# A Look at the Time Delays in CVSS Vulnerability Scoring

arXiv: https://arxiv.org/abs/1801.00938 · HTML: https://mlsanity.com/paper/1801.00938/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 3 Jan 2018.

## Built on by (most cited first, 4 of 4)

- [Common Vulnerability Scoring System Prediction based on Open Source Intelligence Information Sources](https://mlsanity.com/paper/2210.02143/) (2022)
- [Perspectives on risk prioritization of data center vulnerabilities using rank aggregation and multi-objective optimization](https://mlsanity.com/paper/2202.07466/) (2022)
- [HAL 9000: a Risk Manager for ITSs](https://mlsanity.com/paper/2311.09449/) (2023)
- [A Risk Manager for Intrusion Tolerant Systems: Enhancing HAL 9000 with New Scoring and Data Sources](https://mlsanity.com/paper/2508.13364/) (2025)

## Abstract (arXiv)

This empirical paper examines the time delays that occur between the publication of Common Vulnerabilities and Exposures (CVEs) in the National Vulnerability Database (NVD) and the Common Vulnerability Scoring System (CVSS) information attached to published CVEs. According to the empirical results based on regularized regression analysis of over eighty thousand archived vulnerabilities, (i) the CVSS content does not statistically influence the time delays, which, however, (ii) are strongly affected by a decreasing annual trend. In addition to these results, the paper contributes to the empirical research tradition of software vulnerabilities by a couple of insights on misuses of statistical methodology.