MSRXTools / Vulnerabilities
CVSS 4.0 and 3.1 calculator
Score a vulnerability with CVSS 4.0 or 3.1, explained in plain words, or paste a vector to see what it means.
Runs in your browser
Loading tool…
Good to know
- CVSS measures severity, not risk. A critical bug on a system that is not exposed can wait behind a medium one that is.
- CVSS 4.0 splits impact into the vulnerable system and the systems beyond it, and adds Attack Requirements; most new advisories publish both 4.0 and 3.1 vectors.
- Share the vector, not just the number: two 7.5s can be very different problems.
Related tools
Exploited vulnerabilities, last 365 days
Every vulnerability CISA confirmed as exploited in the wild in the past year, live: php2shell, React2Shell, WordPress, SharePoint, Citrix, Fortinet and more. Search and filter.Dependency vulnerability scanner
Drop in a lockfile (npm, yarn, pnpm, pip, Poetry, uv, Go, Cargo, Ruby, Composer, Maven, NuGet) and see every package with a known vulnerability, what is being exploited, and the version that fixes it.CVE lookup
Everything about one CVE on one page: description, CVSS scores, exploitation in the wild (CISA KEV), EPSS probability, affected products and fixed package versions. Or search a product for its newest CVEs.Website vulnerability scanner
Paste a URL. Get a SWOT security report scored out of 10: HTTPS, TLS, headers, cookies, content, DNS and email, with fixes.
Every vulnerability CISA confirmed as exploited in the wild in the past year, live: php2shell, React2Shell, WordPress, SharePoint, Citrix, Fortinet and more. Search and filter.Dependency vulnerability scanner
Drop in a lockfile (npm, yarn, pnpm, pip, Poetry, uv, Go, Cargo, Ruby, Composer, Maven, NuGet) and see every package with a known vulnerability, what is being exploited, and the version that fixes it.CVE lookup
Everything about one CVE on one page: description, CVSS scores, exploitation in the wild (CISA KEV), EPSS probability, affected products and fixed package versions. Or search a product for its newest CVEs.Website vulnerability scanner
Paste a URL. Get a SWOT security report scored out of 10: HTTPS, TLS, headers, cookies, content, DNS and email, with fixes.