arXiv proposes VPre for early CVSS vector prediction
PARSE and VPre decouple evidence screening and routing to predict CVSS vectors 38 days early with 0.7239 MAE.
Stories per day · 30 days
3 RSS
Relatedphp5security-release3vulnerability-management2bug-bounty1cisa1critical-infrastructure1cve-enrichment1cwe1digital-twin1early-warning1epss1hackerone1hosting1human-in-the-loop1huntr1ics1kev1nvd1
23 stories, newest first · one card per story
Stories tagged #cvss
Pentest remediation workflow ranks findings with CVSS, EPSS and impact
A June 2026 survey of 158 practitioners found 68.4% would be strained by 500 or more candidate findings.
PHP schedules October 21 fixes for two flaws rated 9.2
watchTowr cites CVE-2026-109618 and CVE-2026-109619, but PHP has not confirmed identifiers or scope.
PHP security team schedules critical release for October 21
Two flaws each scored 9.2 will be detailed with patched versions at 14:00 UTC, or sooner if they leak.
PHP schedules critical security release for October 21
Two flaws are each rated CVSS v4.0 9.2, but versions, fixes and CVE identifiers remain unpublished.
PHP to fix two CVSS 9.2 flaws on October 21
The PHP security team may publish earlier if details leak or exploitation appears.
PHP team warns of two critical flaws ahead of October 21 release
Both issues are rated CVSS v4.0 9.2, and affected and fixed versions will be published with the 14:00 UTC release.
4
Paper scores ICS cyber risk with digital twins and a social metric
CSVSS adds a Social Impact dimension to CVSS, while an LLM drafts reports a human analyst must still validate.
LLMs overestimate CVSS severity on bug bounty reports
Best prompting reached 49.58% level accuracy on 240 vendor-validated Huntr reports; fine-tuning a 7B model hit 56.25%.
Fine-tuned Phi-3.5-mini predicts CVSS and CWE from CVE text
It matched official vectors on 48.8% of 36,325 usable 2024 CVEs after training only on 2022 and 2023.
Vulnerability Management Isn't About the Score — It's About How It Applies to You
Dark Reading argues vulnerability management should use environment-specific exploit evidence, not vendor scores.
3
CAPE - Context-Aware Prioritization Engine for Vulnerability Scoring and Management
CAPE ranks CVEs using deployment context and outperforms CVSS, EPSS, and KEV on agentic apps.
CVE-2026-21589: Critical Atlassian File Access
Atlassian disclosed CVE-2026-21589, a critical unauthenticated file-access flaw in eight self-hosted products.
CVE-2026-56098: Katello: Registry Proxy authorization bypass (fixed in 4.21.2, 5.0.1)
Katello Registry Proxy lets low-privilege users bypass authorization and enumerate organizations and products.
When Cyber Scoring Systems Diverge: An Empirical Comparison
CVSS, EPSS, SSVC, and IronMiner disagree sharply on a reconstructed 2015 Ukraine grid OT network.
AI-Based Vulnerability Assessment Capability and Cyber Attack Graph Analysis
Two AI attack-graph methods recover the 2015 Ukraine grid paths and flag ICS nodes.
GitHub Engagement Signals for CVE Prioritization: The GitHub Popularity Metric (GPM)
Researchers propose GPM, an open CVE prioritization metric based on GitHub exploit popularity, now in EPSS v5.
CVE-2026-31377: Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta Service
CVE-2026-31377 lets unauthenticated attackers reach the Apache Doris Frontend meta service; CVSS score is 7.5.
CISA Retires Weekly Vulnerability Bulletin in Risk-Based Pivot
CISA will discontinue its weekly vulnerability bulletin on September 28, shifting defenders toward risk-based prioritization via the KEV catalog.
CISA decides weekly vulnerability bulletin isn't necessary anymore
CISA will discontinue its weekly vulnerability bulletin on September 28, pushing users toward KEV, alerts, and CVE data under risk-based prioritization.
1
Quantifying IIoT Sensor Node Criticality by Fusing its Data Criticality and Security Vulnerability
Researchers propose a Dempster–Shafer framework fusing IIoT sensor data criticality with CVSS 4.0/3.1 vulnerability scores to rank node criticality.
Drowning in CVEs and thirsty for answers? Try CTEM
Sponsored Register piece argues traditional vulnerability management cannot scale with CVE volume and promotes Continuous Threat Exposure Management via Horizon3's NodeZero.
What vulnerability prioritization looks like when KEV, EPSS, and CVSS disagree
Cohesity field CISO Joye Purser ranks KEV over EPSS over CVSS and urges 24-72 hour patching of exploited internet-facing systems.