Insights
CNA scorecard
How well each CVE Numbering Authority fills the records it publishes, scored against a published set of rules: Describe, Scope, Assess, Act, 25 points each. Only what the assigner wrote itself counts; severity and weaknesses added later by an ADP are shown as a dependency, not as the assigner's work.
191
Ranked CNAs
160
Under the threshold
180 days
Rolling window
9
Grade A
A
99.19 · 37 records
A
96.35 · 294 records
A
95.73 · 11 records
A
95.51 · 85 records
A
95.0 · 29 records
A
93.03 · 127 records
A
91.84 · 34 records
A
91.51 · 21 records
A
91.12 · 57 records
| # | CNA | Grade | Score | Records | Badge |
|---|---|---|---|---|---|
| 1 | secur0 | A | 99.19 | 37 |
|
| 2 | eef | A | 96.35 | 294 |
|
| 3 | temporal | A | 95.73 | 11 |
|
| 4 | palo_alto | A | 95.51 | 85 |
|
| 5 | isc | A | 95.0 | 29 |
|
| 6 | amzn | A | 93.03 | 127 |
|
| 7 | netgear | A | 91.84 | 34 |
|
| 8 | checkmk | A | 91.51 | 21 |
|
| 9 | watchguard | A | 91.12 | 57 |
|
| 10 | autodesk | B | 89.9 | 29 |
|
| 11 | sonatype | B | 89.9 | 29 |
|
| 12 | docker | B | 89.85 | 15 |
|
| 13 | cert-in | B | 89.46 | 23 |
|
| 14 | wso2 | B | 88.89 | 45 |
|
| 15 | circl | B | 88.61 | 209 |
|
| 16 | fluid attacks | B | 88.55 | 60 |
|
| 17 | ibm | B | 87.65 | 1,047 |
|
| 18 | tplink | B | 87.25 | 91 |
|
| 19 | arista | B | 86.41 | 65 |
|
| 20 | incibe | B | 86.3 | 88 |
|
| 21 | kong | B | 84.9 | 16 |
|
| 22 | juniper | B | 84.8 | 49 |
|
| 23 | asustor1 | B | 84.8 | 11 |
|
| 24 | concretecms | B | 84.36 | 111 |
|
| 25 | harborist | B | 84.36 | 10 |
|
| 26 | silabs | B | 83.88 | 33 |
|
| 27 | vulncheck | B | 83.86 | 5,087 |
|
| 28 | dsf | B | 83.79 | 22 |
|
| 29 | ni | B | 83.69 | 33 |
|
| 30 | typo3 | B | 83.61 | 52 |
|
| 31 | gv | B | 83.54 | 77 |
|
| 32 | herodevs | B | 83.2 | 10 |
|
| 33 | lenovo | B | 83.12 | 40 |
|
| 34 | solarwinds | B | 83.07 | 23 |
|
| 35 | f5 | B | 83.03 | 76 |
|
| 36 | github_p | B | 82.72 | 26 |
|
| 37 | nlnet labs | B | 82.03 | 57 |
|
| 38 | bcorg | B | 81.99 | 42 |
|
| 39 | twcert | B | 81.87 | 91 |
|
| 40 | vuldb | B | 81.77 | 3,845 |
|
| 41 | microsoft | B | 81.54 | 2,680 |
|
| 42 | redhat | B | 81.48 | 893 |
|
| 43 | rti | B | 81.4 | 20 |
|
| 44 | nozomi | B | 81.0 | 60 |
|
| 45 | prjblk | B | 80.78 | 11 |
|
| 46 | cert-pl | B | 80.72 | 219 |
|
| 47 | sec-vlab | B | 80.5 | 23 |
|
| 48 | canonical | B | 80.34 | 106 |
|
| 49 | ncsc.ch | B | 80.21 | 64 |
|
| 50 | php | B | 80.1 | 25 |
|
| 51 | enisa | B | 79.65 | 34 |
|
| 52 | psf | B | 79.52 | 31 |
|
| 53 | mattermost | B | 79.5 | 115 |
|
| 54 | qnap | B | 79.27 | 26 |
|
| 55 | zabbix | B | 79.14 | 14 |
