## 1 Introduction
The need to automate the prediction of CVSS scores has become crucial due to delays or inconsistencies in their availability from various sources. To address this, an ML-based solution has been developed to automatically estimate CVSS scores. This approach allows for the faster and more accurate assessment of vulnerabilities, ensuring that critical issues can be identified and prioritized for action without relying solely on external CVSS data. Accurate categorization of affected products in vulnerabilities is essential for effective vulnerability management, as it allows security teams to filter and prioritize vulnerabilities based on the specific products that have impacted. However, this task presents several challenges. The data often need more standardization, with consistent or missing details such as vendor names, product models, or series becoming an issue, making automated categorization difficult. Product names may also be formatted differently across sources or even misspelt. This inconsistency complicates efforts to build reliable automated solutions. It happens that a product series or a trade name refers to products from entirely different categories. An example would be a mobile application for controlling IoT devices named after the entire line of IoT products. The correct product category may differ despite the same key element in the name. In response to this challenge, the authors decided to develop a robust automated categorization system that handles these variations while maintaining accuracy, ensuring that security teams can effectively track and manage vulnerabilities across diverse product ecosystems. Authors are not aware of any sources of reference for our categorization results, which makes evaluating and refining our work that much more difficult. Having robust information about vulnerabilities and exploits gives us the ability to link them. Understanding the exploits related to a specific vulnerability, and vice versa, is crucial for effective cybersecurity activities. Additionally, having an exact timeline of when a vulnerability was discovered, disclosed, and potentially exploited improves incident response planning and compliance efforts. This timeline helps organizations understand the evolution of threats and ensures timely action to protect assets before vulnerabilities can be widely exploited. The project includes monitoring the [[https://infosec.exchange](https://infosec.exchange)]([https://infosec.exchange](https://infosec.exchange)) (accessed on 1 November 2024) server on the Mastodon platform, selected for its active cybersecurity community and API capabilities. By regularly downloading and filtering posts, the system can track discussions related to vulnerabilities and index relevant data in an Elasticsearch database for further analysis. This approach supports trend identification and real-time insights into emerging cybersecurity threats, enhancing the project's broader monitoring and analysis functions. In addition to monitoring social media, the project also includes monitoring other resources using the Google Programmable Search Engine. This system queries recent news, filters out duplicates, and indexes relevant results in Elasticsearch, complementing social media monitoring by tracking wider online discussions on vulnerabilities. Monitoring different sources of information is connected with different obstacles that can limit or prevent planned operations. For example, X (formerly Twitter) API payment policy changed, thus preventing us from obtaining data. Another example is Reddit and its license, which made scraping data problematic enough that it was not chosen as an information source. The authors are not aware of other databases that would combine features in the way the VARIoT database does. One of the differentiating factors is the amount of sources used to obtain data in order to provide a comprehensive view of vulnerabilities and exploits.