Where to find the full reference of CVSS values and how the NVD CVSS calculator works

The National Vulnerability Database (NVD) CVSS online calculator is the official, comprehensive reference for all CVSS metric values, including v3.1. Tenable docs can guide usage, but the full metric space lives with NVD. Use the calculator to see allowed values and how they form a vector string.

There’s a quiet but powerful truth behind CVSS: it’s a fixed vocabulary. If you’ve spent time wrestling with vulnerability data, you’ve probably noticed that CVSS scores aren’t just numbers pulled from the ether. They’re built from a well-defined set of metrics, each with its own allowed values. Put simply, CVSS is a standardized language for describing how severe a vulnerability is, and that language is standardized for good reason.

Let’s unpack what that means and, more importantly, where you can find the most authoritative map of every metric option and how those options combine into a score.

The backbone of CVSS: fixed metrics and defined values

CVSS isn’t a guessing game. It’s a structured framework with a fixed catalog of metrics, and each metric has a carefully enumerated set of possible values. For CVSS versions 3.0 and 3.1 (the most widely used in modern workflows), the core metrics include:

• Attack Vector: how the attacker would reach the vulnerability (physical, local, adjacent, network).

• Attack Complexity: how hard it is to exploit (low, high).

• Privileges Required: what level of privileges an attacker needs (none, low, high, sometimes a “unprivileged” framing depending on the version).

• User Interaction: whether exploitation requires a user to do something (none, required).

• Scope: whether the vulnerability affects resources beyond its own security scope (unchanged, changed).

• Impact metrics: Confidentiality, Integrity, and Availability impacts, each rated as none, low, or high.

These metrics come together into a vector string and, from there, into the numerical score. The key point: the set of options for each metric is finite and documented. That makes CVSS predictable, auditable, and portable across tools and databases.

Where to find the complete reference: the National Vulnerability Database’s CVSS calculator

If you want a single, definitive reference that lays out every metric option and shows how they combine, the National Vulnerability Database (NVD) CVSS calculator is the place to go. Here’s why it’s the standard-bearer:

• It’s the canonical source for CVSS metric options. You can browse each metric, see all permissible values, and watch how a chosen vector translates into a numeric score.

• It covers CVSS versions that matter in practice, including 3.1, which remains widely used in security tooling and reporting.

• It presents the vector string in a straightforward, human-readable format and demonstrates how each part of the string contributes to the overall severity.

In short, if you need a complete, official reference of every metric option and their combinations, the NVD CVSS calculator is the anchor point. It’s the resource that many security products and databases reference to stay aligned with a universal standard.

Why other sources don’t quite measure up for the full reference

There are plenty of places to learn about CVSS, and many are helpful for day-to-day work. But if you’re after the entire universe of metric values and their permitted combinations, a quick tour through general documentation or product-specific pages won’t give you the exhaustive catalog.

• Product documentation: Company and product docs—like those for vulnerability management platforms—do a great job explaining how CVSS is used within that product, how scores are displayed, and what nuances a particular tool might apply. They’re invaluable for practitioners, but they’re not the universal, version-agnostic catalog of all metric options.

• Individual finding details: In many tools, a given vulnerability presents a CVSS score and its vector string. Those plugin or finding details show the score for that item, but they don’t enumerate every possible value across all metrics. They describe the result you’re looking at, not the full space of possibilities.

• General articles or tutorials: These often focus on what CVSS means and how to interpret scores, perhaps with worked examples. They’re excellent for intuition and learning, but they’re not the definitive reference for every metric option.

Understanding CVSS in practice, beyond the numbers

For a Tenable Vulnerability Management Specialist—or anyone coordinating a vulnerability program—the CVSS framework isn’t just about numbers. It’s about context. Here’s how a full grasp of CVSS values informs real-world work:

• Prioritization that makes sense: When you know the exact metric values behind a score, you understand why a vulnerability has that severity. For example, a high impact on confidentiality with network attack vector and low attack complexity communicates a different risk story than a high impact on availability with local access. That nuance guides where you allocate remediation effort.

• Consistency across data sources: Different feeds and tools may compute scores slightly differently if they interpret metrics in varying ways. With a shared, canonical reference, you can harmonize discussions, mappings, and dashboards, reducing confusion.

• Transparency in reporting: Stakeholders—from IT operations to executive leadership—often want to understand how a risk picture was built. Being able to point to the exact CVSS vector that produced a score adds credibility and clarity.

• Evolution readiness: CVSS isn’t frozen. As new versions or refinements emerge, having a stable, official source for metric values helps teams adapt without losing track of how scores are formed.

A practical tour: what you’ll see on the NVD calculator

If you open the NVD CVSS calculator, you’ll notice a few things that make the ecosystem feel coherent and navigable:

• Metric selectors: Each metric presents its allowed values clearly. You can switch between versions if you’re comparing CVSS 3.0 and 3.1 scores.

• Real-time score: As you choose values, the calculator updates the vector string and the numerical base score on the fly. It’s handy for experimentation and for validating your understanding.

• Extended details: The calculator often includes explanations of what each metric means, how the values impact scoring, and notes on scope and base impact. That extra context is useful when you’re teaching teams or documenting risk assessments.

• Vector string format: You’ll see the compact vector (e.g., AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). If you recognize those letters, you’re on the same wavelength as security practitioners worldwide.

Bringing it back to everyday practice

Here’s a simple way to anchor your work: whenever you encounter a CVSS score, take a moment to translate the vector string into its meaning. Ask yourself:

• What does the attack vector tell me about exposure?

• How does attack complexity influence likelihood?

• Are user interactions required, or could exploitation happen quietly?

• Is there a scope change that could widen the impact beyond the vulnerable component?

• Which impact areas (Confidentiality, Integrity, Availability) are most affected, and by how much?

That translation isn’t about chasing perfect scores; it’s about building a narrative around risk that teammates can act on. And remember, the NVD CVSS calculator is your friend in this translation work. It’s the most reliable compass for navigating the landscape of CVSS values.

A few tips to keep your CVSS literacy sharp

• Get comfortable with the vector: Practice reading and writing vector strings. They’re compact, but they convey a lot of information. The more you see them, the faster you’ll interpret risk.

• Compare versions thoughtfully: If you’re comparing scores from different CVSS versions, be mindful of how metric definitions shifted between versions. A direct numeric comparison isn’t always apples-to-apples.

• Use the canonical reference as your yardstick: When in doubt about a metric’s allowed values or how they combine, check the NVD calculator. It’s the standard against which other sources measure themselves.

• Keep the conversation human: Numbers matter, but so do the stories behind them. Pair CVSS data with practical implications for teams—what needs attention first, what resources are required, what timelines are realistic.

A final thought: CVSS as a shared language, not a secret code

Vulnerability management thrives when teams can move beyond isolated dashboards and speak the same language about risk. CVSS provides that shared vocabulary, and the NVD CVSS calculator is the most trustworthy map you’ll find for every metric option and their combinations. It’s not about memorizing a bunch of numbers for their own sake; it’s about arming you with a clear, consistent way to understand and communicate risk—and to drive smarter, more focused action across your security program.

If you’re curious to deepen your fluency, spend a little time with the calculator. Play around with different vectors, observe how small changes in a metric shift the overall score, and notice how the narrative changes with it. You’ll gain a sharper intuition for vulnerability severity, and that—not just the score—will guide your decisions in a way that makes sense to everyone involved.