|
| 56 | suse | B | 79.08 | 96 |
|
| 57 | progresssoftware | B | 78.81 | 78 |
|
| 58 | deltaww | B | 78.74 | 23 |
|
| 59 | jci | B | 78.24 | 14 |
|
| 60 | openssl | B | 78.0 | 36 |
|
| 61 | cisa-cg | B | 77.93 | 54 |
|
| 62 | googlecloud | B | 77.3 | 27 |
|
| 63 | pandorafms | B | 77.0 | 13 |
|
| 64 | zephyr | B | 76.84 | 146 |
|
| 65 | fortra | B | 76.74 | 10 |
|
| 66 | hitachi | B | 76.3 | 14 |
|
| 67 | wolfssl | B | 76.09 | 69 |
|
| 68 | cyberdanube | B | 76.0 | 20 |
|
| 69 | fedora | B | 75.89 | 18 |
|
| 70 | rapid7 | B | 75.81 | 53 |
|
| 71 | apache | B | 75.76 | 815 |
|
| 72 | gen | B | 75.68 | 19 |
|
| 73 | certvde | B | 75.66 | 142 |
|
| 74 | acer | B | 75.18 | 49 |
|
| 75 | gitlab | B | 75.12 | 274 |
|
| 76 | jfrog | B | 75.03 | 60 |
|
| 77 | document fdn. | B | 75.0 | 15 |
|
| 78 | C | 74.87 | 30 |
|
|
| 79 | adobe | C | 74.74 | 680 |
|
| 80 | zuso art | C | 74.73 | 11 |
|
| 81 | icscert | C | 74.67 | 303 |
|
| 82 | altium | C | 74.67 | 12 |
|
| 83 | patchstack | C | 74.5 | 2,286 |
|
| 84 | tr-cert | C | 74.5 | 235 |
|
| 85 | rami.io | C | 74.36 | 27 |
|
| 86 | hp | C | 74.21 | 35 |
|
| 87 | glibc | C | 74.12 | 16 |
|
| 88 | securin | C | 73.89 | 53 |
|
| 89 | rockwell | C | 73.76 | 45 |
|
| 90 | runzero | C | 73.74 | 38 |
|
| 91 | openvpn | C | 73.5 | 23 |
|
| 92 | divd | C | 73.4 | 12 |
|
| 93 | zdi | C | 72.95 | 130 |
|
| 94 | pega | C | 72.9 | 10 |
|
| 95 | asus | C | 72.16 | 34 |
|
| 96 | joomla | C | 72.14 | 308 |
|
| 97 | tenable | C | 71.94 | 48 |
|
| 98 | fortinet | C | 71.78 | 72 |
|
| 99 | zohocorp | C | 71.69 | 52 |
|
| 100 | github_m | C | 71.59 | 7,696 |
|
| 101 | hdfg | C | 71.5 | 10 |
|
| 102 | wikimedia-foundation | C | 71.05 | 65 |
|
| 103 | eric | C | 70.66 | 13 |
|
| 104 | papercut | C | 70.42 | 12 |
|
| 105 | mongodb | C | 70.31 | 183 |
|
| 106 | hashicorp | C | 70.0 | 41 |
|
| 107 | okta | C | 70.0 | 22 |
|
| 108 | hiddenlayer | C | 70.0 | 16 |
|
| 109 | turansec | C | 69.75 | 189 |
|
| 110 | dell | C | 69.72 | 422 |
|
| 111 | foxit | C | 69.51 | 70 |
|
| 112 | oracle | C | 69.28 | 3,007 |
|
| 113 | elastic | C | 69.18 | 147 |
|
| 114 | incd | C | 69.18 | 11 |
|
| 115 | zte | C | 69.02 | 29 |
|
| 116 | grafana | C | 68.97 | 42 |
|
| 117 | hitachi energy | C | 68.48 | 12 |
|
| 118 | abb | C | 68.12 | 16 |
|
| 119 | zscaler | C | 67.9 | 10 |
|
| 120 | acronis | C | 67.8 | 12 |
|
| 121 | synology | C | 67.38 | 48 |
|
| 122 | postgresql | C | 66.78 | 80 |
|
| 123 | zyxel | C | 66.53 | 15 |
|
| 124 | cisco | C | 66.46 | 336 |
|
| 125 | checkpoint | C | 65.68 | 17 |
|
| 126 | snowflake | C | 65.5 | 20 |
