---
task_categories:
- text-classification
language:
- en
license: cc-by-4.0
library_name: datasets
tags:
- vulnerability
- cybersecurity
- security
- cve
- cvss
---

# vulnerability-scores

This dataset comprises **731,020** real-world vulnerabilities used to train and evaluate VLAI,
a transformer-based model designed to predict software vulnerability severity levels directly from text descriptions,
enabling faster and more consistent triage.

The dataset is presented in the paper [VLAI: A RoBERTa-Based Model for Automated Vulnerability Severity Classification](https://huggingface.co/papers/2507.03607).

## Sources

| Source | Label | Entries | Share |
|--------|-------|---------|-------|
| `cvelistv5` | CVE Program (enriched with vulnrichment and Fraunhofer FKIE) | 345,760 | 47.3% |
| `github` | GitHub Security Advisories | 345,052 | 47.2% |
| `csaf_redhat` | CSAF Red Hat | 26,218 | 3.6% |
| `csaf_cisa` | CSAF CISA | 5,944 | 0.8% |
| `pysec` | PySec advisories | 4,105 | 0.6% |
| `csaf_cisco` | CSAF Cisco | 3,941 | 0.5% |

Extracted from the database of [Vulnerability-Lookup](https://vulnerability.circl.lu) with the [VulnTrain](https://github.com/vulnerability-lookup/VulnTrain) project.
Dumps of the data are available [here](https://vulnerability.circl.lu/dumps/).

## Splits

| Split | Examples |
|-------|----------|
| train | 657,918 |
| test  | 73,102 |

## Fields

| Field | Type | Description |
|-------|------|-------------|
| `id` | string | Vulnerability identifier (e.g., CVE-2024-1234, GHSA-xxxx, PYSEC-2024-xxx) |
| `title` | string | Vulnerability title |
| `description` | string | Vulnerability description in English |
| `cpes` | list[string] | Common Platform Enumeration identifiers |
| `cvss_v4_0` | float | CVSS v4.0 score |
| `cvss_v3_1` | float | CVSS v3.1 score |
| `cvss_v3_0` | float | CVSS v3.0 score |
| `cvss_v2_0` | float | CVSS v2.0 score |
| `patch_commit_url` | string | URL to the patch commit on GitHub, if available |
| `source` | string | Data source identifier |

## Usage

```python
import json
from datasets import load_dataset

dataset = load_dataset("CIRCL/vulnerability-scores")

vulnerabilities = ["CVE-2012-2339", "RHSA-2023:5964", "GHSA-7chm-34j8-4f22", "PYSEC-2024-225"]

filtered_entries = dataset.filter(lambda elem: elem["id"] in vulnerabilities)

for entry in filtered_entries["train"]:
    print(json.dumps(entry, indent=4))
```

## Related models

- [CIRCL/vulnerability-severity-classification-roberta-base](https://huggingface.co/CIRCL/vulnerability-severity-classification-roberta-base) — RoBERTa severity classifier
- [CIRCL/vulnerability-severity-classification-distilbert-base-uncased](https://huggingface.co/CIRCL/vulnerability-severity-classification-distilbert-base-uncased) — DistilBERT severity classifier

## References

- [Vulnerability-Lookup](https://vulnerability.circl.lu) — the vulnerability data source
- [VulnTrain](https://github.com/vulnerability-lookup/VulnTrain) — training pipeline
- [ML-Gateway](https://github.com/vulnerability-lookup/ML-Gateway) — inference API
- [VLAI paper](https://arxiv.org/abs/2507.03607) — Bonhomme, C., Dulaunoy, A. (2025)