CVSS Calculator
Answer eight questions, or paste a vector, and get the score out of 10 in plain English.
How a CVSS Score Is Worked Out
The base score combines two halves. Exploitability asks how easy the flaw is to attack: from where, how reliably, with what access, and whether a user has to help. Impact asks what an attacker gets: whether they can read data, change it or take the service down, and whether the damage can spread beyond the flawed software.
| Score | Severity | What we'd do |
|---|---|---|
| 9.0 – 10.0 | Critical | Patch now |
| 7.0 – 8.9 | High | Patch this week |
| 4.0 – 6.9 | Medium | Keep an eye; fix in normal updates |
| 0.1 – 3.9 | Low | Keep an eye |
One exception: if attackers are already using a flaw (it's on CISA's Known Exploited Vulnerabilities list), patch it now whatever its score.
FAQ
What is a CVSS score?
CVSS (the Common Vulnerability Scoring System) rates how severe a security flaw is from 0 to 10, based on how it can be attacked and what an attacker can do with it. It is published with most CVEs in the National Vulnerability Database.
What do the severity bands mean?
None is 0.0, Low is 0.1 to 3.9, Medium is 4.0 to 6.9, High is 7.0 to 8.9 and Critical is 9.0 to 10.0.
What is a CVSS vector string?
A short code such as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H that records each answer. Paste one into the box above to see its score and what it means.
Does a high score mean I'm at risk?
Not on its own. The score describes the flaw, not your setup. A 9.8 in software you don't run doesn't matter, and a 6.5 that attackers are actively using can matter more than a 9.0 nobody has exploited. That's why CVE Hawk puts exploited flaws first.
Which version of CVSS is this?
CVSS v3.1 base scores, which are still what most CVEs are published with. CVSS v4.0 is starting to appear; we'll add it here as it becomes common.