Datasetpublic

CIRCL/vulnerability-scores

vulnerability-scores This dataset comprises 798,886 real-world vulnerabilities used to train and evaluate VLAI, a transformer-based model designed to predict software vulnerability severity levels directly from text descriptions, enabling faster and more consistent triage. The dataset is presented in the paper VLAI: A RoBERTa-Based Model for Automated Vulnerability Severity Classification. Sources Source Label Entries Share cvelistv5 CVE Program… See the full description on the dataset page: https://huggingface.co/datasets/CIRCL/vulnerability-scores.

sourceHugging Facecc-by-4.0updated 18h agoView on Hugging Face

11likes303downloads

Dataset Card

vulnerability-scores

This dataset comprises 798,886 real-world vulnerabilities used to train and evaluate VLAI, a transformer-based model designed to predict software vulnerability severity levels directly from text descriptions, enabling faster and more consistent triage.

The dataset is presented in the paper VLAI: A RoBERTa-Based Model for Automated Vulnerability Severity Classification.

Sources

Source	Label	Entries	Share
`cvelistv5`	CVE Program (enriched with vulnrichment and Fraunhofer FKIE)	377,278	47.2%
`github`	GitHub Security Advisories	375,215	47.0%
`csaf_redhat`	CSAF Red Hat	28,859	3.6%
`pysec`	PySec advisories	7,525	0.9%
`csaf_cisa`	CSAF CISA	6,066	0.8%
`csaf_cisco`	CSAF Cisco	3,943	0.5%

Extracted from the database of Vulnerability-Lookup with the VulnTrain project. Dumps of the data are available here.

Splits

Split	Examples
train	718,997
test	79,889

Fields

Field	Type	Description
`id`	string	Vulnerability identifier (e.g., CVE-2024-1234, GHSA-xxxx, PYSEC-2024-xxx)
`title`	string	Vulnerability title
`description`	string	Vulnerability description in English
`cpes`	list[string]	Common Platform Enumeration identifiers
`cvss_v4_0`	float	CVSS v4.0 score
`cvss_v3_1`	float	CVSS v3.1 score
`cvss_v3_0`	float	CVSS v3.0 score
`cvss_v2_0`	float	CVSS v2.0 score
`patch_commit_url`	string	URL to the patch commit on GitHub, if available
`source`	string	Data source identifier

Usage

python

import json
from datasets import load_dataset

dataset = load_dataset("CIRCL/vulnerability-scores")

vulnerabilities = ["CVE-2012-2339", "RHSA-2023:5964", "GHSA-7chm-34j8-4f22", "PYSEC-2024-225"]

filtered_entries = dataset.filter(lambda elem: elem["id"] in vulnerabilities)

for entry in filtered_entries["train"]:
    print(json.dumps(entry, indent=4))

Related models

—CIRCL/vulnerability-severity-classification-roberta-base — RoBERTa severity classifier
—CIRCL/vulnerability-severity-classification-distilbert-base-uncased — DistilBERT severity classifier

References

—Vulnerability-Lookup — the vulnerability data source
—VulnTrain — training pipeline
—ML-Gateway — inference API
—VLAI paper — Bonhomme, C., Dulaunoy, A. (2025)