一句话：针对 NVD 中 CVE 版本信息不可靠的问题，概述基于 SZZ 评估受漏洞影响软件版本的工作。
NVD 公开披露的漏洞会被分配 CVE ID 并关联到具体软件版本，许多 IT 公司和政府等组织依赖这些信息来评估自身安全风险。然而，NVD 中受影响软件版本信息并不总是可靠。Nguyen et al. 发现许多 CVE 漏洞的版本信息是虚假的，并提出一种基于原始 SZZ 算法（用于识别引入 bug 的提交）的方法，来评估哪些软件版本受 CVE 漏洞影响。论文标题 V-SZZ 指向这一方向，但给定摘要没有进一步说明 V-SZZ 的具体技术细节、实验设置或评估结果，因此本文速览仅能概括问题背景与已有 SZZ 方法思路。
Vulnerabilities publicly disclosed in the National Vulnerability Database (NVD) are assigned with CVE (Common Vulnerabilities and Exposures) IDs and associated with specific software versions. Many organizations, including IT companies and government, heavily rely on the disclosed vulnerabilities in NVD to mitigate their security risks. Once a software is claimed as vulnerable by NVD, these organizations would examine the presence of the vulnerable versions of the software and assess the impact on themselves. However, the version information about vulnerable software in NVD is not always reliable. Nguyen et al. find that the version information of many CVE vulnerabilities is spurious and propose an approach based on the original SZZ algorithm (i.e., an approach to identify bug-introducing commits) to assess the software versions affected by CVE vulnerabilities.