## 2 Related Works  
Researchers' interest in IoT device security has grown over the past few years, and so a full literature review would be pervasive. In our article, we discuss the most important works in the context of aggregating IoT vulnerabilities. For example, in [11], the authors reviewed various research directions and their technical details from a multidimensional perspective, focusing on IoT vulnerabilities. The relatively comprehensive survey revealed many open research questions in the context of the IoT paradigm security. A study of IoT-specific attacks and their malicious signatures was also presented. The authors presented a taxonomy that shows IoT security vulnerabilities, their attack vectors, impact on multiple security targets, attacks that exploit such vulnerabilities, appropriate remediation methodologies, and operational cybersecurity capabilities offered for inference and monitoring.  
It aims to provide the reader with a multidimensional research perspective related to IoT vulnerabilities as well as a look at IoT exploits.  
The article [12] added some more granular context to analysing IoT vulnerabilities with a special focus on IoT firmware, pointing to some of the most notorious security loopholes found within IoT firmware. It also highlights the potential use of ML in firmware analysis and proposes the use of blockchain as an IoT vulnerability knowledge repository. Several other studies, such as [13; 14], further enrich these findings by highlighting the wide variety of flaws and vulnerabilities in IoT-related software and hardware solutions, which were frequently used by the threat actors to compromise the security of these devices, often leading to serious security incidents reaching far beyond the realm of the IoT. The article [15] proposes a methodology for comparing the National Vulnerability Database (NVD), China National Vulnerability Database (CNVD) and China National Information Security Vulnerability Database (CNNVD). The results show that the CNNVD contains some vulnerabilities not found in the NVD, in particular entries for Chinese vendors. However, the research lacks the comparison of vulnerability descriptions found in these databases.  
An overview summarizing our efforts to identify and evaluate publicly available sources of vulnerability information, focusing on their usefulness in the IoT domain, was presented in the paper [16], and the results of our research aimed at building such a database, i.e., how to obtain, standardize, aggregate, and correlate vulnerability information, as well as how to enrich and select IoT-related data was presented in the paper [17; 18].  
In our work, we analysed only publicly available free sources of information, excluding paid services such as the Vulners [9] vulnerability and exploit aggregator, among others. Vulners is a service that aggregates cybersecurity information from various sources, from vulnerability and exploits databases to vendor security guides and security-related blogs. Currently, data are available from 209 sources, including some of the ones we use in our database. The quality and completeness of data vary. Often, the Vulners data lack some information found in the original source for particular entries, or not all entries from a given source are available in Vulners.  
The idea of developing a solution for automatically assessing vulnerability criticality was introduced in [19]. While the proposed approach was intriguing, it did not meet our needs due to insufficient classification accuracy. Nonetheless, the findings demonstrated that vectorizing vulnerability descriptions yielded promising results. By combining this technique with a more advanced approach utilizing classic ML classification, a significantly improved solution was achieved. This enhancement in both accuracy and reliability was essential for successful implementation in the VARIoT database.