CVE Forecast is an enterprise-grade, self-improving forecasting platform that predicts Common Vulnerabilities and Exposures (CVEs) using advanced machine learning, statistical models, and automated hyperparameter optimization. The system provides actionable insights into future vulnerability disclosure trends through an intelligent, continuously-evolving pipeline with real-time accuracy tracking.

Version 0.10 "Phoenix" 🔥🐦 (October 2025): Complete architectural rebirth with unified pipeline, historical backtest validation, forecast accuracy tracking, modular codebase, and production-ready automation. The system now features real-world performance metrics, automated monthly tuning, and comprehensive documentation.

• 13 Optimized Models: Statistical (Prophet, ARIMA, TBATS), ML (XGBoost, LightGBM, CatBoost), and baseline models
• Real-World Validation: Historical backtest on 2025 data (Jan-Sep) with actual vs. predicted comparisons
• Accuracy Metrics: MAPE ranging from 6.22% (LightGBM) to 21.65% (Croston) on real 2025 data
• 120+ CNA Forecasts: Individual predictions for CVE Numbering Authorities with per-organization model selection
• Dynamic Forecasting: Automatically forecasts current incomplete month through end of next year

• Unified Pipeline: Single command (run_production_forecast.py) handles CVE + CNA forecasting
• Daily Updates: Automated GitHub Actions workflow generates fresh forecasts at midnight UTC
• Monthly Tuning: Separate workflow optimizes hyperparameters on the 1st of each month
• Forecast Tracking: Historical snapshot system tracks prediction evolution and accuracy over time
• Zero Downtime: Continuous deployment to GitHub Pages with automatic rollback on failure

• Forecast vs Published Table: Month-by-month comparison of predictions against actual CVE counts
• Model Rankings: Real-time performance leaderboard based on backtest MAPE
• Historical Tracking: forecast_history.json accumulates prediction snapshots for long-term analysis
• Performance Badges: Visual indicators (Excellent < 5%, Good < 10%, Fair < 20%, Poor > 20%)
• Detailed Metrics: MAE, MAPE, error percentages, and performance ratings for every model

• Modular Design: Clean separation between data loading, training, forecasting, and validation
• Base Classes: BaseForecaster and ValidationMixin provide extensible framework
• Adapters Pattern: CVEForecaster and CNAForecaster implement domain-specific logic
• Configuration-Driven: Centralized config.json with optimized hyperparameters
• Comprehensive Logging: Detailed execution logs with progress tracking and error reporting

Experience the full power of CVE Forecast on the live dashboard:

cveforecast.org

For a comprehensive understanding of the project's architecture, data processing pipeline, forecasting models, and deployment strategy, please refer to our detailed technical documentation:

Technical Details Page

• Python 3.10+
• 8GB+ RAM recommended
• CVE data repository (auto-cloned by pipeline)

1. Clone the repository:

   git clone https://github.com/[your-username]/CVEForecast.git
   cd CVEForecast

2. Install dependencies:

   pip install -r requirements.txt

3. Clone CVE data (required for forecasting):

   git clone --depth 1 https://github.com/CVEProject/cvelistV5.git

Option 1: Full Production Pipeline (Recommended)

python code/run_production_forecast.py

Generates:

• web/data.json - CVE forecasts and metrics
• web/cna_data.json - CNA forecasts
• web/forecast_history.json - Historical tracking
• web/pipeline_results.json - Execution summary

Option 2: CVE Forecasts Only

python code/adapters/cve_adapter.py

Option 3: CNA Forecasts Only

python code/adapters/cna_adapter.py

Local Dashboard:

# Simple HTTP server
python -m http.server 8000 --directory web

# Open browser to http://localhost:8000

Production: Visit cveforecast.org

Comprehensive documentation is available in the docs/ directory:

• Architecture Guide - System design, components, and data flow
• API Reference - Classes, methods, and configuration options
• Deployment Guide - GitHub Actions, hosting, and CI/CD
• Development Guide - Contributing, testing, and best practices
• Tuning Guide - Hyperparameter optimization workflows

Real-world accuracy on Jan-Sep 2025 data:

Full rankings available in the dashboard's "Model Performance Rankings" section.

Edit code/config.json to enable/disable models:

{
  "models": {
    "Prophet": {
      "enabled": true,
      "hyperparameters": { ... }
    }
  }
}

{
  "forecast_end_year": 2026
}

# Clone CVE data repository
git clone --depth 1 https://github.com/CVEProject/cvelistV5.git

# Check logs for specific model errors
# Disable problematic models in config.json

# Reduce number of enabled models
# Use CPU-only models (disable deep learning models)

# Update to v0.10
git pull origin main

# Install new dependencies
pip install -r requirements.txt

# Run new pipeline
python code/run_production_forecast.py