Base
The intrinsic qualities of the flaw: where it can be attacked from, what the attacker has to get past, the privileges and user interaction it needs, and the damage it does to the vulnerable system and to systems beyond it.
Security Tools
Free tools for security teams. No account, no email wall, no API key.
What the calculator scores
CVSS v4.0 splits a vulnerability into four metric groups. The calculator exposes all of them and recomputes the score as you change a value.
Threat
How real the exploit is today: not proven, proof of concept, or actively attacked. The same flaw scores higher once someone is exploiting it, and this group is where that shows up.
Environmental
What the flaw means in your deployment: modified base metrics, security requirements, and whether the vulnerable component sits in the critical path of your product.
Supplemental
Context that does not move the score: safety impact, automatable, recovery, value density, response effort and provider urgency. It helps order two findings that land on the same number.
Keep the vector string
A CVSS v4.0 vector records every choice behind the score in one line, for example CVSS:4.0/AV:N/AC:L/... Paste it into a ticket, an advisory or a customer report and anyone can replay the assessment in another calculator. Two analysts who disagree on the number can compare vectors instead of arguing about severity.
What the score does not tell you
CVSS measures severity, not risk. It says nothing about whether the flaw is reachable from your code path, whether the data behind it matters, or whether an exploit exists for the version you run. A 9.8 on an endpoint nobody can reach is noise; a 6.5 on your login flow is not. Use the score as one input, next to reachability and business context.
Remediation guidance is mapped from the metrics you select, not generated from your codebase. For fixes matched to your stack, you still need an assessment.
Embed it
The calculator is free to embed in your own docs or site, with no API key. Attribution is the only condition.