GitHub Engagement Signals for CVE Prioritization: The GitHub Popularity Metric (GPM)
Researchers propose GPM, an open CVE prioritization metric based on GitHub exploit popularity, now in EPSS v5.
The paper introduces the GitHub Popularity Metric (GPM), an open CVE prioritization score based on stars, forks, and unique users associated with exploit repositories. GPM can be computed for current and historical windows and is compared with CVSS, EPSS, KEV, and SSVC. The authors report that it highlights CVEs and inconsistencies missed by existing methods, and that GPM was integrated into EPSS version 5. A demonstration of the work was accepted to the ACM CCS 2026 demo track.
- GPM scores CVE exploit popularity from GitHub stars, forks, and users.
- It is fully open and computable across current and historical windows.
- Authors compare GPM with CVSS, EPSS, KEV, and SSVC.
- GPM was integrated into EPSS version 5; a CCS 2026 demo was accepted.
From the original article
1 min read at arxiv.orgAttackers can compromise multiple systems with a single vulnerability, while defenders need to fix all security weaknesses in their systems. This asymmetry puts defenders at a disadvantage. Security vulnerabilities are found at an alarming rate, and patching vulnerabilities is costly and time-consuming; thus, vulnerability prioritization is a must and a time-critical challenge.
By Jafar Akhoundali · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.