Severity Without a Common Scale: A Cross-Ecosystem Census of Machine-Readable Severity Signals in OSV
Keywords:
OSV, CVSS, vulnerability metadata, software supply chain, package ecosystems, data qualityAbstract
Background: Package-security tools need severity metadata they can parse consistently. The Open Source Vulnerability (OSV) schema supports quantitative severity arrays at record and affected-package levels, while source databases can publish local qualitative labels. Their availability across package ecosystems has not been measured at scale.
References
1. OpenSSF Vulnerability Disclosures Working Group. Open Source Vulnerability format, schema v1.9.1. 2026. https://ossf.github.io/osv-schema/
2. Google Open Source Security Team. OSV: Open Source Vulnerabilities. https://osv.dev/
3. FIRST. Common Vulnerability Scoring System v2.0. https://www.first.org/cvss/v2/
4. FIRST. Common Vulnerability Scoring System v3.1: Specification Document. https://www.first.org/cvss/v3-1/specification-document
5. FIRST. Common Vulnerability Scoring System v4.0: Specification Document. https://www.first.org/cvss/v4-0/specification-document
6. Wunder J, Kurtz A, Eichenmüller C, Gassmann F, Benenson Z. Shedding Light on CVSS Scoring Inconsistencies: A User-Centric Study on Evaluating Widespread Security Vulnerabilities. IEEE Symposium on Security and Privacy. 2024. IEEE document 10646847; arXiv:2308.15259.
7. Croft R, Babar MA, Li L. An Investigation into Inconsistency of Software Vulnerability Severity across Data Sources. SANER. 2022. doi:10.1109/SANER53432.2022.00050.
8. Walkowski M, Nowak M, Balsam A, Nowak K, Oko J, Sujecki S. Fragmentation of CVSS scores in the NVD: A quantitative analysis of inconsistency across vulnerability scoring standards. Computers & Security. 2026;164:104978. doi:10.1016/j.cose.2026.104978.
9. Coutinho LS, Menasche D, Miranda L, Lovat E, Kumar SG, Ramchandran A, Kocheturov A, Limmer T. How Context Impacts Vulnerability Severity: An Analysis of Product-Specific CVSS Scores. Proceedings of LADC. 2024. doi:10.1145/3697090.3697109.
10. Allodi L, Massacci F. Comparing Vulnerability Severity and Exploits Using Case-Control Studies. ACM Transactions on Information and System Security. 2014;17(1). doi:10.1145/2630069.
11. Ruohonen J. A look at the time delays in CVSS vulnerability scoring. Applied Computing and Informatics. 2019;15(2):129–135. doi:10.1016/j.aci.2017.12.002.
12. Decan A, Mens T, Constantinou E. Detection, assessment and mitigation of vulnerabilities in open source dependencies. Empirical Software Engineering. 2021;26. doi:10.1007/s10664-020-09830-x.
13. National Institute of Standards and Technology. National Vulnerability Database. https://nvd.nist.gov/
14. Google Open Source Security Team. Announcing a unified vulnerability schema for open source. 24 June 2021. https://security.googleblog.com/2021/06/announcing-unified-vulnerability-schema.html
Downloads
Published
Issue
Section
License
Copyright (c) 2026 The author(s)
This work is licensed under a Creative Commons Attribution 4.0 International License.
AlphaTech Systems LLC publishes the version of record under the Creative Commons Attribution 4.0 International licence (CC BY 4.0), permitting sharing and adaptation for any purpose with appropriate attribution, a link to the licence, and an indication of changes. The public licence applies upon publication and is irrevocable for compliant users; submission alone does not license unpublished material.
