An Ensemble Transformer Approach with Cross-Attention for Automated Code Security Vulnerability Detection and Documentation

Java vulnerability detection remains challenging due to the lack of standardized benchmarks and the complexity of framework interactions that introduce unique security risks compared to C/C++. We introduce a new Java vulnerability benchmark dataset combining the Juliet Test Suite, OWASP Benchmarks, and GitHub repositories, and develop a multi-model transformer framework that freezes pre-trained CodeBERT, GraphCodeBERT, and CodeT5 models, fusing their represen-tations via cross-attention. Our ensemble achieves near-perfect type classification (99.73 %) and 93.46 % detection accuracy on the Java dataset while remaining competitive on PRIMEVUL for C/C++ (89.58% accuracy) without extensive fine-tuning. This work advances vulnerability detection by: (1) creating a comprehensive Java vulnerability benchmark, (2) demonstrating that frozen pre-trained models can achieve strong results through cross-attention fusion, and (3) automating CWE-aligned security documentation to guide developers in remediation, demonstrating a practical and resource-efficient approach to vulnerability detection across languages.