CVSS Calculator
A CVE, advisory or vector in; scores, EPSS, KEV and a patch priority out.
Background readingCVSS explainedEPSSCVSS vs EPSS
How the calculator works
CVSS 3.x uses FIRST's equations. CVSS 4.0 runs FIRST's reference code, unmodified.
CVE records come from the CVE Program with CISA Vulnrichment; EPSS from FIRST. A published score its own vector does not produce is flagged.
The priority rule
| Priority | Patch within | When |
|---|---|---|
| Act now | 48 hours | Exploited in the wild and reachable from the internet, or exploited on a crown-jewel system. |
| Next window | 7 days | Exploited anywhere else, or EPSS of 10% or more, or a score of 9.0 or more on an internet-facing system. |
| Scheduled | 30 days | A score of 7.0 or more, or EPSS of 1% or more. |
| Routine | 90 days | Everything else. Isolated or low-value systems drop one level, never below routine. |
pwnsy's rule of thumb. Your own policy comes first.
CVSS calculator FAQ
What is the difference between CVSS 3.1 and CVSS 4.0?
4.0 splits impact into vulnerable and subsequent systems, adds Attack Requirements and Exploit Maturity, and scores by lookup. Scores are labelled CVSS-B, CVSS-BT or CVSS-BTE by the groups used.
Why does the published score not match the vector?
Either the CNA typed a wrong score, or (in 4.0) the vector carries Exploit Maturity while the number is base-only CVSS-B. Both are shown and the gap is flagged.
Should I patch by CVSS score?
Use it with exploitation data. CVSS is severity; EPSS is the 30-day exploitation chance; KEV lists CVEs already exploited. The priority here starts from exploitation and exposure.
Where does the CVE data come from?
The CVE Program API (with CISA Vulnrichment for SSVC, KEV and fallback vectors) and FIRST's EPSS API, fetched by your browser.
CVSS 4.0 scoring by FIRST's reference calculator (BSD-2-Clause). CVE records from the CVE Program, EPSS from FIRST, KEV and SSVC from CISA Vulnrichment.