LLM-Ready CVE Severity Triage with CWE-Aware TF-IDF Features, Probability Calibration, and Evidence-Bound Explanations on 2025 NVD Data

Vulnerability triage requires severity information that is structured enough for automation, calibrated enough for risk-aware routing, and readable enough for analyst review. This study evaluates four-class CVSS v3.1 severity modeling on the NVD CVE-2025 JSON 2.0 feed using English CVE descriptions, CWE mappings, categorical CVSS vector fields, probability calibration, and an LLM-ready, evidence-bound explanation layer. The feed contained 44,920 CVE records; 39,992 records with a selected non-NONE CVSS v3.1 metric supported a chronological 70/15/15 split of 27,994 training, 5,999 validation, and 5,999 test records. Without CVSS vector tokens, the best early model, a CWE-aware LinearSVC over sparse TF-IDF features, achieved 0.642 accuracy and 0.509 macro-F1. Temperature scaling preserved its decisions while reducing expected calibration error from 0.108 to 0.021. In the vector-aware consistency condition, accuracy reached 0.820 and macro-F1 reached 0.699; Ridge regression reached 0.442 MAE and 0.871 R². Because the vector categories define the CVSS base score, these gains are interpreted as score-consistency validation rather than independent severity prediction. The constrained explanation layer produced 5,999 held-out rationales with complete inclusion of the required record fields. That coverage is a schema-consistency check, not a user study or a measure of explanation truthfulness. The findings support a human-in-the-loop workflow in which calibrated text-and-CWE models assist early triage, vector-aware models check scoring consistency, and evidence packets make each recommendation reviewable.

Keywords: CVE severity prediction; National Vulnerability Database; Common Weakness Enumeration; probability calibration; evidence-grounded explanations.