GitHub Engagement Signals for CVE Prioritization: The GitHub Popularity Metric (GPM)

arXiv:2609.31004 · cs.CR · Submitted 2026-09-25 · Read on arXiv

cs.CR

Submitted: 2026-09-25

Updated: 2026-09-25

Code: https://github.com/rapid7/metasploit-framework

Terminology

• GitHub Popularity Metric — 6× in this paper
• Actor — 5× in this paper · explained in 3 episodes
• F1 Score — 3× in this paper · explained in 3 episodes
• National Institute of Standards and Technology — 3× in this paper
• Verification — 3× in this paper · explained in 2 episodes
• Common Vulnerabilities and Exposures — 2× in this paper
• Common Vulnerability Scoring System — 2× in this paper
• Common Weakness Enumeration — 2× in this paper
• Selection Bias — 2× in this paper · explained in 4 episodes
• Stakeholder-Specific Vulnerability Categorization — 2× in this paper
• ACM Conference on Computer and Communications Security — 1× in this paper
• Consistency — 1× in this paper · explained in 3 episodes
• Contrastive Learning — 1× in this paper · explained in 5 episodes
• Core — 1× in this paper · explained in 2 episodes
• Cybersecurity and Infrastructure Security Agency — 1× in this paper
• Exploit Prediction Scoring System8 — 1× in this paper
• Generalization — 1× in this paper · explained in 13 episodes
• Heterogeneous Graph — 1× in this paper · explained in 2 episodes
• Hybrid Model — 1× in this paper · explained in 2 episodes
• Hybrid Models — 1× in this paper · explained in 2 episodes
• National Vulnerability Database3 — 1× in this paper

Sources

• Vulnerability Management Chaining: An Integrated Framework for Efficient Cybersecurity Risk Prioritization
• A Survey on Vulnerability Prioritization: Taxonomy, Metrics, and Research Challenges
• Analyzing the Perceived Severity of Cybersecurity Threats Reported on Social Media
• Evaluating the Performance of Twitter-based Exploit Detectors
• Conflicting Scores, Confusing Signals: An Empirical Study of Vulnerability Scoring Systems
• Predicting Missing Information of Key Aspects in Vulnerability Reports

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs