Provetry
FRDEGet early access
Free check
Get early access

Provetry opens in November 2026. The free CRA check, the tools and the guides are available now.

Free tool

CVSS 4.0 calculator

Pick the eleven base metrics of a vulnerability, or paste a CVSS 4.0 vector, to get its score and severity. The score is computed with the reference scoring published by FIRST.

Runs entirely in your browser: nothing you type or open is sent to us or stored.

Exploitability

Attack vector (AV)
Attack complexity (AC)
Attack requirements (AT)
Privileges required (PR)
User interaction (UI)

Vulnerable system

Confidentiality (VC)
Integrity (VI)
Availability (VA)

Subsequent systems

Confidentiality (SC)
Integrity (SI)
Availability (SA)

Score CVSS-B

9.3

Critical

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Scoring: the reference calculator of FIRST and Red Hat (BSD licence).

CVSS 4.0, CVSS 3.1 and the Cyber Resilience Act

CVSS 4.0, published by FIRST in November 2023, splits the impact between the vulnerable system and the systems that follow it, adds attack requirements and two levels of user interaction, and names its scores by the metrics they use (CVSS-B for the base metrics alone, CVSS-BT with threat metrics, CVSS-BE or CVSS-BTE with environmental ones). Its scores are not directly comparable with CVSS 3.1 scores.

Whatever the version, the CVSS score measures how severe a vulnerability is, not whether it is exploited. The reporting clock of the CRA starts when you become aware that a vulnerability in your product is actively exploited, whatever its score.

The CVSS 3.1 calculator →

The reporting clock, explained →

Other free tools

  • security.txt generator and checker

    Write the RFC 9116 file that tells researchers where to report a vulnerability, or check the one you have.

  • CVSS 3.1 calculator

    Score a vulnerability from its eight base metrics, or paste a vector to read it.

  • EPSS score lookup

    How likely a vulnerability is to be exploited in the next 30 days: today’s score from FIRST, for up to 30 CVEs at once.

  • Vulnerability disclosure policy generator

    A coordinated vulnerability disclosure policy for your products, ready to publish, in English, French or German.

  • SBOM generator

    Turn your lock files into a CycloneDX or SPDX SBOM: npm, pnpm, Yarn, Python, Go, Rust, Java, .NET, PHP and Ruby.

  • SBOM viewer and checker

    Open a CycloneDX or SPDX file: its components, and what the CRA expects that is missing.