cvss
CVSS2/3/4 library with interactive calculator for Python 2 and Python 3
Decision gist · record as of 2026-08-14
Yes. The package is stable, dependency-free, and fills a clear need for standardized vulnerability scoring. The copyleft license is a minor consideration only if you plan to redistribute modified code. The aging maintenance status (375 days since last release) is not a blocker for a mature, narrow-scope library, but verify that the v2/v3/v4 standards it implements match your current security requirements.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Low friction installation with no runtime dependencies.
- Maintenance status is aging—last release was 375 days ago—but the repository remains active and the package is marked Production/Stable.
License · maintenance · safety
LGPLv3+ (copyleft) — Licensed under LGPLv3+, a copyleft license. Any derivative work or modification must be distributed under the same or compatible license terms.
last release 2025-08-04 (375 days) · last repo commit 2025-08-04 · 126 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 1,996,234 downloads/mo, #3,375 on PyPI
Alternatives
Verify before relying
pip install cvss
from cvss import CVSS3
vector = 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
c = CVSS3(vector)
print(c.scores())
print(c.severities())- Whether the package is actively maintained or in maintenance-only mode given the 375-day gap since last release
What it is and what it does
This package implements the Common Vulnerability Scoring System (CVSS) standards for Python, supporting all three major versions: v2, v3, and v4. It takes a CVSS vector string—a standardized notation that encodes vulnerability characteristics like attack vector, complexity, and impact—and computes the corresponding numeric score (0–10) and severity rating (e.g., 'Critical', 'High', 'Medium'). The library includes both a programmatic API for scripting and an interactive command-line calculator for manual scoring.
The package has no runtime dependencies and is tested across modern Python versions (3.6 through 3.13). It is designed to be lightweight and portable, making it suitable for integration into security tools, vulnerability databases, and assessment workflows where standardized severity ratings are needed.
Use it for
- Score vulnerabilities in a security scanner or vulnerability management system using standardized CVSS ratings.
- Parse and validate CVSS vector strings from security advisories or CVE databases.
- Generate severity reports that map raw vulnerability data to standardized impact levels for stakeholder communication.
- Automate vulnerability triage by computing scores for large batches of security issues.
- Build a command-line tool for security analysts to interactively calculate CVSS scores during incident response.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes.
The package is stable, dependency-free, and fills a clear need for standardized vulnerability scoring. The copyleft license is a minor consideration only if you plan to redistribute modified code. The aging maintenance status (375 days since last release) is not a blocker for a mature, narrow-scope library, but verify that the v2/v3/v4 standards it implements match your current security requirements.
Install
cvss on PyPI
Before you install
Low friction installation with no runtime dependencies. Maintenance status is aging—last release was 375 days ago—but the repository remains active and the package is marked Production/Stable.
License in practice
Licensed under LGPLv3+, a copyleft license. Any derivative work or modification must be distributed under the same or compatible license terms.
Quickstart
pip install cvss
from cvss import CVSS3
vector = 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
c = CVSS3(vector)
print(c.scores())
print(c.severities())Verify before relying
- Whether the package is actively maintained or in maintenance-only mode given the 375-day gap since last release
Package facts
| License | LGPLv3+ copyleft |
| Python support | Not specified |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | None |
| Maintenance | Aging 375 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 1,996,234 / month, #3,375 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 5 - Production/StableIntended Audience :: DevelopersLicense :: OSI Approved :: GNU Lesser General Public License v3 or later (LGPLv3+)Programming Language :: Python :: 3Programming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.6Programming Language :: Python :: 3.7Programming Language :: Python :: 3.8Programming Language :: Python :: 3.9Topic :: Security |
Evidence: cvss-3.6-py2.py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “cvss score calculator”
- cvssParses and scores CVSS v2, v3, and v4 vulnerability severity vectors,…
- cosmic-rayCosmic Ray is a mutation testing tool that modifies your Python…
- nvdlibWrapper library for the NIST National Vulnerability Database API that…
Give your agent the search over MCP, or paste the wish link into any chat.
More Security packages
Provides Python bindings to the FreeDesktop.org Secret Service API for securely storing and retrieving passwords and secrets through GNOME Keyring, KWallet, or KeePassXC.
MSAL for Python handles OAuth2 and OpenID Connect authentication with Microsoft identity services, managing token acquisition, caching, and refresh for applications integrating with Microsoft Entra ID, Microsoft Accounts, and Azure AD B2C.
joserfc implements JOSE standards (JWS, JWE, JWK, JWT, and related RFCs) for signing, encrypting, and managing JSON-based cryptographic tokens in Python.
Authlib provides a complete implementation of OAuth 1.0, OAuth 2.0, and OpenID Connect 1.0 for building both authentication clients and servers, with built-in support for JWS, JWK, JWA, and JWT standards.
Provides low-level CFFI bindings to the official Argon2 password hashing algorithm for use by libraries and applications that need direct access to Argon2 without higher-level abstractions.
ADAL for Python authenticates applications with Azure Active Directory to obtain tokens for accessing Azure AD-protected resources.
Install only if maintaining existing code that already depends on it, and plan a migration.
See also nvdlib · debsecan-mcp · pysentry-rs · properscoring · uv-secure · ca9 · recurly · dbt-score · lib4vex · trueskill