CVSS Calculator by {metæffekt}

Enter multiple CVSS vectors into the text field below. The format does not matter, as long as each vector is separated by at least one space character. If possible, the system will try to assign fitting names to the vectors.

If you've added all your vectors, click a name to edit it!

The "Universal CVSS Calculator" by {metæffekt} is licensed under the Apache License, Version 2.0 (the "License"). A copy of the License is available at http://www.apache.org/licenses/LICENSE-2.0.

Portions of this project incorporate third-party software and services:

NIST NVD
This product uses data from the NVD API but is not endorsed or certified by the NVD. https://nvd.nist.gov/developers/start-here.

CVSS by FIRST
CVSS is owned by FIRST and used by permission. CVSS is free for use by anyone. https://www.first.org/cvss/specification-document.

Chart.js
Chart.js License

The MIT License (MIT)

Copyright (c) 2014-2022 Chart.js Contributors

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.

Bootstrap
Bootstrap License

The MIT License (MIT)

Copyright (c) 2011-2023 The Bootstrap Authors

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.

Bootstrap Icons
Bootstrap Icons License

The MIT License (MIT)

Copyright (c) 2019-2024 The Bootstrap Authors

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.

pako
pako MIT License

(The MIT License)

Copyright (C) 2014-2017 by Vitaly Puzrin and Andrei Tuputcyn

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.

Portions of the Pako library, specifically the contents of the /lib/zlib folder, are based on the zlib C sources and are licensed under the Zlib License.

Acknowledgments:

  The deflate format used by zlib was defined by Phil Katz.  The deflate and
  zlib specifications were written by L.  Peter Deutsch.  Thanks to all the
  people who reported problems and suggested various improvements in zlib; they
  are too numerous to cite here.

Copyright notice:

 (C) 1995-2013 Jean-loup Gailly and Mark Adler

Copyright (c) <''year''> <''copyright holders''>

This software is provided 'as-is', without any express or implied
warranty. In no event will the authors be held liable for any damages
arising from the use of this software.

Permission is granted to anyone to use this software for any purpose,
including commercial applications, and to alter it and redistribute it
freely, subject to the following restrictions:

1. The origin of this software must not be misrepresented; you must not
   claim that you wrote the original software. If you use this software
   in a product, an acknowledgment in the product documentation would be
   appreciated but is not required.
2. Altered source versions must be plainly marked as such, and must not be
   misrepresented as being the original software.
3. This notice may not be removed or altered from any source distribution.


  Jean-loup Gailly        Mark Adler
  jloup@gzip.org          madler@alumni.caltech.edu

Copyright:
(C) 1995-2013 Jean-loup Gailly and Mark Adler
(C) 2014-2017 Vitaly Puzrin and Andrey Tupitsin

Creating new CVSS vectors

Using the buttons and input field at the top, you can:

Click on the first button that says CVSS to import multiple vectors at once.
Click on of the buttons next to it to add a vector of that CVSS version.
Input a CVSS vector of any version in the input field and press enter.
Input a CVE-ID and press enter to fetch the vectors of this CVE from the NVD.

Editing CVSS vectors

Click on a vector in the list to select it. A small arrow will appear to the left of the selected vector. CVSS list

You can directly edit the vector in the above text field, but below, you'll find a series of accordion elements, each representing a different segment of the CVSS vector, which allow for more convenient editing. Closed editing accordion

Expand an accordion section by clicking its header to view and modify the individual components of that vector segment. Opened editing accordion

Interpreting the results

The table below the vector list shows the available calculated scores for each CVSS vector. Score table

Certain CVSS versions do not normalize all their scores to a 0-10 scale before displaying them. For example, the Exploitability Score of CVSS:3.1 only has a version range of 0-6.1, which can confuse users. To make the scores more comparable, the calculator will display a scaled score alongside the original score, which looks as follows: 3.4 → 5.7

The radar chart on the right visualizes these scores. Vectors can be excluded from this chart using the eye icon in the vector list. A thicker and dotted line means that the vector is currently selected. The selected vector will also be displayed below the radar chart. Severity radar (Combined)

Toggle the switch at the top of the radar chart to split it into multiple charts for each CVSS version, improving readability when many vectors are present. Severity radar (Combined)

CVSS:4.0

CVSS:4.0 differs from previous versions in several ways:

Only a Base Score is provided, which is used on every axis of the radar chart.
During calculation, a MacroVector is calculated from the vector, which is a representation of the vector with a reduced amount of dimensions. This MacroVector is displayed below the radar chart if a CVSS:4.0 vector is selected.
The supplemental metrics are purely informational and do not affect the calculated score.

Further notes

More can be read about the CVSS standard at:

Version 1.0.15 2024-02-26

Issue #5: Made NVD CVE API requests more consistent by using XMLHttpRequests.
Vector name input fields widths will now more accurately be set to the actual content widths across the application.

Version 1.0.14 2024-02-23

Issue #1: Added support for CVSS:3.0.
Issue #3: Added support for exporting and importing CVSS vectors as JSON files according to the CVSS Data Representations specification.
Adjusted metric descriptions of CVSS:3.0 to match specification.