|
| 127 | openjs | C | 65.27 | 104 |
|
| 128 | eclipse | C | 65.24 | 82 |
|
| 129 | schneider | C | 65.17 | 30 |
|
| 130 | esri | C | 65.11 | 22 |
|
| 131 | sap | C | 65.1 | 114 |
|
| 132 | wordfence | C | 65.0 | 2,072 |
|
| 133 | siemens | C | 65.0 | 71 |
|
| 134 | @huntr_ai | C | 65.0 | 49 |
|
| 135 | nvidia | C | 64.71 | 201 |
|
| 136 | hcl | C | 64.53 | 169 |
|
| 137 | cpansec | C | 64.22 | 262 |
|
| 138 | redhat-cnalr | C | 64.17 | 13 |
|
| 139 | vmware | C | 64.14 | 251 |
|
| 140 | jpcert | C | 63.78 | 175 |
|
| 141 | 3ds | C | 63.75 | 12 |
|
| 142 | samsung.tv_appliance | C | 63.23 | 60 |
|
| 143 | netscaler | C | 62.84 | 16 |
|
| 144 | amd | C | 62.78 | 74 |
|
| 145 | ivanti | C | 62.62 | 34 |
|
| 146 | talos | C | 62.07 | 12 |
|
| 147 | atlassian | C | 61.9 | 10 |
|
| 148 | qualcomm | C | 61.47 | 91 |
|
| 149 | zoom | C | 61.21 | 14 |
|
| 150 | openharmony | C | 60.8 | 10 |
|
| 151 | ox | C | 60.62 | 74 |
|
| 152 | commvault | C | 60.57 | 14 |
|
| 153 | gitea | C | 60.53 | 87 |
|
| 154 | snyk | C | 60.28 | 18 |
|
| 155 | intel | C | 60.0 | 97 |
|
| 156 | sn | C | 60.0 | 10 |
|
| 157 | freebsd | D | 59.8 | 56 |
|
| 158 | tanium | D | 59.4 | 40 |
|
| 159 | absolute | D | 58.96 | 25 |
|
| 160 | axis | D | 58.95 | 10 |
|
| 161 | hackerone | D | 58.61 | 183 |
|
| 162 | ubiquiti | D | 58.45 | 29 |
|
| 163 | huawei | D | 57.06 | 80 |
|
| 164 | jetbrains | D | 57.05 | 110 |
|
| 165 | xen | D | 57.0 | 38 |
|
| 166 | trendmicro | D | 57.0 | 16 |
|
| 167 | hpe | D | 55.32 | 186 |
|
| 168 | csa | D | 55.17 | 32 |
|
| 169 | imaginationtech | D | 54.91 | 32 |
|
| 170 | samsungmobile | D | 54.51 | 109 |
|
| 171 | arm | D | 54.09 | 11 |
|
| 172 | linux | D | 53.62 | 6,493 |
|
| 173 | sonicwall | D | 53.53 | 26 |
|
| 174 | drupal | D | 51.96 | 103 |
|
| 175 | meta | D | 51.5 | 10 |
|
| 176 | unisoc | D | 49.5 | 15 |
|
| 177 | curl | D | 49.44 | 35 |
|
| 178 | hikvision | D | 49.15 | 13 |
|
| 179 | mediatek | D | 45.0 | 73 |
|
| 180 | jenkins | E | 44.28 | 132 |
|
| 181 | devolutions | E | 44.13 | 51 |
|
| 182 | wpscan | E | 44.02 | 1,363 |
|
| 183 | chrome | E | 42.3 | 2,668 |
|
| 184 | certcc | E | 42.08 | 152 |
|
| 185 | go | E | 41.44 | 71 |
|
| 186 | google_android | E | 40.34 | 173 |
|
| 187 | nokia | E | 38.91 | 11 |
|
| 188 | google_devices | E | 37.75 | 138 |
|
| 189 | mozilla | E | 37.72 | 466 |
|
| 190 | apple | E | 36.82 | 633 |
|
| 191 | mitre | E | 26.67 | 2,343 |
|
Under the threshold (160)
Fewer than 10 publications in the window. The score is indicative and these are not ranked: three perfect records are not evidence of a practice.
