CVSS 3.1 Base Score Calculator

Set the eight base metrics and get the actual CVSS v3.1 base score back — computed from the official FIRST.org formula, not an approximation, and verified here against the reference vectors published in the spec. Pick the metrics that match the vulnerability, get the score and vector string, done.

What the eight metrics are actually asking

• Attack Vector — how close does an attacker need to be? Network is the worst case (exploitable from anywhere), Physical is the least severe (needs hands on the device).
• Attack Complexity — does exploitation work reliably every time (Low), or does it depend on conditions outside the attacker's control, like a race condition or specific configuration (High)?
• Privileges Required — does the attacker need to already have some level of access before they can exploit this?
• User Interaction — does a victim have to do something (click a link, open a file) for the exploit to work?
• Scope — this is the one people get wrong most often. It's not about severity, it's about whether the vulnerability lets an attacker impact resources beyond the vulnerable component's own security boundary — a container escape or a sandbox breakout, for instance, sets Scope to Changed. Most vulnerabilities don't, and default to Unchanged.
• Confidentiality / Integrity / Availability — the actual impact if successfully exploited: can data be read, changed, or is the system taken down?

Why Scope matters more than its position in the list suggests

Scope doesn't just add a data point — it changes which formula gets used entirely, and it can be the difference between a 9.8 and a clean 10.0 for what's otherwise an identical set of metrics. It's worth double-checking specifically, because it's the metric most likely to get set on autopilot to "Unchanged" without actually being considered.

What the score is, and what it deliberately isn't

This is the Base Score only — the intrinsic severity of the vulnerability itself, independent of whether it's actually being exploited in the wild, whether a patch exists, or how it applies to your specific environment. The full CVSS model also has Temporal and Environmental metric groups that adjust the base score for exactly those factors, and a lot of real-world prioritization decisions should weight those as much as the base score, not treat a 9.8 in isolation as an automatic drop-everything signal. A 9.8 with no known exploit and no internet-facing exposure in your environment is a different priority than a 7.5 that's actively being exploited against systems you actually run — the base score is the starting point for triage, not the whole answer.