CVSS vector decoder
Paste a CVSS v3.1 or v3.0 vector and get the score computed and mapped to a severity, with every metric spelled out. Local and offline; nothing is sent anywhere.
Security & WAFThe vector is scored in your browser. Nothing is uploaded.
The score is computed entirely in your browser from the vector you paste. The math is implemented directly from the FIRST.org CVSS v3.1 specification: the Impact and Exploitability sub-scores, the Base score, and, when those metrics are present, the Temporal and Environmental scores, using the specification's floating-point-safe Roundup. It looks nothing up and fetches nothing. The implementation is validated against officially published reference scores, so a canonical unauthenticated remote code execution scores 9.8, a scope change pushes it to 10.0, and a reflected cross-site scripting vector scores 6.1.
- FIRST.org: CVSS v3.1 Specification DocumentMetric definitions and weights, the Section 7 scoring formulas, and the Appendix A Roundup
- FIRST.org: CVSS v3.1 CalculatorThe reference calculator the scores are checked against
- NVD: CVSS v3.1 EquationsThe base and environmental equations as published by NVD