Datasetpublic

luca-software-developer/cyber-cve2cwe-extension

cyber-cve2cwe-extension Overview The CVE-to-CWE classification task suffers from low macro-averaged F1 scores because many CWE categories appear only a handful of times in the training data. This dataset supplies additional examples for 36 low-frequency (tail) CWE classes with the aim of improving model performance on those categories and providing a reproducible record of how the training data for the companion model was extended. It is intended as a transparency… See the full description on the dataset page: https://huggingface.co/datasets/luca-software-developer/cyber-cve2cwe-extension.

sourceHugging Facecc-by-4.0updated 9d agoView on Hugging Face

1likes85downloads

Dataset Card

cyber-cve2cwe-extension

Overview

The CVE-to-CWE classification task suffers from low macro-averaged F1 scores because many CWE categories appear only a handful of times in the training data. This dataset supplies additional examples for 36 low-frequency (tail) CWE classes with the aim of improving model performance on those categories and providing a reproducible record of how the training data for the companion model was extended. It is intended as a transparency artifact rather than a complete training resource.

Dataset composition

The dataset consists of a single split stored in the file nvd_extension.parquet. Each record contains four fields:

—cve_id: the official CVE identifier (e.g., CVE-2026-47088).
—description: the English vulnerability description as published by the National Vulnerability Database (NVD).
—cwe_id: the target CWE identifier for the record (e.g., CWE-126).
—source: provenance tag, always the literal string NVD.

The split holds 153 records covering the identified tail CWE classes.

Per-class distribution

The 36 CWE classes fall into three distinct frequency bands:

—Five classes have 11 to 18 records each. The most represented are CWE-407 (18 records), CWE-829 (17 records), CWE-668 (13 records), CWE-610 (13 records) and CWE-1284 (11 records).
—Twenty-one classes contain between 2 and 9 records each. Examples include CWE-681 (9 records), CWE-436 (7 records), CWE-457 (5 records), and several classes with 4, 3, or 2 records.
—Ten classes have exactly one record each, such as CWE-126, CWE-1390, CWE-305, CWE-359, CWE-277, CWE-538, CWE-93, CWE-320, CWE-834, and CWE-310.

Example record

—cve_id: CVE-2026-47088
—cwe_id: CWE-126
—source: NVD
—description: "An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is heap exposure in nested MIME comment parsing."

Collection process

Records were obtained by querying the NVD API 2.0 with the cweId parameter for each tail CWE class identified in the base dataset (classes with fewer than 100 training examples and at least one test example). After retrieval, any record whose identifier or description already existed in any split of the base dataset was removed to avoid leakage into the frozen test split. The remaining records were saved with their English description, target CWE, and a source tag of NVD. The records were collected programmatically from the public NVD API 2.0.

Why the set is small

The base dataset already incorporates the majority of NVD entries for these CWE categories. Deduplication therefore leaves only residual records that were not present before, resulting in a modest total of 153 records.

Relation to base dataset and companion model

The base dataset is xamxte/cve-to-cwe, a CVE-to-CWE collection covering 205 CWE classes and derived from the NVD with AI-assisted relabeling. The frozen test split of this base dataset serves as a standard evaluation benchmark.

The 153 additional records were merged into the training split of the base dataset. They were then combined with class-wise oversampling (each class duplicated with replacement to reach at least 500 records) and used to fine-tune the companion model luca-software-developer/cyber-cve2cwe-0.6b, a Qwen3-0.6B model equipped with LoRA rank-32 adapters. On the frozen test split, macro F1 improved from 0.512 to 0.593. Most of this gain is attributable to the oversampling strategy; the direct contribution of the 153 additional records alone is modest.

Intended uses

—Reproducing the training pipeline of the companion model.
—Supplementing tail CWE classes in research on CVE-to-CWE mapping.
—Inspecting recent NVD entries that illustrate under-represented weaknesses.

Out of scope uses

—Training a classifier using only this extension set, as it is too small and not representative.
—Treating the set as a proxy for the overall CWE distribution.

Licensing and attribution

Released under the CC BY 4.0 license. CVE identifiers and vulnerability descriptions are sourced from the CVE Program (MITRE) and the National Vulnerability Database (NVD).

Limitations

—The dataset is intentionally small and focused exclusively on tail classes; it does not reflect the full CWE frequency landscape.
—Some entries correspond to recent CVEs, so the data may become outdated as new vulnerabilities are published.

References

—National Vulnerability Database (NVD)
—Base dataset: xamxte/cve-to-cwe
—Companion model: luca-software-developer/cyber-cve2cwe-0.6b

Citation

If you use this dataset, please cite it using the following reference.

bibtex

@misc{dellorusso2026cve2cweext,
  title        = {cyber-cve2cwe-extension: a tail-class extension dataset for CVE-to-CWE classification},
  author       = {Dello Russo, Luca},
  year         = {2026},
  howpublished = {\url{https://hf.co/datasets/luca-software-developer/cyber-cve2cwe-extension}}
}