Software Security – CVSS Scoring API

Try It

The same scoring as the calculator. Stateless, nothing is stored, and CORS is open, so it can be called from any web page.

Vector

Request

Open in browser

Response

Score several vectors at once

Reference

Endpoints

Request	Description
GET /cvss/api.php?vector=<vector>	Score one vector. `:` and `/` may stay unencoded in the query.
POST /cvss/api.php	JSON body `{"vector": "…"}` or form field `vector=…` — same result as GET. JSON body `{"vectors": ["…", "…"]}` scores up to 100 vectors at once and returns `{"ok": true, "results": […]}`, one entry per vector in the same order. A bad vector does not fail the batch; its entry carries `"ok": false` and the error instead.

Accepted vectors

CVSS:4.0/… and CVSS:3.1/…. All base metrics are required; threat, temporal, environmental and supplemental metrics are optional, in any order.
Without a prefix (as NVD shows v3 vectors, AV:N/AC:L/…) the version is guessed: 4.0 if AT or VC appears, else 3.1.
CVSS 3.0 and 2.0 are not supported. The response always contains the normalised vector — canonical order, X values dropped.

Response fields

Field	Meaning
ok	`true`, or `false` together with `error` (a stable code) and `message` (human readable).
version	`"4.0"` or `"3.1"`
vector	Normalised vector string.
score, severity	The overall score and its rating: `None`, `Low`, `Medium`, `High`, `Critical`. For 3.1 this is the most specific score the vector supports — environmental if any environmental metric is set, else temporal if any temporal metric is set, else base.
nomenclature, macroVector	4.0 only: `CVSS-B`, `CVSS-BT`, `CVSS-BE` or `CVSS-BTE`, and the six-digit MacroVector (EQ1–EQ6) the score was looked up from.
base, temporal, environmental	3.1 only: each with `score` and `severity`; base and environmental also with the `impact` and `exploitability` subscores.
metrics	Every metric of the version with its value, `X` where not defined.
url	Link that opens this calculator with the vector pre-selected.
translation	What the vector says about the other version (3.1 ↔ 4.0): `version`, the `metrics` that carry over, `open` (base metrics that need more information, e.g. 3.1 `AC:H` does not tell 4.0 whether `AC` or `AT` applies), and `assumed` — metrics resting on a scope assumption (3.1 `S:U` → no subsequent-system impact; a 4.0 subsequent-system impact → `S:C`). When nothing is open, also `vector`, `score` and `severity`.

Status codes

200 — scored (and for every batch that could be read, even if single entries failed).
400 — no vector given, or the vector is invalid (missing_vector, invalid_vector, invalid_body).
405 — any method other than GET, POST or OPTIONS.
413 — more than 100 vectors in one batch (too_many_vectors).

CWE Lookup

The calculator maps vulnerabilities to CWE from a copy of MITRE's CWE catalog on this server. The same catalog can be searched directly — a keyword ranking, no AI, nothing stored, CORS open. Try ?q=path traversal in zip extraction.

Request	Description
GET /cvss/cwe.php?q=<text>	The weaknesses that best match a description or keywords (up to 4000 characters), best first. `&limit=` 1–25, default 10. Only entries that may be used for mapping are returned.
GET /cvss/cwe.php?id=79,89	Up to 25 entries by ID (`79` or `CWE-79`), each with `alternate_terms`, MITRE's `mapping_note`, `parents` and `children`. An unknown ID gets an `error` entry.

Every result has id, name, kind (weakness or category), abstraction (Pillar, Class, Base, Variant), status, description, url (cwe.mitre.org) and usage — MITRE's mapping guidance: Allowed, Allowed-with-Review, Discouraged or Prohibited (categories, deprecated entries). catalog names the CWE edition. Errors: 400 no or bad query, 413 query or ID list too long, 503 catalog not installed.