{"id":"https://openalex.org/W7169550202","doi":"https://doi.org/10.48550/arxiv.2607.14900","title":"The Distributed Open-Source Vulnerability Ecosystem","display_name":"The Distributed Open-Source Vulnerability Ecosystem","publication_year":2026,"publication_date":"2026-07-16","ids":{"openalex":"https://openalex.org/W7169550202","doi":"https://doi.org/10.48550/arxiv.2607.14900"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2607.14900","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.14900","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2607.14900","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5141063960","display_name":"Peter Mandl","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Mandl, Peter","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5103846460","display_name":"Paul Mandl","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Mandl, Paul","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.6984999775886536,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.6984999775886536,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.0722000002861023,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.06480000168085098,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/vulnerability-management","display_name":"Vulnerability management","score":0.8312000036239624},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.8019999861717224},{"id":"https://openalex.org/keywords/vulnerability-assessment","display_name":"Vulnerability assessment","score":0.6664999723434448},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.4422000050544739},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.43939998745918274},{"id":"https://openalex.org/keywords/standardization","display_name":"Standardization","score":0.4219000041484833},{"id":"https://openalex.org/keywords/task","display_name":"Task (project management)","score":0.40220001339912415},{"id":"https://openalex.org/keywords/conceptual-framework","display_name":"Conceptual framework","score":0.3702999949455261}],"concepts":[{"id":"https://openalex.org/C172776598","wikidata":"https://www.wikidata.org/wiki/Q7943570","display_name":"Vulnerability management","level":4,"score":0.8312000036239624},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.8019999861717224},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.6664999723434448},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6018999814987183},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.4422000050544739},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.43939998745918274},{"id":"https://openalex.org/C188087704","wikidata":"https://www.wikidata.org/wiki/Q369577","display_name":"Standardization","level":2,"score":0.4219000041484833},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.40220001339912415},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.392300009727478},{"id":"https://openalex.org/C14224292","wikidata":"https://www.wikidata.org/wiki/Q13600188","display_name":"Conceptual framework","level":2,"score":0.3702999949455261},{"id":"https://openalex.org/C180198813","wikidata":"https://www.wikidata.org/wiki/Q121182","display_name":"Information system","level":2,"score":0.35499998927116394},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.35350000858306885},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.353300005197525},{"id":"https://openalex.org/C189693848","wikidata":"https://www.wikidata.org/wiki/Q6031064","display_name":"Information exchange","level":2,"score":0.3398999869823456},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3391999900341034},{"id":"https://openalex.org/C2778355321","wikidata":"https://www.wikidata.org/wiki/Q17079427","display_name":"Identity (music)","level":2,"score":0.33149999380111694},{"id":"https://openalex.org/C107826830","wikidata":"https://www.wikidata.org/wiki/Q929380","display_name":"Environmental resource management","level":1,"score":0.32989999651908875},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.3292999863624573},{"id":"https://openalex.org/C195094911","wikidata":"https://www.wikidata.org/wiki/Q14167904","display_name":"Process management","level":1,"score":0.31060001254081726},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.3043000102043152},{"id":"https://openalex.org/C529173508","wikidata":"https://www.wikidata.org/wiki/Q638608","display_name":"Software development","level":3,"score":0.29760000109672546},{"id":"https://openalex.org/C13606891","wikidata":"https://www.wikidata.org/wiki/Q2623243","display_name":"Conceptual model","level":2,"score":0.2777999937534332},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.27000001072883606},{"id":"https://openalex.org/C128487930","wikidata":"https://www.wikidata.org/wiki/Q579488","display_name":"Information management","level":2,"score":0.25609999895095825},{"id":"https://openalex.org/C87868495","wikidata":"https://www.wikidata.org/wiki/Q750843","display_name":"Information processing","level":2,"score":0.2515000104904175}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2607.14900","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.14900","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2607.14900","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.14900","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.516628086566925,"id":"https://metadata.un.org/sdg/15","display_name":"Life in Land"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Identifying":[0],"known":[1],"software":[2,9,33],"vulnerabilities":[3],"is":[4,19],"a":[5,62,70],"central":[6],"task":[7],"in":[8,133],"supply":[10],"chain":[11],"security":[12],"management.":[13],"Although":[14],"publicly":[15],"available":[16],"vulnerability":[17,25,57,67,80,131],"information":[18,74,81,96],"based":[20],"on":[21],"shared":[22],"standards,":[23],"different":[24],"scanners":[26],"often":[27],"report":[28],"divergent":[29,98],"results":[30],"for":[31,120],"identical":[32],"inventories.":[34],"These":[35],"differences":[36],"do":[37],"not":[38],"arise":[39],"solely":[40],"from":[41,82],"individual":[42],"data":[43],"sources":[44],"or":[45],"scanner":[46,113],"implementations.":[47],"They":[48],"can":[49],"emerge":[50],"at":[51],"several":[52],"stages":[53],"of":[54,73,111],"the":[55,118],"open-source":[56],"ecosystem.":[58],"This":[59],"paper":[60],"presents":[61],"conceptual":[63],"framework":[64],"that":[65],"describes":[66],"management":[68],"as":[69,108],"distributed":[71],"process":[72],"exchange":[75],"and":[76,85,100,105,128],"transformation.":[77],"It":[78,115],"traces":[79],"its":[83],"creation":[84],"standardization":[86],"through":[87],"enrichment":[88],"to":[89],"context-dependent":[90,106],"interpretation.":[91],"The":[92],"analysis":[93,122],"identifies":[94],"heterogeneous":[95],"sources,":[97],"identity":[99],"version":[101],"models,":[102],"temporal":[103],"change,":[104],"assessment":[107],"major":[109],"causes":[110],"inconsistent":[112],"findings.":[114],"then":[116],"discusses":[117],"implications":[119],"interpreting":[121],"results,":[123],"designing":[124],"reproducible":[125],"evaluation":[126],"methods,":[127],"handling":[129],"dynamic":[130],"knowledge":[132],"practice.":[134]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-07-18T00:00:00"}