Free tool
CVSS 3.1 calculator
Pick the eight base metrics of a vulnerability, or paste a vector string, to get its CVSS 3.1 base score and severity.
Runs entirely in your browser: nothing you type or open is sent to us or stored.
Base score
9.8
Critical- Impact
- Exploitability
Vector
CVSS and the Cyber Resilience Act
The CVSS score measures how severe a vulnerability is in itself, not whether it is being exploited. The CRA reporting clock (24 hours, 72 hours, 14 days) starts when you become aware that a vulnerability in your product is actively exploited, whatever its score: a medium score that is exploited must be reported, a critical one that is not does not.
To decide what to fix first, combine three signals: the CVSS score (how bad), the EPSS score (how likely to be exploited in the next 30 days) and the catalogues of exploited vulnerabilities, CISA KEV and the EU Vulnerability Database (exploited now). Provetry shows the three together for every component of your products.
CVSS 4.0 is the newer version of the standard; the scores of the two versions are not directly comparable.
Other free tools
- security.txt generator and checker
Write the RFC 9116 file that tells researchers where to report a vulnerability, or check the one you have.
- CVSS 4.0 calculator
The newer version of CVSS, scored with FIRST’s reference calculation: base metrics, or any vector pasted.
- EPSS score lookup
How likely a vulnerability is to be exploited in the next 30 days: today’s score from FIRST, for up to 30 CVEs at once.
- Vulnerability disclosure policy generator
A coordinated vulnerability disclosure policy for your products, ready to publish, in English, French or German.
- SBOM generator
Turn your lock files into a CycloneDX or SPDX SBOM: npm, pnpm, Yarn, Python, Go, Rust, Java, .NET, PHP and Ruby.
- SBOM viewer and checker
Open a CycloneDX or SPDX file: its components, and what the CRA expects that is missing.