## 4 Materials and Methods
### Inputs
C and C++ have high-risk coefficients of 0.5444 and 0.4271 due to memory management issues, while Java has a vulnerability coefficient near 0.6584 due to access control and input validation weaknesses. PHP shows a coefficient of 0.2480 due to XSS and SQL injection, while JavaScript, which is pervasive in web applications, has a coefficient of 0.0451 related to insecure interactions. \begin{table}
\begin{tabular}{l l l l l} \hline \hline
**Language** & **Common CWEs** & **Total Vulnerabilities** & \begin{tabular}{l} **CVSS Score Percentage (High, Medium,** \\ **Low**) \\ \end{tabular} \\ \hline PHP & \begin{tabular}{l} CWE-20, CWE-22, CWE-78, CWE-79, \\ CWE-89, CWE-306, CWE-352, CWE-434, \\ CWE-502, CWE-601 \\ \end{tabular} & 13,000+ & High: 30\%, Medium: 50\%, Low: 20\% \\ \hline Java & \begin{tabular}{l} CWE-20, CWE-79, CWE-89, CWE-209, \\ CWE-287, CWE-400, CWE-476, CWE-502, \\ CWE-611, CWE-732 \\ \end{tabular} & 3000+ & High: 35\%, Medium: 45\%, Low: 20\% \\ \hline C & \
\begin{tabular}{l} CWE-20, CWE-119, CWE-125, CWE-200, \\ CWE-362, CWE-399, CWE-416, CWE-476, \\ CWE-772, CWE-787 \\ \end{tabular} & 10,000+ & High: 40\%, Medium: 40\%, Low: 20\% \\ \hline C++ &
\begin{tabular}{l} CWE-20, CWE-119, CWE-125, CWE-362, \\ CWE-399, CWE-399, CWE-400, CWE-416, CWE-476, \\ CWE-772, CWE-787 \\ \end{tabular} & 7000+ & High: 42\%, Medium: 38\%, Low: 20\% \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Top CWEs, Total Vulnerabilities, and CVSS Score Distribution by Language. The inclusion of PHP alongside Java, C, and C++ in this study is justified due to their distinct programming roles. Java, C, and C++ belong to the same language family and are essential in high-performance systems requiring explicit memory management, which makes them vulnerable to memory safety and access control issues. Notably, PHP--despite its declining popularity--remains widely used in legacy web applications, where vulnerabilities such as Cross-Site Scripting (XSS) and SQL injection continue to be key concerns. Thus, PHP was included in the vulnerability analysis due to its persistent use in security-critical applications alongside Java, C, and C++. Finally, Python, although being relatively safer (with an NBR of 0.0531), can encounter challenges related to input validation and access control when integrated with other languages via Foreign Function Interfaces (FFI), thus heightening its vulnerability. Traditional ML methods based on batch processing struggle to adapt to new data distributions or emerging threats, limiting their flexibility in handling evolving security landscapes [13]. Despite challenges such as licensing, sample diversity, or public access in obtaining vulnerable code, the Software Assurance Metrics and Tool Evaluation (SAMATE) project [41] offers a comprehensive data set for this purpose. The Software Assurance Reference Data Set (SARD) [42] is openly available and provides over 450,000 case studies for programming languages such as PHP, Java, C, and C++, classified according to CWE and including descriptions of code flaws, making it a valuable resource for vulnerability research. To ensure the quality of the data, vulnerable code from SARD was thoroughly filtered. Only cases labeled as _accepted + bad_, which have been verified through functional testing, were included. Mixed cases with minimal variations within the same CWE were excluded, and obsolete cases were filtered by comparing descriptions with those in the OWASP Top 10 2021 [43]. This comparison employed a Vector Space Model (VSM) using the Term Frequency-Inverse Document Frequency (TF-IDF) algorithm [44]. The TF-IDF algorithm assigns weights to textual corpora based on their relevance within a data set.