Fragmentation of CVSS Scores in the NVD: A Quantitative Analysis of Inconsistency Across Vulnerability Scoring Standards

This dataset contains vulnerability records from the National Vulnerability Database (NVD), retrieved via the NVD API 2.0 in October 2025. It accompanies the paper "Fragmentation of CVSS Scores in the NVD: A Quantitative Analysis of Inconsistency Across Vulnerability Scoring Standards."

The dataset comprises 24 yearly JSON files (nvdcve-2.0-{year}.json, years 2002–2025) plus two supplementary feeds (modified, recent), covering over 270,000 CVE entries. Each record includes the CVE identifier, textual descriptions, references, and, where available, CVSS metrics across multiple scoring standard versions: CVSS v2.0, v3.0, v3.1, and v4.0. The data preserves the original NVD API 2.0 JSON schema, with no modifications to the source records.

In addition to the raw JSON files, the dataset includes pre-extracted tabular summaries in TSV format:
- scores_cvss20.tsv, scores_cvss30.tsv, scores_cvss31.tsv, scores_cvss40.tsv - base scores per CVE for each CVSS version (~190k, ~54k, ~179k, and ~14k records, respectively);
- severity_all.tsv - aggregated severity-level counts (None/Low/Medium/High/Critical) across all four CVSS versions;
- severity_changes_detailed.tsv - per-CVE severity category comparison across CVSS versions, with change pattern annotations;
- severity_changes_summary.txt and severity_changes_by_pattern.txt - summary statistics of severity migration patterns between CVSS versions;
- cvss_30_31_vector_differences.txt - detailed comparison of CVSS v3.0 vs. v3.1 vector strings for CVEs scored under both versions (11,114 CVEs; 52.6% with differing vectors);
- year_counts.tsv - annual CVE publication counts (1988–2025).

The dataset enables reproducibility of all quantitative analyses presented in the paper, including cross-version score distribution comparisons, severity category migration analysis, and CVSS vector-level discrepancy assessment.