CVSS 4.0 Calculator

No. The official calculator is published by FIRST.ORG at first.org/cvss/calculator/4.0 and is the authority. This calculator's scoring is a TypeScript port of the FIRST.ORG reference implementation (cvss_score.js, BSD-2-Clause), so it should agree with the official calculator for any vector. If you find a vector where it does not, that is a bug worth reporting to us.

CVSS v4.0 does not score a vector with a closed-form equation. Each vector belongs to a MacroVector equivalence class, and the score comes from that class's value interpolated toward the next-lower class by how far the vector sits from the class's most severe members. That is why this page shows the MacroVector next to the score: it is the step you would need in order to check the arithmetic by hand.

Yes, when you set them. Left at Not Defined they do not, which is what the specification requires. Exploit Maturity feeds the EQ5 MacroVector digit, and the security requirements and modified base metrics substitute into the scoring walk in place of the base values. A calculator that only implements Base is not a CVSS 4.0 calculator, so all three metric groups are exposed here.

Article 14 does not name a scoring system, so neither is mandated. What matters is whether a vulnerability is actively exploited, which is a factual question rather than a scoring one. CVSS is useful for prioritisation and for describing severity in a report consistently. Many databases still publish 3.1, so recording both is often the practical answer. A 3.1 calculator is available at /tools/cvss-calculator.

Yes. Append ?vector=CVSS:4.0/... to this page's URL and it opens with those metrics selected. The vector must carry the CVSS:4.0/ prefix and all eleven base metrics, otherwise the page says so rather than silently scoring something else.