ThreatLens: Evidence-Guided Ranking of High-Priority CVEs

• URL: http://arxiv.org/abs/2608.22306v1
• Date: Sun, 23 Aug 2026 09:10:40 GMT
• Title: ThreatLens: Evidence-Guided Ranking of High-Priority CVEs
• Abstract summary: ThreatLens ranks vulnerabilities at each review point using only cutoff-valid evidence.<n>System learns from future CISA KEV entries as weak supervision for exploitation relevance.
• Score: 0.19573380763700712
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Security teams must prioritize vulnerabilities before exploitation evidence is complete. Existing signals, such as CVSS, EPSS, advisories, and public exploits, are useful but fragmented and time-sensitive; retrospective rankings can therefore overstate performance by using evidence unavailable at decision time. We present ThreatLens, a simple yet effective and deployment-realistic framework for CVE prioritization. ThreatLens ranks vulnerabilities at each review point using only cutoff-valid evidence and learns from future CISA KEV entries as weak supervision for exploitation relevance. Under forward-in-time, CVE-disjoint evaluation, ThreatLens significantly outperforms CVSS, EPSS, and rule-based evidence-fusion baselines. On the held-out test split, ThreatLens surfaces 80.0% of future KEV CVEs in the top 20, over three times EPSS at the same budget, and reaches 95.9% in the top 50. Early-warning analysis further shows that ThreatLens identifies a substantial fraction of subsequent KEV entries before formal catalog inclusion, supporting timely, evidence-grounded triage.

Related papers

• AI Slop and Hallucinations in Vulnerability Assessment: A Survey on Reasoning Failures and Trustworthy Mitigation [48.55515767840701]
  "AI slop" is artifacts, hallucinated vulnerabilities, plausible but incorrect patches, and semantically repackaged bug reports.<n>This paper surveys the empirical evidence, identifies a unifying mechanism, and traces a path toward trustworthy triage.
  arXiv  Detail & Related papers  (2026-08-26T11:48:38Z)
• Look Before You Leap: Distilling Tree Search into Action Evaluation for Frozen VLA Models [60.17417174639865]
  Vision-Language-Action (VLA) models acquire broad embodied capabilities through large-scale pretraining.<n>The prevailing remedy, post-training, improves task-specific performance but narrows the generalist capability that makes pretraining valuable.<n>We propose SVA, a framework that equips frozen VLA policies with long-term consequence awareness.
  arXiv  Detail & Related papers  (2026-07-04T07:53:10Z)
• Compute-Budgeted Exploitability Evidence Graphs for Prospective Vulnerability Triage [0.2864713389096699]
  We study compute-budgeted vulnerability triage in which each CVE is scored only from public evidence visible by a fixed decision time.<n>A naive random split with unfiltered evidence inflates apparent prospective recall by 8.5x and EPSS-high recall by 5.0x.
  arXiv  Detail & Related papers  (2026-06-17T13:47:34Z)
• SecPI: Secure Code Generation with Reasoning Models via Security Reasoning Internalization [50.71047638695205]
  Reasoning language models (RLMs) are increasingly used in programming.<n>Yet, even state-of-the-art RLMs frequently introduce critical security vulnerabilities in generated code.<n>We present SecPI, a fine-tuning pipeline that teaches RLMs to internalize structured security reasoning.
  arXiv  Detail & Related papers  (2026-04-04T04:29:11Z)
• Evidence-Augmented Policy Optimization with Reward Co-Evolution for Long-Context Reasoning [52.144281362465996]
  We propose EAPO (Evidence-Augmented Policy Optimization) to apply Reinforcement Learning to long-context scenarios.<n>We first establish the Evidence-Augmented Reasoning paradigm, validating via Tree-Structured Evidence Sampling.<n>We then introduce a specialized RL algorithm where a reward model computes a Group-Relative Evidence Reward.<n>To sustain accurate supervision throughout training, we further incorporate an Adaptive Reward-Policy Co-Evolution mechanism.
  arXiv  Detail & Related papers  (2026-01-15T11:40:57Z)
• OPV: Outcome-based Process Verifier for Efficient Long Chain-of-Thought Verification [91.15649744496834]
  We propose the Outcome-based Process Verifier (OPV), which verifies the rationale process of summarized outcomes from long chains of thought.<n>OPV achieves new state-of-the-art results on our held-out OPV-Bench, outperforming much larger open-source models such as Qwen3-Max-Preview with an F1 score of 83.1 compared to 76.3.
  arXiv  Detail & Related papers  (2025-12-11T15:47:38Z)
• Long-horizon Reasoning Agent for Olympiad-Level Mathematical Problem Solving [65.02106674311908]
  This paper introduces Intern-S1-MO, a long-horizon math agent that conducts multi-round hierarchical reasoning.<n>By maintaining a compact memory in the form of lemmas, Intern-S1-MO can more freely explore the lemma-rich reasoning spaces.<n> Experiments show that Intern-S1-MO can obtain 26 out of 35 points on the non-geometry problems of IMO2025, matching the performance of silver medalists.
  arXiv  Detail & Related papers  (2025-12-11T15:26:28Z)
• Preliminary Investigation into Uncertainty-Aware Attack Stage Classification [81.28215542218724]
  This work addresses the problem of attack stage inference under uncertainty.<n>We propose a classification approach based on Evidential Deep Learning (EDL), which models predictive uncertainty by outputting parameters of a Dirichlet distribution over possible stages.<n>Preliminary experiments in a simulated environment demonstrate that the proposed model can accurately infer the stage of an attack with confidence.
  arXiv  Detail & Related papers  (2025-08-01T06:58:00Z)
• Vulnerability Management Chaining: An Integrated Framework for Efficient Cybersecurity Risk Prioritization [0.0]
  We present Vulnerability Management Chaining, a decision tree framework to achieve efficient vulnerability prioritization.<n>Our framework employs a two-stage evaluation process: first applying threat-based filtering using KEV membership or EPSS threshold $geq$ 0.088, then applying vulnerability severity assessment using CVSS scores $geq$ 7.0) to enable informed deprioritization.
  arXiv  Detail & Related papers  (2025-06-02T00:06:54Z)
• Efficacy of EPSS in High Severity CVEs found in KEV [0.0]
  The Exploit Prediction Scoring System (EPSS) is designed to assess the probability of a vulnerability being exploited in the next 30 days. This study evaluates EPSS's ability to predict exploitation before vulnerabilities are actively compromised.
  arXiv  Detail & Related papers  (2024-11-04T21:12:58Z)
• Unveiling Hidden Links Between Unseen Security Entities [3.7138962865789353]
  VulnScopper is an innovative approach that utilizes multi-modal representation learning, combining Knowledge Graphs (KG) and Natural Processing (NLP) We evaluate VulnScopper on two major security datasets, the National Vulnerability Database (NVD) and the Red Hat CVE database. Our results show that VulnScopper outperforms existing methods, achieving up to 78% Hits@10 accuracy in linking CVEs to Common Vulnerabilities and Exposures (CWEs), and Common Platform Languageions (CPEs)
  arXiv  Detail & Related papers  (2024-03-04T13:14:39Z)
• Automated CVE Analysis for Threat Prioritization and Impact Prediction [4.540236408836132]
  We introduce our novel predictive model and tool (called CVEDrill) which revolutionizes CVE analysis and threat prioritization. CVEDrill accurately estimates the Common Vulnerability Scoring System (CVSS) vector for precise threat mitigation and priority ranking. It seamlessly automates the classification of CVEs into the appropriate Common Weaknession (CWE) hierarchy classes.
  arXiv  Detail & Related papers  (2023-09-06T14:34:03Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.