Version 1.0.13 2024-02-02

Holding down shift or the command/meta key will reveal buttons with secondary actions by displaying alternative content.
Added option to apply all environmental metrics back onto the base vector by holding shift and clicking the eye icon.
Added text descriptions for all CVSS:4.0 metric values.
For future versions, the JavaScript will check if the version in the HTML does not match the actual application version and tell the user to reload the page.

Version 1.0.12 2024-01-29

Radar chart element will no longer flash on application load if no vectors are defined.
Added banner warning for disabled JS.

Version 1.0.11 2024-01-26

Interpolation of undefined environmental/temporal scores in the radar chart will now use base scores rather than being an interpolated value between neighboring scores.
Changed the color randomization algorithm for the radar chart to make them independent of the vector names and rather use a unique color per vector instance.
Improved performance by caching calculated score values within one change iteration.

Version 1.0.10 2024-01-25

Added ability to drag and drop CVSS vector list elements to rearrange them.
Adjusted button popover text for creating vectors.

Version 1.0.9 2024-01-24

Changed user guide icons to question marks .
Adjusted height and position of footer elements to appear vertically centered and to be more useful.
Fixed Attack Vector (AV) user guide answer to be listed under the incorrect response.
Vector names will now be displayed in cursive if: there is a CVE name in the name field AND the official NVD vectors could be fetched for that CVE AND the relevant fetched vector is different from the current vector.
Right-clicking the name will reset the vector to the official fetched one.
The NVD fetching indicator will now properly handle multiple vectors being fetched from different sources.
Adding new vectors will now append empty vectors unless shift-key is held, in which case the old behaviour with randomized vectors is applied.
Added buttons for cloning vectors .

Version 1.0.8 2024-01-23

Undefined metrics buttons are displayed more narrow to discourage setting base metrics to these values and to save space for the actual components.
Setting base metrics to ND or X will highlight them in red to make it clearer that these values are not valid as base metrics.
A vector can be reset to be undefined by shift-clicking the remove vector button.
The CVSS:4.0 nomenclature will now be displayed in the macro vector explanation card.
Added a user guide for the base components for vector versions 3.1 and 4.0. based on their respective specification documents.

Version 1.0.7 2024-01-22

Component names can now be clicked to copy them to clipboard.
Added a vector copy button to copy the vector string. By holding any modifier key while clicking it, only components will be copied that have been modified since the vectors have been added to the page (e.g. when opened via link or vectors have been pasted into the list).

Version 1.0.6 2024-01-19

Scrollbars on details table will now be hidden on larger devices.
"Usage Guide" and "Project on GitHub" links on initial page layout will now be displayed elsewhere (inside other text and in footer).

Version 1.0.5 2024-01-17

Added support for a b64gzip parameter that accepts a gzip compressed and base64 encoded string that it will decode and extract URL parameters from, replacing all existing URL parameters that are present in the encoded string.
Using this is usually not worth it if only one vector is passed, but with three or more vectors, a significant reduction of more than 40-50% can be achieved.
Added a button to clear all vectors to the vector list.
Added a link to the publicly available GitHub repository, where the implementation of the CVSS standard used in this calculator and the source code of this page can be found.
Improved detection of CVSS names for vectors copied from a Vulnerability Assessment Dashboard.

Version 1.0.4 2024-01-16

Added a limit of 25 vectors to the vector list.
Improved mobile experience by adding more screen size checks and adding overflow scrolling behaviours.

Version 1.0.3 2024-01-15

Vector input fields have been reworked:
- Added a multi-CVSS input modal where multiple vectors can be pasted to bulk import them.
- The CVSS and CVE input fields have been merged, they will now decide automatically what the input type is and act accordingly.
Added button to copy all active vectors into the clipboard.
Added button to copy current vector configuration as link into the clipboard.

Version 1.0.2 2024-01-12

Improved URL parameter interpretation code, preventing invalid vectors from causing unexpected behavior after loading the vectors from a URL.
Fixed CVSS:2.0 improperly using negative values for the impact score, especially regarding the radar chart.
Component button labels will now adapt to available space and potentially use abbreviations or only use the short name if not enough space is available.
Added a cve URL parameter that allows for loading CVSS from NVD when opening the page.

Version 1.0.1 2024-01-11

Scores are now visible in the vector list and added warnings for invalid vectors.
Added additional explanatory popovers.
Introduced a text field for adding custom vectors without the need for buttons.
The selected vector is now highlighted in the radar chart.
Adjusted vertically centered button alignment.
Standardized color coding for vector versions across the application.
Updated input placeholders to a lighter shade of gray to minimize user confusion.
New CVSS vectors will now use random base component values instead of average ones.
Set the base category accordions to expand by default.
Updated the CVE input field to more reliably detect even malformed CVE inputs.
Added a 'CVSS:' prefix to new vector names on desktop views when appending a new CVSS vector.
Increased the thickness of the selected vector entry for better visibility.
Added the CVE descriptions below the severity radar charts for vectors sourced from the NVD.

Version 1.0.0 2024-01-10

Initial release

Universal CVSS Calculator by {metæffekt}