CVSS v4.0 & v3.1 Vulnerability Severity Score & Vector Calculator (2026)

CVSS v4.0 eliminates the confusing single 'Scope (Unchanged/Changed)' toggle and replaces it with distinct Impact metrics for the Vulnerable System (VC/VI/VA) and Subsequent Systems (SC/SI/SA). It also splits Attack Complexity into Attack Complexity (AC) and Attack Requirements (AT), replaces User Interaction's binary None/Required with None/Passive/Active, and renames Temporal metrics to Threat metrics.

Attack Requirements (AT) captures deployment or execution prerequisites of the vulnerable component—such as winning a race condition, bypassing ASLR on a non-deterministic heap, or requiring an active Man-in-the-Middle position—separating those preconditions from the attacker's own engineering effort (Attack Complexity).

Both CVSS v3.1 and v4.0 map numeric scores to five qualitative severity bands: None (0.0), Low (0.1 – 3.9), Medium (4.0 – 6.9), High (7.0 – 8.9), and Critical (9.0 – 10.0).

A CVSS Base score (CVSS-B) reflects intrinsic technical severity assuming worst-case exploitability, which often inflates remediation queues. Combining Base with Threat (Exploit Maturity) and Environmental metrics (CVSS-BTE) reflects whether a public PoC or active in-the-wild exploitation actually exists.

In a typical Reflected or Stored XSS where the web server hosts the flaw but the victim's browser DOM/session is compromised, the Vulnerable System (the web server itself) often has VC:N/VI:N/VA:N, while the Subsequent System (the user's browser context) receives SC:L/SI:L/SA:N with UI:P (Passive) or UI:A (Active).