| hackrtu | 100.0 | 4 records |
| nutanix | 96.8 | 1 record |
| tqtc | 95.14 | 7 records |
| illumos | 93.0 | 2 records |
| echo | 93.0 | 1 record |
| neo4j | 92.8 | 3 records |
| arcinfo | 91.8 | 2 records |
| fti | 91.8 | 2 records |
| ca | 91.8 | 1 record |
| qt | 91.25 | 8 records |
| rust | 90.5 | 2 records |
| moxa | 90.47 | 9 records |
| flexera | 90.3 | 2 records |
| cribl | 89.8 | 5 records |
| milestone | 89.8 | 1 record |
| roche | 89.8 | 1 record |
| strongdm | 89.8 | 1 record |
| vestel | 89.8 | 1 record |
| tigera | 89.0 | 6 records |
| checkmarx | 89.0 | 2 records |
| omicron | 88.47 | 3 records |
| schutzwerk | 88.0 | 4 records |
| crestron | 88.0 | 1 record |
| danfoss | 88.0 | 1 record |
| algosec | 87.0 | 1 record |
| bull | 86.8 | 1 record |
| hackrate | 86.63 | 6 records |
| delinea | 86.3 | 4 records |
| postiz | 85.5 | 4 records |
| microchip | 85.26 | 7 records |
| mitsubishi | 84.8 | 7 records |
| canon_emea | 84.8 | 2 records |
| nx | 84.8 | 2 records |
| asrg | 84.38 | 8 records |
| softing | 84.0 | 1 record |
| fermax | 83.55 | 4 records |
| libreswan | 83.5 | 4 records |
| netskope | 83.2 | 6 records |
| star_labs | 83.0 | 1 record |
| sra | 82.74 | 7 records |
| tcpdump | 82.57 | 7 records |
| ptc | 82.55 | 4 records |
| blackduck | 82.3 | 4 records |
| m-files corporation | 82.3 | 4 records |
| payara | 82.3 | 2 records |
| tha-psirt | 82.2 | 3 records |
| swi | 82.0 | 3 records |
| logitech | 82.0 | 1 record |
| wibu | 81.8 | 7 records |
| purestorage | 81.5 | 2 records |
| altera | 80.88 | 8 records |
| opennms | 80.4 | 5 records |
| tlt_net | 80.0 | 3 records |
| nintendo | 80.0 | 1 record |
| vaadin | 80.0 | 1 record |
| extremenetworks | 79.87 | 3 records |
| thinkstappliedresearch | 79.8 | 7 records |
| linqi | 79.8 | 4 records |
| sick ag | 79.8 | 2 records |
| centreon | 79.8 | 1 record |
| brocade | 79.44 | 9 records |
| dotcms | 79.0 | 2 records |
| kubernetes | 79.0 | 2 records |
| toreon | 79.0 | 2 records |
| ping identity | 78.8 | 5 records |
| mandiant | 78.5 | 6 records |
| bitdefender | 78.33 | 3 records |
| forcepoint | 78.0 | 3 records |
| perforce | 77.8 | 8 records |
| lge | 77.0 | 1 record |
| tv | 76.92 | 5 records |
| n-able | 76.9 | 6 records |
| seal | 76.86 | 7 records |
| medtronic | 76.8 | 2 records |
| symantec | 75.3 | 4 records |
| otrs | 75.0 | 9 records |
| bt | 75.0 | 6 records |
| caliptra | 75.0 | 5 records |
| hanwha_vision | 75.0 | 3 records |
| watchdog | 75.0 | 3 records |
| cato | 75.0 | 1 record |
| elan | 75.0 | 1 record |
| proton | 75.0 | 1 record |
| yandex | 75.0 | 1 record |
| alibaba | 74.93 | 3 records |
| tml | 74.3 | 6 records |
| kaspersky | 74.14 | 9 records |
| yeswehack | 73.33 | 3 records |
| canon | 72.8 | 9 records |
| tcs-cert | 72.5 | 6 records |
| ncsc-fi | 72.47 | 8 records |
| blackberry | 72.26 | 7 records |
| airbus | 72.2 | 9 records |
| opentext | 72.17 | 6 records |
| eset | 72.0 | 5 records |
| fsoft | 72.0 | 1 record |
| sophos | 72.0 | 1 record |
| tro | 72.0 | 1 record |
| connectwise | 71.75 | 4 records |
| aha | 71.25 | 4 records |
| crowdstrike | 71.0 | 2 records |
| honeywell | 70.94 | 8 records |
| digi | 70.9 | 2 records |
| upkeeper | 70.0 | 3 records |
| bizerba | 70.0 | 2 records |
| bombadilsystems | 70.0 | 2 records |
| supermicro | 70.0 | 2 records |
| ami | 70.0 | 1 record |
