Cybersecurity Advances · Vol. 3 No. 1 (2026) · pp. 1–13
Queue Shock at Model Upgrades: A Longitudinal Audit of EPSS v2–v5 Rank Stability and Prioritization Workload
ATS PRESS Research Group
EPSS publishes daily probabilities and percentiles to help defenders prioritize vulnerabilities. This study measures how EPSS v2→v3, v3→v4, and v4→v5 transitions changed rankings, bounded priority sets, threshold classifications, and score coverage.
Cybersecurity Advances · Vol. 3 No. 1 (2026) · pp. 14–24
Beyond One-Hop Aliases: Measuring Identifier-Resolution Fragmentation in the OSV Vulnerability Graph Across Six Package Ecosystems
ATS PRESS Research Group
Open-source vulnerability records connect source-native identifiers through aliases. This study measures the difference between direct alias lists and transitive closure in a frozen, cross-ecosystem OSV snapshot.
Cybersecurity Advances · Vol. 3 No. 1 (2026) · pp. 25–35
Where Is the Fix? A Cross-Ecosystem Census of Machine-Actionable Remediation Endpoints in OSV
ATS PRESS Research Group
OSV records can describe affected versions with fixed, last_affected, limit, and enumerated-version representations. This study measures the availability and concentration of remediation endpoints across six package ecosystems.
Cybersecurity Advances · Vol. 3 No. 1 (2026) · pp. 36–45
Severity Without a Common Scale: A Cross-Ecosystem Census of Machine-Readable Severity Signals in OSV
ATS PRESS Research Group
Package-security tools need severity metadata they can parse consistently. This study measures the availability of quantitative severity arrays and local qualitative labels across package ecosystems.
Cybersecurity Advances · Vol. 3 No. 1 (2026) · pp. 46–58
Cross-Format Semantic Preservation in Vulnerability Exploitability Exchange: A Conformance and Round-Trip Benchmark of OpenVEX 0.2.0, CycloneDX 1.6, and CSAF 2.0
ATS PRESS Research Group
VEX formats encode overlapping semantics but differ in schema and surrounding data models. This controlled benchmark measures schema conformance and semantic retention across all six ordered translations among OpenVEX 0.2.0, CycloneDX 1.6, and CSAF 2.0.