Evaluating the NIST Bugs Framework Against CWE as a Successor for Automated Vulnerability Classification
The findings support the claim that BF is a more structured and automation-friendly framework than CWE, and exploration reveals specific gaps in BF, including under-specified guidance on attributes.