accepts vectors labelled either version.

Will this give the same score as NVD, and is my input sent anywhere?

The formulas are the ones in the CVSS v3.1 specification, checked against the published scores for real CVEs including Log4Shell, Spring4Shell and Heartbleed, so pasting a vector from an NVD record gives the number on that record. Nothing you enter leaves your machine: the page is static, the scoring runs in your browser, and your selections go into the URL fragment after the # symbol, which browsers never send to a server.

Parameter Platform

A red team that never stops.

/ pentesting

Real vulnerabilities, found and proven.

/ Cloud security

Cloud misconfigs, caught continuously.

/ Supply chain

Only the reachable dependency risks.

/ sentinel

Vulnerabilities caught before they merge.

/ Blog

Research, writeups, and product news.

/ Tools

Free tools, starting with a CVSS calculator.

/ Security

How we secure the agents and your data.

/ Pricing

What a continuous pentest costs.

/ About

The team behind Parameter.

/ Careers

Open roles. Come build with us.

Blog

Book a call

CVSS v3.1 score calculator

CVSS is the standard way to rate how severe a software vulnerability is, from 0.0 to 10.0. Score one below, or paste a vector string to check someone else's number.

[ Score ]

—IncompleteBase score

0 of 8 base metrics chosen.

0.010.0

[ Vector string ]

Editable. Paste a vector to load it.

1 / 8

Attack Vector

How does an attacker reach the vulnerable component?

type a key to answer

[ The math ]

How the score is built

Your eight answers feed three ingredients. Two get measured, one decides how they combine.

01Exploitability: How hard the bug is to reach. Your answers to Attack Vector, Attack Complexity, Privileges Required and User Interaction. Reachable from the internet, no account, no clicks: maximum.
02Impact: What the attacker gets. Read data (Confidentiality), change data (Integrity), take the service down (Availability). All three None means the score is 0.0, no matter how easy the bug is to trigger.
03Scope: How the two combine. Damage contained in the component: they are added. Damage escapes it (a sandbox escape, a VM reaching its host): heavier weights and a 1.08 multiplier. Flipping this one answer moves a score more than any other.

The result is capped at 10.0 and always rounded up to one decimal, so 4.02 publishes as 4.1, never 4.0.

[ Notation ]

How to read a vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS:3.1: Version
AV:N: Attack Vector: Network
AC:L: Attack Complexity: Low
PR:N: Privileges Required: None
UI:N: User Interaction: None
S:U: Scope: Unchanged
C:H: Confidentiality: High
I:H: Integrity: High
A:H: Availability: High

Temporal and environmental metrics follow the eight base ones, and are left out when they have no value.

[ Ratings ]

CVSS severity rating scale

None: 0.0
Low: 0.1 – 3.9
Medium: 4.0 – 6.9
High: 7.0 – 8.9
Critical: 9.0 – 10.0

[ Reference ]

CVSS v3.1 base metrics

Attack Vector

AVHow far away the attacker can be.

AV:N: Network. Exploitable over the internet, from another network entirely.
AV:A: Adjacent. Attacker must share the network: same subnet, VPN segment, or Bluetooth range.
AV:L: Local. Needs a local shell, or a user to open a malicious file.
AV:P: Physical. Attacker must physically touch the device.

Attack Complexity

ACWhat has to line up beyond the attacker's control.

AC:L: Low. Works every time, against every affected target.
AC:H: High. Needs a race won, a secret guessed, or per-target preparation.

Privileges Required

PRWhat access the attacker needs first.

PR:N: None. Unauthenticated.
PR:L: Low. An ordinary user account, reaching that user's own resources.
PR:H: High. Admin or equivalent control over the component.

User Interaction

UIWhether someone else has to help.

UI:N: None. Nobody but the attacker has to do anything.
UI:R: Required. Someone must click, open, or accept something first.

Scope

SWhether the damage escapes the vulnerable component.

S:U: Unchanged. Damage stays inside the component's own security authority.
S:C: Changed. Damage escapes it. Sandbox escapes, guest VM reaching its host, SSRF into an internal network.

Confidentiality

CHow much the attacker gets to read.

C:H: High. Reads everything, or reads something serious like private keys.
C:L: Low. Some data leaks, but the attacker cannot choose what.
C:N: None. Nothing leaks.

Integrity

IHow much the attacker gets to change.

I:H: High. Changes anything, or changes one thing that matters badly.
I:L: Low. Some data changes, but the attacker cannot choose what.
I:N: None. Nothing changes.

Availability

AHow much service the attacker takes away.

A:H: High. Service goes down, and can be kept down at will.
A:L: Low. Degraded or intermittent. Never fully denied.
A:N: None. Service is unaffected.

[ Reference ]

Temporal metrics

Exploit Code Maturity

EHow ready to use the exploit is.

E:X: Not Defined. Left out of the score. Scored as High.
E:H: High. Reliable autonomous exploit code, or no exploit needed.
E:F: Functional. Working exploit code exists.
E:P: Proof-of-Concept. A demo exists, impractical for real attacks.
E:U: Unproven. No exploit code, or theoretical only.

Remediation Level

RLHow official and permanent the fix is.

RL:X: Not Defined. Left out of the score. Scored as Unavailable.
RL:U: Unavailable. No fix exists.
RL:W: Workaround. Unofficial mitigation only: a community patch or a WAF rule.
RL:T: Temporary Fix. Vendor hotfix or workaround, but not the patch.
RL:O: Official Fix. Full vendor patch available.

Report Confidence

RCHow sure anyone is that this is real.

RC:X: Not Defined. Left out of the score. Scored as Confirmed.
RC:C: Confirmed. Reproduced in detail, or acknowledged by the vendor.
RC:R: Reasonable. Published in detail, but the root cause is unconfirmed.
RC:U: Unknown. Reports conflict and the cause is unknown.

[ Reference ]

Environmental metrics

Confidentiality Requirement

CRHow much confidentiality matters on this asset.

CR:X: Not Defined. Left out of the score. Scored as Medium, leaving the score unchanged.
CR:H: High. Losing confidentiality here would be catastrophic.
CR:M: Medium. Losing confidentiality here would be serious.
CR:L: Low. Losing confidentiality here would barely matter.

Integrity Requirement

IRHow much integrity matters on this asset.

IR:X: Not Defined. Left out of the score. Scored as Medium, leaving the score unchanged.
IR:H: High. Losing integrity here would be catastrophic.
IR:M: Medium. Losing integrity here would be serious.
IR:L: Low. Losing integrity here would barely matter.

Availability Requirement

ARHow much availability matters on this asset.

AR:X: Not Defined. Left out of the score. Scored as Medium, leaving the score unchanged.
AR:H: High. Losing availability here would be catastrophic.
AR:M: Medium. Losing availability here would be serious.
AR:L: Low. Losing availability here would barely matter.

MAV, MAC, MPR, MUI, MS, MC, MI, MA each override the base metric of the same name, take the same values, and add Not Defined, which falls back to the base value. Use them to record that a finding NVD scored as Network is only reachable from your management VLAN.

[ What the score can't tell you ]

A CVSS score is severity, not risk

CVSS grades a vulnerability in the abstract. It cannot know whether your code ever calls the vulnerable function, whether the host answers from the internet, or what the data behind it is worth. So a 9.8 in a dependency you never reach can matter less than a 6.1 in your login flow, and a patch queue sorted by base score spends its first week on the wrong findings.

Parameter's agents settle what the score leaves open: they try the exploit. Every finding arrives with the request that triggered it and the response that proves it worked.

Book a call

See how the agents prove a finding