The Common Vulnerabilities and Exposures (CVE) system is crucial
for cybersecurity, providing standardized identification of vulnerabilities. In February 2024, the National Vulnerability Database
(NVD) announced it could no longer enrich new CVEs due to increasing volumes, significantly impacting global security efforts.
This paper introduces VulnScopper, an innovative approach to
automate and enhance vulnerability enrichment using Graph Neural Networks (GNNs). VulnScopper combines Knowledge Graphs
(KG) with Natural Language Processing (NLP) by leveraging ULTRA, a GNN-based knowledge graph foundation model, alongside
a Large Language Model (LLM). VulnScopper’s inductive approach
enables it to handle unseen entities, overcoming a crucial limitation
of previous CVE enrichment methods.
We evaluate VulnScopper on the NVD dataset in inductive and transductive setups for CVE to Common Platform Enumerations
(CPE) linking. Our results show that VulnScopper outperforms state-of-the-art techniques, achieving up to 60% Hits@10 accuracy
in linking CVEs to CPE on unseen CVE records. We demonstrate VulnScopper’s effectiveness on unseen 2023 CVEs, showcasing its
ability to uncover new vulnerable products and potentially reduce
vulnerability remediation time.