{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:XB2OUHNYFLKG6ZJLEMZ4VJ4FEH","short_pith_number":"pith:XB2OUHNY","canonical_record":{"source":{"id":"2508.13644","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-08-19T08:54:58Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"018ff3c184f7606b708dc32fe774ef1ecf04cb948af844002c65d70d1f64b3aa","abstract_canon_sha256":"38e68752b99df0ce29069d32d55054d556b0ac84949106d926173ab7e8cad133"},"schema_version":"1.0"},"canonical_sha256":"b874ea1db82ad46f652b2333caa78521dea835519c502933c9686039957e5b64","source":{"kind":"arxiv","id":"2508.13644","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2508.13644","created_at":"2026-07-05T11:55:51Z"},{"alias_kind":"arxiv_version","alias_value":"2508.13644v1","created_at":"2026-07-05T11:55:51Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2508.13644","created_at":"2026-07-05T11:55:51Z"},{"alias_kind":"pith_short_12","alias_value":"XB2OUHNYFLKG","created_at":"2026-07-05T11:55:51Z"},{"alias_kind":"pith_short_16","alias_value":"XB2OUHNYFLKG6ZJL","created_at":"2026-07-05T11:55:51Z"},{"alias_kind":"pith_short_8","alias_value":"XB2OUHNY","created_at":"2026-07-05T11:55:51Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:XB2OUHNYFLKG6ZJLEMZ4VJ4FEH","target":"record","payload":{"canonical_record":{"source":{"id":"2508.13644","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-08-19T08:54:58Z","cross_cats_sorted":["cs.SE"],"title_canon_sha256":"018ff3c184f7606b708dc32fe774ef1ecf04cb948af844002c65d70d1f64b3aa","abstract_canon_sha256":"38e68752b99df0ce29069d32d55054d556b0ac84949106d926173ab7e8cad133"},"schema_version":"1.0"},"canonical_sha256":"b874ea1db82ad46f652b2333caa78521dea835519c502933c9686039957e5b64","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:55:51.710875Z","signature_b64":"+HVO9/cyeVuYiQQbI6WXn5kklP96SKmsHMihE2UKA2n55YlQuGjVrnPZTOTaAgGUABJuPDgDPhfHxzC+RJVXAw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"b874ea1db82ad46f652b2333caa78521dea835519c502933c9686039957e5b64","last_reissued_at":"2026-07-05T11:55:51.710382Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:55:51.710382Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2508.13644","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:55:51Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"GomRxK0t2GBfw281QINs8+yJUhzD3q2ABiIn056OUSP3Hx6Ahdz+qwO8+u5HbgM40to2LidW0uLOviHHehi4AQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-06T22:53:41.518519Z"},"content_sha256":"80c9d3034f364b17f2d4440123f85cdb4f3a7a3aafed2b317592e3247834f4e9","schema_version":"1.0","event_id":"sha256:80c9d3034f364b17f2d4440123f85cdb4f3a7a3aafed2b317592e3247834f4e9"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:XB2OUHNYFLKG6ZJLEMZ4VJ4FEH","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Conflicting Scores, Confusing Signals: An Empirical Study of Vulnerability Scoring Systems","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.SE"],"primary_cat":"cs.CR","authors_text":"Ahmet Okutan, Mark Nelson, Mehdi Mirakhorli, Robert Falso, Viktoria Koscinski","submitted_at":"2025-08-19T08:54:58Z","abstract_excerpt":"Accurately assessing software vulnerabilities is essential for effective prioritization and remediation. While various scoring systems exist to support this task, their differing goals, methodologies and outputs often lead to inconsistent prioritization decisions. This work provides the first large-scale, outcome-linked empirical comparison of four publicly available vulnerability scoring systems: the Common Vulnerability Scoring System (CVSS), the Stakeholder-Specific Vulnerability Categorization (SSVC), the Exploit Prediction Scoring System (EPSS), and the Exploitability Index. We use a data"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2508.13644","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2508.13644/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:55:51Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"/4O01rn7gbrrFaPGlM71ogvoEyiHTLb0z5DDBaEUrdk12Fxw7FkTX59APGlt7ofKx43nK6U4H2wnxeXRXNIyCw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-06T22:53:41.519104Z"},"content_sha256":"6185ea4cccdfa05a0f437d3c56f45a141df3fc9cce54212abd75767c2d308135","schema_version":"1.0","event_id":"sha256:6185ea4cccdfa05a0f437d3c56f45a141df3fc9cce54212abd75767c2d308135"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/XB2OUHNYFLKG6ZJLEMZ4VJ4FEH/bundle.json","state_url":"https://pith.science/pith/XB2OUHNYFLKG6ZJLEMZ4VJ4FEH/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/XB2OUHNYFLKG6ZJLEMZ4VJ4FEH/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-06T22:53:41Z","links":{"resolver":"https://pith.science/pith/XB2OUHNYFLKG6ZJLEMZ4VJ4FEH","bundle":"https://pith.science/pith/XB2OUHNYFLKG6ZJLEMZ4VJ4FEH/bundle.json","state":"https://pith.science/pith/XB2OUHNYFLKG6ZJLEMZ4VJ4FEH/state.json","well_known_bundle":"https://pith.science/.well-known/pith/XB2OUHNYFLKG6ZJLEMZ4VJ4FEH/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:XB2OUHNYFLKG6ZJLEMZ4VJ4FEH","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"38e68752b99df0ce29069d32d55054d556b0ac84949106d926173ab7e8cad133","cross_cats_sorted":["cs.SE"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-08-19T08:54:58Z","title_canon_sha256":"018ff3c184f7606b708dc32fe774ef1ecf04cb948af844002c65d70d1f64b3aa"},"schema_version":"1.0","source":{"id":"2508.13644","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2508.13644","created_at":"2026-07-05T11:55:51Z"},{"alias_kind":"arxiv_version","alias_value":"2508.13644v1","created_at":"2026-07-05T11:55:51Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2508.13644","created_at":"2026-07-05T11:55:51Z"},{"alias_kind":"pith_short_12","alias_value":"XB2OUHNYFLKG","created_at":"2026-07-05T11:55:51Z"},{"alias_kind":"pith_short_16","alias_value":"XB2OUHNYFLKG6ZJL","created_at":"2026-07-05T11:55:51Z"},{"alias_kind":"pith_short_8","alias_value":"XB2OUHNY","created_at":"2026-07-05T11:55:51Z"}],"graph_snapshots":[{"event_id":"sha256:6185ea4cccdfa05a0f437d3c56f45a141df3fc9cce54212abd75767c2d308135","target":"graph","created_at":"2026-07-05T11:55:51Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2508.13644/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Accurately assessing software vulnerabilities is essential for effective prioritization and remediation. While various scoring systems exist to support this task, their differing goals, methodologies and outputs often lead to inconsistent prioritization decisions. This work provides the first large-scale, outcome-linked empirical comparison of four publicly available vulnerability scoring systems: the Common Vulnerability Scoring System (CVSS), the Stakeholder-Specific Vulnerability Categorization (SSVC), the Exploit Prediction Scoring System (EPSS), and the Exploitability Index. We use a data","authors_text":"Ahmet Okutan, Mark Nelson, Mehdi Mirakhorli, Robert Falso, Viktoria Koscinski","cross_cats":["cs.SE"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-08-19T08:54:58Z","title":"Conflicting Scores, Confusing Signals: An Empirical Study of Vulnerability Scoring Systems"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2508.13644","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:80c9d3034f364b17f2d4440123f85cdb4f3a7a3aafed2b317592e3247834f4e9","target":"record","created_at":"2026-07-05T11:55:51Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"38e68752b99df0ce29069d32d55054d556b0ac84949106d926173ab7e8cad133","cross_cats_sorted":["cs.SE"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-08-19T08:54:58Z","title_canon_sha256":"018ff3c184f7606b708dc32fe774ef1ecf04cb948af844002c65d70d1f64b3aa"},"schema_version":"1.0","source":{"id":"2508.13644","kind":"arxiv","version":1}},"canonical_sha256":"b874ea1db82ad46f652b2333caa78521dea835519c502933c9686039957e5b64","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"b874ea1db82ad46f652b2333caa78521dea835519c502933c9686039957e5b64","first_computed_at":"2026-07-05T11:55:51.710382Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:55:51.710382Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"+HVO9/cyeVuYiQQbI6WXn5kklP96SKmsHMihE2UKA2n55YlQuGjVrnPZTOTaAgGUABJuPDgDPhfHxzC+RJVXAw==","signature_status":"signed_v1","signed_at":"2026-07-05T11:55:51.710875Z","signed_message":"canonical_sha256_bytes"},"source_id":"2508.13644","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:80c9d3034f364b17f2d4440123f85cdb4f3a7a3aafed2b317592e3247834f4e9","sha256:6185ea4cccdfa05a0f437d3c56f45a141df3fc9cce54212abd75767c2d308135"],"state_sha256":"5a7fbfeee75560e4ba4d9fc844bd566880709ab2e4cd84af3d246153d630de40"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"yHJoN8nIwZuwUAmuUBmiZep58iV5Kyra+jX1xy8/v99N1f6UL0ueSMeAsFvjekz+wf1FuCQHbTUN3yDupVcvCA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-06T22:53:41.524521Z","bundle_sha256":"cb71987f6bc065db7f64c5d7a05607e65a7ee90709fed6f2ecc5d0e8a26e6e6b"}}