NIST tools

CVSS vector viewer

Parse CVSS 3.1 and 4.0 vector strings, view base scores and severity, explore each metric, and export the scorecard as text or an image.

← Home ← All tools

Vector

CVSS vector string

Paste your CVSS vector string

Quick examples

Enter a CVSS vector string above to see the scorecard.

Understanding CVSS Metrics

CVSS 3.1: Common Vulnerability Scoring System version 3.1, used to assess vulnerability severity with metrics for attack vector, complexity, privileges, user interaction, scope, and impacts.

CVSS 4.0: The latest version with enhanced metrics including attack requirements, vulnerability impacts (VC/VI/VA), and subscore impacts (SC/SI/SA) for more granular assessment.

Vector string: A standardized format that encodes all base metrics required to calculate the CVSS score. Format: CVSS:VERSION/METRIC:VALUE/METRIC:VALUE/...

Enter a CVSS vector string above to see an interactive tutorial explaining each metric.

How scores are used

None (0.0):No exploitability, no impact; safely ignored.

Low (0.1–3.9):Little real-world risk. Patch on routine schedule.

Medium (4.0–6.9):Moderate risk. Evaluate business impact, address within normal cycle.

High (7.0–8.9):Significant risk. Prioritize for remediation, consider immediate mitigations.

Critical (9.0–10.0):Highest risk. Must remediate urgently to prevent likely compromise.

CVSS scores help organizations triage vulnerabilities and focus resources on the most significant threats.

Learn more

The Common Vulnerability Scoring System (CVSS) provides a way to capture the principal characteristics of a vulnerability and produce a numerical score reflecting its severity. The vector string contains all the information needed to calculate the base score, which ranges from 0.0 to 10.0.

For official CVSS specifications and detailed scoring formulas, visit: first.org/cvss