Understanding the landscape of software vulnerabilities is key for developing effective security solutions. Fortunately, the evaluation of vulnerability databases that use a framework for communicating vulnerability attributes and their severity scores, such as the Common Vulnerability Scoring System (CVSS), can help shed light on the nature of publicly published vulnerabilities. In this paper, we characterize the software vulnerability landscape by performing a historical and statistical analysis of CVSS vulnerability metrics over the period of 2005 to 2019 through using data from the National Vulnerability Database. We conduct three studies analyzing the following: the distribution of CVSS scores (both empirical and theoretical), the distribution of CVSS metric values and how vulnerability characteristics change over time, and the relative rankings of the most frequent metric value over time. Our resulting analysis shows that the vulnerability threat landscape has been dominated by only a few vulnerability types and has changed little during the time period of the study. The overwhelming majority of vulnerabilities are exploitable over the network. The complexity to successfully exploit these vulnerabilities is dominantly low; very little authentication to the target victim is necessary for a successful attack. And most of the flaws require very limited interaction with users. However on the positive side, the damage of these vulnerabilities is mostly confined within the security scope of the impacted components. A discussion of lessons that could be learned from this analysis is presented.
CVE-LLM : Ontology-Assisted Automatic Vulnerability Evaluation Using Large Language Models
Digital Technology and Innovation, Siemens Healthineers USA（美国西门子医疗数字技术与创新部门）；Cybersecurity, Siemens Healthineers Germany（德国西门子医疗网络安全部门）；Corporate Technology, Siemens AG Romania（罗马尼亚西门子公司企业技术部门）
Knowdit: Agentic Smart Contract Vulnerability Detection with Auditing Knowledge Summarization
Nanyang Technological University（南洋理工大学）；National Superior College for Engineers, Beihang University（北京航空航天大学高等工程学院）；Bitslab；The Chinese University of Hong Kong（香港中文大学）
Cross-Ecosystem Vulnerability Analysis for Python Applications
University of Athens（雅典大学）；National Infrastructures for Research and Technology（国家研究与技术基础设施）；Athens University of Economics and Business（雅典经济与商业大学）；ETH Zurich（苏黎世联邦理工学院）；Technical University of Crete（克里特理工大学）
