A recent arXiv paper investigates whether fine-tuned small language models can predict Common Vulnerability Scoring System (CVSS) v3.1 vectors, severity tiers, and Common Weakness Enumeration (CWE) categories directly from CVE descriptions. The authors observe that the National Vulnerability Database (NVD) labeled nearly every published CVE with this information until April 2026, suggesting that the practice may be changing or becoming unsustainable.
The study focuses on fine-tuning compact language models rather than large-scale systems, which could make automated vulnerability labeling more accessible and cost-effective. By training on existing CVE descriptions and their associated labels, the models aim to generate the same structured outputs without human intervention.
If successful, this method could help maintain vulnerability databases as the volume of newly disclosed CVEs continues to grow. The paper does not report specific performance figures in the abstract, but the proposed approach points toward a future where vulnerability enrichment is faster and less reliant on manual analysis.