Work out cvss base score instantly with clear inputs, formula shown and shareable results.
CVSS v3.1 combines an exploitability subscore from attack vector, complexity, privileges required and user interaction with an impact subscore derived from confidentiality, integrity and availability. Impact uses 1 - (1-C)(1-I)(1-A) so multiple partial impacts combine sub-additively, and the total is rounded up to one decimal. A zero impact forces a zero score regardless of how easy the attack is.
CVSS v3.1 base
exploitability = 8.22 x AV x AC x PR x UI; ISC = 1 - (1-C)(1-I)(1-A); impact = 6.42 x ISC; base = roundup(min(impact + exploitability, 10))
When scope changes, the privileges-required weights are higher (0.68 low, 0.5 high) because escaping the vulnerable component's authorisation boundary is more serious.
No. It measures severity in the abstract with no knowledge of exploitation in the wild or your environment. Combine it with EPSS and asset criticality.