Newest papers

Narratives Mislead: An Empirical Study of How LLMs Misjudge CVSS Severity in Bug Bounty Reports

Ruitao Feng, Yuekang Li, Yao Zhang · 2026 · arXiv

DOI: 10.48550/arXiv.2610.24623 · open-access PDF

Japanese

Bug bounty platforms receive vulnerability reports faster than vendors can sort them, and Large Language Models (LLMs) are increasingly considered for assigning the Common Vulnerability Scoring System (CVSS) severity that drives prioritization. 以前の評価は短いCVEの記述とレポートの精度をスコアするが、展開はモデルがどのようにエラーするかに依存するだけでなく、どの程度の頻度にかかっている。

Machine translation (Meta M2M100); the English original follows.

Abstract

Bug bounty platforms receive vulnerability reports faster than vendors can triage them, and Large Language Models (LLMs) are increasingly considered for assigning the Common Vulnerability Scoring System (CVSS) severity that drives prioritization. Prior evaluations score short CVE descriptions and report accuracy, but deployment depends on how models err, not only how often. CVSS gives each metric a formal meaning that departs from how researchers describe impact in narrative reports, and model rationales suggest that errors concentrate where the two diverge; we ask whether this pattern is syst

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange