Analyze CVSS, CWE, and CPE Data With Python

Export JSON from the NVD CVE Scraper and keep the source-shaped table unchanged. Analysis should happen in a copy so arrays, nulls, and identifiers remain available for audit.

import pandas as pd

df = pd.read_json("dataset_items.json")
df["published"] = pd.to_datetime(df["published"], utc=True, errors="coerce")\ncwes = df.explode("cwe_ids")\nsummary = cwes.groupby(["severity", "cwe_ids"]).size().sort_values(ascending=False)
print(summary if "summary" in locals() else wide.head())

Audit before charting

First check duplicate cve_id values, missing dates, null numeric values, and unexpected units. Print a few rows from every transformation. An attractive chart can still be wrong because an array was counted as text or a missing observation became zero.

CVSS is technical severity, not your business risk. Join results to an asset inventory and consider exposure, exploit status, ownership, and compensating controls before opening remediation tickets.

When exploding arrays, keep the original row count nearby. An exploded table counts relationships, not source records. When pivoting, verify that the proposed index is unique; otherwise pivot_table will aggregate duplicates without asking what they mean.

Make comparisons honest

Use explicit denominators and label the time period. For a monitoring dataset, separate newly collected records from older records modified during the window. For numeric series, compare compatible definitions and units. For categorical counts, include an "unknown" bucket rather than dropping missing values.

Save the notebook, Actor input, dataset ID, and collection timestamp together. That small bundle is enough to reproduce the result later, which matters more than adding another visualization.