| omron | 70.0 | 1 record |
| opengauss | 70.0 | 1 record |
| pentraze | 70.0 | 1 record |
| blsops | 69.29 | 7 records |
| bcny | 69.25 | 4 records |
| hitvan | 69.25 | 4 records |
| windriver | 69.25 | 4 records |
| fsi | 69.2 | 5 records |
| sba-research | 69.0 | 8 records |
| asr | 69.0 | 3 records |
| bosch | 68.8 | 9 records |
| jaspersoft | 68.5 | 2 records |
| trellix | 68.5 | 2 records |
| citrix | 68.2 | 5 records |
| everpure | 68.0 | 3 records |
| oppo | 67.75 | 4 records |
| secomea | 67.5 | 2 records |
| vivo | 67.0 | 4 records |
| gandc | 67.0 | 1 record |
| hypr | 67.0 | 1 record |
| dahua | 66.67 | 3 records |
| netapp | 66.64 | 5 records |
| canva | 66.4 | 5 records |
| edb | 66.0 | 5 records |
| cloudflare | 65.96 | 5 records |
| sailpoint | 65.5 | 4 records |
| securifera | 65.0 | 7 records |
| seagate | 65.0 | 3 records |
| yokogawagroup | 65.0 | 1 record |
| txone | 64.8 | 1 record |
| 9front | 64.3 | 2 records |
| genetec | 64.17 | 6 records |
| insyde | 64.12 | 8 records |
| nec | 63.5 | 4 records |
| sk-cert | 63.5 | 2 records |
| eaton | 62.43 | 8 records |
| panasonic_holdings_corporation | 62.0 | 1 record |
| mautic | 60.0 | 7 records |
| gallagher | 60.0 | 4 records |
| spotfire | 60.0 | 1 record |
| systemd | 59.67 | 3 records |
| octopus | 58.81 | 8 records |
| ly-corporation | 57.5 | 8 records |
| ciena | 57.45 | 4 records |
| omnissa | 57.0 | 2 records |
| tibco | 57.0 | 1 record |
| bugcrowd | 56.75 | 8 records |
| oai | 54.17 | 6 records |
| tecnomobile | 53.5 | 2 records |
| honor | 52.0 | 3 records |
| naver | 51.8 | 1 record |
| debian | 35.0 | 2 records |
The rules
Each record earns a credit in 0..1 per rule; the record's score is the weighted sum, the assigner's is the mean.
Describe: can a reader tell what the vulnerability is? (25 points)
- Description (10): An English description that is not a placeholder: full credit from 200 characters, 0.7 from 80, 0.4 from 40, none below.
- Title (5): A title.
- Cwe (10): A weakness as a CWE identifier in problemTypes; a free-text problem type without one earns a quarter.
Scope: can a reader tell whether they are affected? (25 points)
- Affected (10): An affected entry naming both a vendor and a product; one side missing or 'n/a' earns half.
- Versions (8): An affected entry stating versions, as a version or a bound; a defaultStatus alone earns half.
- Cpe (7): A CPE on an affected entry, or a cpeApplicability block.
Assess: can a reader tell how bad it is? (25 points)
- Severity (15): A severity statement in the CNA container: a CVSS v3 or v4 vector, an SSVC decision, or a vendor rating as an 'other' metric. A CVSS v2 vector alone earns half.
- Modern severity (5): A CVSS v4 vector or an SSVC decision.
- Impacts (5): An impacts entry (a CAPEC identifier or an impact description).
Act: can a reader tell what to do about it? (25 points)
- References (7): At least one reference.
- Reference tags (5): At least one reference carrying tags.
- Remediation (8): A reference tagged 'patch'; one tagged 'vendor-advisory', 'mitigation' or 'release-notes' earns 0.6.
- Solutions (5): A solution or a workaround.
Grades: A from 90, B from 75, C from 60, D from 45, E from 0. Timeliness is displayed on each assigner's page and never scored: a long reservation-to-publication delay is a disclosure embargo as often as a backlog.