Narratives Mislead: An Empirical Study of How LLMs Misjudge CVSS Severity in Bug Bounty Reports

Reported by arXiv cs.CR (Ruitao Feng, Yuekang Li, Yao Zhang)

Summary by Cyber Security News20 Oct 2026, 06:00 CET

About this summary. This is a short excerpt from the description that arXiv cs.CR published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://arxiv.org/abs/2610.24623

arXiv:2610.24623v1 Announce Type: new Abstract: Bug bounty platforms receive vulnerability reports faster than vendors can triage them, and Large Language Models (LLMs) are increasingly considered for assigning the Common Vulnerability Scoring System (CVSS) severity that drives prioritization. Prior evaluations score short CVE descriptions and report accuracy, but deployment depends on how models err, not only how often.

Read the full article at arXiv cs.CR →

Source attribution: headline and facts are from arXiv cs.CR (arxiv.org). Summary method: excerpt of the source description. See our source attribution policy.