Improve EPSS Importer and Getting EPSS history data
維護者通常 1 天內回覆
還沒有人認領這個 Issue。
評估
研究方向
Start with the EPSS importer and the AdvisoryDataV2/VulnerabilitySeverity flow described here, then review PR #2433 and the historical daily dataset format. Define a bulk-import and time-series representation that avoids one advisory per CVE per day, and validate it against the stated multi-year history and import-time constraints.
由索引模型根據 Issue 內容生成。
描述
EPSS is currently represented as a VulnerabilitySeverity associated with an AdvisoryDataV2.
The importer creates one advisory for each CVE and stores the EPSS score and percentile as a vulnerability severity.
The current importer fetches the latest EPSS dataset for a single day, for example: epss_scores-2026-09-14.csv.gz, The pipeline then processes the entire dataset and creates a large number of advisory records. A single EPSS import currently takes approximately 3–12 hours.
This becomes a major problem when trying to import the complete EPSS history. The EPSS project provides historical daily datasets covering multiple years.
With approximately 2,190 daily files for roughly 6 years of history:
~365 days × 6 years = ~2,190 files
At an average of ~3 hours per import:
2,190 × 3 = 6,570 hours
6,570 / 24 = 273.75 days
Therefore, importing the complete history through the existing pipeline is not practical without implementing some form of bulk creation.
see:
There is also a second problem:
- importing every historical file through the normal AdvisoryDataV2 workflow would generate a very large number of advisory records, even though EPSS is fundamentally time-series data where the score for a CVE changes over time.
I think we need a better way to handle EPSS data.
- 主要語言
- Python
- 星號
- 716
- 分支
- 347
- 平均合併
- 12 小時 15 分鐘
- 30 天內合併 PR
- 9
環境準備
- 提供 Dockerfile 或 Docker Compose 檔案
- 沒有 Pull Request 範本
- 沒有貢獻指南
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
aboutcode-org/vulnerablecode 的其他 Issue
-
OSV parser drops all crates.io affected entries because the ecosystem mapping uses cargo可能已有人在做 @Ashutosh-Panda2004 於 2 天前認領。 未關閉
難度 2/5 1-3 小時 新手友好度 76/100
aboutcode-org/vulnerablecode#2485 · 1 則留言 ·
維護者通常 1 天內回覆
-
Docker Compose setup fails on wait-for-it host web:8000 and missing runtime .env可能已有人在做 @Anurag-S1ngh 於 5 天前認領。 未關閉
難度 2/5 半天 新手友好度 77/100
aboutcode-org/vulnerablecode#2477 · 1 則留言 ·
維護者通常 1 天內回覆
-
OVAL parser corrupts version bounds when the epoch is 10, 20 or the version contains "0:"可能已有人在做 關聯的 PR 仍在進行中或已合併。 未關閉
難度 2/5 1-3 小時 新手友好度 76/100
aboutcode-org/vulnerablecode#2474 · 1 則留言 ·
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 86/100
aboutcode-org/vulnerablecode#2426 ·
維護者通常 1 天內回覆
-
Get NuGet package versions from federated PURL version data in https://github.com/aboutcode-data/可能重新可做 @Anshi321 於 24 天前認領，目前沒有進行中的 PR。 未關閉bug data-quality
難度 2/5 1-3 小時 新手友好度 72/100
aboutcode-org/vulnerablecode#2418 · 4 則留言 ·
維護者通常 1 天內回覆
查看 aboutcode-org/vulnerablecode 的全部 Issue
相似的 Issue
-
難度 2/5 1-3 小時 新手友好度 76/100
Graphify-Labs/graphify#4860 · 1 則留言 ·
維護者通常 1 天內回覆
-
:bug: Bug
難度 2/5 1-3 小時 新手友好度 84/100
scikit-image/scikit-image#8377 ·
維護者通常 1 天內回覆
-
Ingredient import validation accepts negative nutrient values and NaN可能已有人在做 @LukeSekai 今天認領。 未關閉
難度 2/5 1-3 小時 新手友好度 82/100
wger-project/wger#2564 ·
維護者通常 2 天內回覆
-
難度 2/5 1-3 小時 新手友好度 68/100
apache/ponymail-foal#351 ·
-
難度 1/5 1 小時以內 新手友好度 68/100
維護者通常 4 天內回覆