CVSS calculator
Parse a CVSS 3.1 or 4.0 vector string and compute its base score and severity, on your device. 3.1 matches the published formula exactly; 4.0 approximates FIRST's severity table.
CVSS calculator takes one pasted vector string, either the 3.1 or 4.0 spec, and works out its severity band from FIRST's own metric definitions. Version 3.1 reproduces FIRST's published formula exactly, checked against its worked examples. Version 4.0 is this tool's own approximation of FIRST's MacroVector table, exact only at the single maximal-severity vector where both agree on 10.0.
Questions
What versions does it support?
CVSS 3.1 and 4.0, detected from the CVSS:3.1/ or CVSS:4.0/ prefix on the vector string.
How accurate is the 3.1 score?
Exact: it reproduces FIRST's own published closed-form formula and matches its worked examples.
How accurate is the 4.0 score?
It is a documented approximation of FIRST's MacroVector severity table, not a byte-exact reproduction of the published lookup table, correct only at the maximal-severity vector.
Why not implement 4.0 exactly?
FIRST's 4.0 score comes from a large empirically-derived lookup table that is not reproducible from the spec's prose alone, and this tool was built with no way to verify a transcription of it.
What happens with an unrecognised metric?
The tool refuses, naming the metric and its allowed values.
Does it show metrics not used in the score?
Yes, any extra metrics present in the vector but not part of the base score are listed separately.