Datasetpublic

AgileRLArena/vulnerability-scores-cvss-v3

Vulnerability scores (CVSS v3 combined) A labeled slice of CIRCL/vulnerability-scores for training and evaluating models that predict CVSS v3 severity from a vulnerability description. Every row has a combined v3 score and a severity band. Rows with no v3.1 or v3.0 score were dropped. What changed from the original The CIRCL dataset stores four separate CVSS columns (cvss_v4_0, cvss_v3_1, cvss_v3_0, cvss_v2_0). Those versions are not on the same scale, so this… See the full description on the dataset page: https://huggingface.co/datasets/AgileRLArena/vulnerability-scores-cvss-v3.

sourceHugging Facecc-by-4.0updated 15d agoView on Hugging Face

0likes61downloads

Dataset Card

Vulnerability scores (CVSS v3 combined)

A labeled slice of CIRCL/vulnerability-scores for training and evaluating models that predict CVSS v3 severity from a vulnerability description.

Every row has a combined v3 score and a severity band. Rows with no v3.1 or v3.0 score were dropped.

What changed from the original

The CIRCL dataset stores four separate CVSS columns (cvss_v4_0, cvss_v3_1, cvss_v3_0, cvss_v2_0). Those versions are not on the same scale, so this derivative does not average them or prefer v4.

cvss_v3_1_v3_combined is:

1.cvss_v3_1 when it is present
2.otherwise cvss_v3_0

v3.0 and v3.1 are the same scoring system (mean absolute difference about 0.09 on overlapping rows). v2 and v4 are not mixed in.

severity_band is the standard CVSS qualitative rating of that combined score:

Band	Score
`low`	0.0–3.9
`medium`	4.0–6.9
`high`	7.0–8.9
`critical`	9.0–10.0

Unlabeled rows are removed. That includes rows with no CVSS score at all, and rows that only have a v2 or v4 score.

Original columns are kept, including the unused v2/v4 values.

Train and test splits follow CIRCL’s split. A row is not moved between splits.

Splits

Split	Rows	From v3.1	From v3.0 fallback
train	509,067	410,050	99,017
test	56,502	45,623	10,879
total	565,569	455,673	109,896

CIRCL’s full dump is 779,178 rows. This set keeps 565,569 (72.5%).

Severity bands

Split	low	medium	high	critical
train	18,546	222,832	206,725	60,964
test	2,041	24,767	23,017	6,677

Fields

Same as CIRCL, plus:

Field	Type	Description
`cvss_v3_1_v3_combined`	float	v3.1 score, or v3.0 if v3.1 is missing. Never null in this dataset.
`severity_band`	string	`low`, `medium`, `high`, or `critical`. Never null in this dataset.

Usage

python

from datasets import load_dataset

ds = load_dataset("AgileRLArena/vulnerability-scores-cvss-v3")
print(ds["train"][0]["description"])
print(ds["train"][0]["cvss_v3_1_v3_combined"], ds["train"][0]["severity_band"])

Typical training target is severity_band (classification) or cvss_v3_1_v3_combined (regression). Input is description.

Source and license

Derived from CIRCL/vulnerability-scores (CIRCL / Vulnerability-Lookup, VulnTrain). Paper: VLAI: A RoBERTa-Based Model for Automated Vulnerability Severity Classification.

License is CC-BY-4.0, same as the original. Credit CIRCL when you use this dataset.