mlsanityData to 7 Oct 2026

A Manually-Curated Dataset of Fixes to Vulnerabilities of Open-Source Software

arXiv 1902.02595 ↗First posted 7 Feb 2019cs.SE cs.CR cs.LGcited by 28

Not on the map. Why?

Abstract (arXiv)

Advancing our understanding of software vulnerabilities, automating their identification, the analysis of their impact, and ultimately their mitigation is necessary to enable the development of software that is more secure. While operating a vulnerability assessment tool that we developed and that is currently used by hundreds of development units at SAP, we manually collected and curated a dataset of vulnerabilities of open-source software and the commits fixing them. The data was obtained both from the National Vulnerability Database (NVD) and from project-specific Web resources that we monitor on a continuous basis. From that data, we extracted a dataset that maps 624 publicly disclosed vulnerabilities affecting 205 distinct open-source Java projects, used in SAP products or internal tools, onto the 1282 commits that fix them. Out of 624 vulnerabilities, 29 do not have a CVE identifier at all and 46, which do have a CVE identifier assigned by a numbering authority, are not available in the NVD yet. The dataset is released under an open-source license, together with supporting scripts that allow researchers to automatically retrieve the actual content of the commits from the corresponding repositories and to augment the attributes available for each instance. Also, these scripts allow to complement the dataset with additional instances that are not security fixes (which is useful, for example, in machine learning applications). Our dataset has been successfully used to train classifiers that could automatically identify security-relevant commits in code repositories. The release of this dataset and the supporting code as open-source will allow future research to be based on data of industrial relevance; also, it represents a concrete step towards making the maintenance of this dataset a shared effort involving open-source communities, academia, and the industry.

Key facts. Cited by 28 papers in the map (data through 7 Oct 2026). First posted on arXiv 7 Feb 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 8; 2022: 1; 2023: 6; 2024: 2; 2025: 7; 2026: 4.

28 papers.

Sort:

By area:

  1. 2021CVEfixes: Automated Collection of Vulnerabilities and Their Fixes from Open-Source Softwarecited by 89
  2. 2023LLMSecEval: A Dataset of Natural Language Prompts for Security Evaluationscited by 58
  3. 2023How Effective Are Neural Networks for Fixing Security Vulnerabilitiescited by 50
  4. 2025LLMs in Software Security: A Survey of Vulnerability Detection Techniques and Insightscited by 44
  5. 2024Finetuning Large Language Models for Vulnerability Detectioncited by 39
  6. 2021Neural Transfer Learning for Repairing Security Vulnerabilities in C Codecited by 36
  7. 2023Uncovering the Limits of Machine Learning for Automatic Vulnerability Detectioncited by 30
  8. 2021A Survey on Machine Learning Techniques for Source Code Analysiscited by 23
  9. 2025Large Language Model (LLM) for Software Security: Code Analysis, Malware Analysis, Reverse Engineeringcited by 15
  10. 2023Enhancing Large Language Models for Secure Code Generation: A Dataset-driven Study on Vulnerability Mitigationcited by 14
  11. 2021DeepCVA: Automated Commit-level Vulnerability Assessment with Deep Multi-task Learningcited by 11
  12. 2025Vulnerability Detection: From Formal Verification to Large Language Models and Hybrid Approaches: A Comprehensive Overviewcited by 7
16 more
  1. 2022On the Use of Fine-grained Vulnerable Code Statements for Software Vulnerability Assessment Modelscited by 5
  2. 2025PredicateFix: Repairing Static Analysis Alerts with Bridging Predicatescited by 5
  3. 2025VADER: A Human-Evaluated Benchmark for Vulnerability Assessment, Detection, Explanation, and Remediationcited by 5
  4. 2026Sifting the Noise: A Comparative Study of LLM Agents in Vulnerability False Positive Filteringcited by 5
  5. 2023Multi-Granularity Detector for Vulnerability Fixescited by 4
  6. 2021Few-Sample Named Entity Recognition for Security Vulnerability Reports by Fine-Tuning Pre-Trained Language Modelscited by 3
  7. 2021Early Detection of Security-Relevant Bug Reports using Machine Learning: How Far Are We?cited by 2
  8. 2021Automated Mapping of Vulnerability Advisories onto their Fix Commits in Open Source Repositoriescited by 1
  9. 2024On the Effectiveness of Machine Learning-based Call Graph Pruning: An Empirical Studycited by 1
  10. 2025Large Language Models Cannot Reliably Detect Vulnerabilities in JavaScript: The First Systematic Benchmark and Evaluationcited by 1
  11. 2021Detecting Security Fixes in Open-Source Repositories using Static Code Analyzerscited by 0
  12. 2023Sequential Graph Neural Networks for Source Code Vulnerability Identificationcited by 0
  13. 2025Today's Cat Is Tomorrow's Dog: Accounting for Time-Based Changes in the Labels of ML Vulnerability Detection Approachescited by 0
  14. 2026Enhancing Continual Learning for Software Vulnerability Prediction: Addressing Catastrophic Forgetting via Hybrid-Confidence-Aware Selective Replay for Temporal LLM Fine-Tuningcited by 0
  15. 2026A Comprehensive Evaluation of Code Language Models for Security Patch Detectioncited by 0
  16. 2026Benchmarking Mythos-Linked Bug Rediscoverycited by 0