Insights
CNA scorecard
How well each CVE Numbering Authority fills the records it publishes, scored against a published set of rules: Describe, Scope, Assess, Act, 25 points each. Only what the assigner wrote itself counts; severity and weaknesses added later by an ADP are shown as a dependency, not as the assigner's work.
197
Ranked CNAs
162
Under the threshold
180 days
Rolling window
12
Grade A
| # | CNA | Grade | Score | Records | Badge |
|---|---|---|---|---|---|
| 1 | Secur0 Secur0
Spain · INCIBE
|
A | 99.15 | 41 |
|
| 2 | Temporal Temporal Technologies Inc.
USA · mitre
|
A | 96.77 | 13 |
|
| 3 | EEF Erlang Ecosystem Foundation
USA · mitre
|
A | 96.52 | 313 |
|
| 4 | palo_alto Palo Alto Networks, Inc.
USA · mitre
|
A | 95.29 | 96 |
|
| 5 | isc Internet Systems Consortium (ISC)
USA · mitre
|
A | 95.0 | 29 |
|
| 6 | AMZN Amazon
USA · mitre
|
A | 93.79 | 139 |
|
| 7 | Moxa Moxa Inc.
Taiwan · icscert
|
A | 92.05 | 12 |
|
| 8 | NETGEAR NETGEAR
USA · mitre
|
A | 92.02 | 40 |
|
| 9 | Checkmk Checkmk GmbH
Germany · mitre
|
A | 91.47 | 18 |
|
| 10 | WatchGuard WatchGuard Technologies, Inc.
USA · mitre
|
A | 91.2 | 73 |
|
| 11 | Qt Qt Group
Finland · mitre
|
A | 90.82 | 11 |
|
| 12 | CIRCL Computer Incident Response Center Luxembourg (CIRCL)
Luxembourg · ENISA
|
A | 90.2 | 243 |
|
| 13 | Sonatype Sonatype Inc.
USA · mitre
|
B | 89.9 | 30 |
|
| 14 | autodesk Autodesk
USA · mitre
|
B | 89.78 | 27 |
|
| 15 | WSO2 WSO2 LLC
USA · mitre
|
B | 89.4 | 48 |
|
| 16 | CERT-In Indian Computer Emergency Response Team (CERT-In)
India · mitre
|
B | 89.34 | 22 |
|
| 17 | Fluid_Attacks Fluid Attacks
Colombia · mitre
|
B | 88.63 | 62 |
|
| 18 | Docker Docker Inc.
USA · mitre
|
B | 88.06 | 33 |
|
| 19 | ibm IBM Corporation
USA · mitre
|
B | 87.78 | 1,280 |
|
| 20 | TPLink TP-Link Systems Inc.
USA · mitre
|
B | 87.54 | 98 |
|
| 21 | Arista Arista Networks, Inc.
USA · mitre
|
B | 87.25 | 89 |
|
| 22 | DSF Django Software Foundation
USA · mitre
|
B | 85.54 | 21 |
|
| 23 | qnap QNAP Systems, Inc.
Taiwan · mitre
|
B | 85.47 | 61 |
|
| 24 | harborist Harborist
USA · redhat
|
B | 85.2 | 13 |
|
| 25 | INCIBE Spanish National Cybersecurity Institute, S.A. (INCIBE)
Spain · mitre
|
B | 85.16 | 119 |
|
| 26 | Kong Kong Inc.
USA · mitre
|
B | 84.89 | 17 |
|
| 27 | ASUSTOR ASUSTOR, Inc.
Taiwan · mitre
|
B | 84.8 | 10 |
|
| 28 | juniper Juniper Networks, Inc.
USA · mitre
|
B | 84.59 | 175 |
|
| 29 | ConcreteCMS Concrete CMS
USA · mitre
|
B | 84.36 | 111 |
|
| 30 | NI National Instruments
USA · mitre
|
B | 83.99 | 28 |
|
| 31 | VulnCheck VulnCheck
USA · mitre
|
B | 83.89 | 6,489 |
|
| 32 | F5 F5, Inc.
USA · mitre
|
B | 83.89 | 87 |
|
| 33 | Silabs Silicon Labs
USA · mitre
|
B | 83.88 | 33 |
|
| 34 | lenovo Lenovo Group Ltd.
USA · mitre
|
B | 83.78 | 43 |
|
| 35 | bcorg Legion of the Bouncy Castle Inc.
Australia · mitre
|
B | 83.76 | 74 |
|
| 36 | GitHub_P GitHub, Inc. (Products Only)
USA · mitre
|
B | 83.73 | 23 |
|
| 37 | TYPO3 TYPO3 Association
Switzerland · mitre
|
B | 83.61 | 52 |
|
| 38 | GV GeoVision Inc.
Taiwan · mitre
|
B | 83.47 | 83 |
|
| 39 | HeroDevs HeroDevs
USA · mitre
|
B | 83.15 | 13 |
|
| 40 | SolarWinds SolarWinds
USA · mitre
|
B | 83.07 | 23 |
|
| 41 | VulDB VulDB
Switzerland · mitre
|
B | 82.38 | 3,904 |
|
| 42 | NLnet_Labs NLnet Labs
Netherlands · mitre
|
B | 82.21 | 61 |
|
| 43 | canonical Canonical Ltd.
UK · mitre
|
B | 81.96 | 58 |
|
| 44 | redhat Red Hat, Inc.
USA · mitre
|
B | 81.8 | 1,032 |
|
| 45 | microsoft Microsoft Corporation
USA · mitre
|
B | 81.69 | 3,956 |
|
| 46 | RTI Real-Time Innovations, Inc.
USA · mitre
|
B | 81.4 | 20 |
|
| 47 | SEC-VLab SEC Consult Vulnerability Lab
Austria · mitre
|
B | 81.21 | 22 |
|
| 48 | twcert TWCERT/CC
Taiwan · mitre
|
B | 81.19 | 91 |
|
| 49 | Mandiant Mandiant Inc.
USA · Google
|
B | 81.0 | 11 |
|
| 50 | TeamViewer TeamViewer Germany GmbH
Germany · mitre
|
B | 80.86 | 10 |
|
| 51 | Nozomi Nozomi Networks Inc.
USA · mitre
|
B | 80.79 | 58 |
|
| 52 | CERT-PL CERT.PL
Poland · ENISA
|
B | 80.68 | 220 |
|
| 53 | securin Securin
USA · mitre
|
B | 80.2 | 71 |
|
| 54 | php PHP Group
USA · mitre
|
B | 80.1 | 25 |
|
| 55 | ENISA EU Agency for Cybersecurity (ENISA)
Greece · mitre
|
B | 80.01 | 40 |
|
| 56 | PSF Python Software Foundation
USA · mitre
|
B | 79.85 | 26 |
|
| 57 | Mattermost Mattermost, Inc.
USA · mitre
|
B | 79.72 | 122 |
|
| 58 | wolfSSL wolfSSL Inc.
USA · icscert
|
B | 79.71 | 51 |
|
| 59 | NCSC.ch Switzerland National Cyber Security Centre (NCSC)
Switzerland · mitre
|
B | 79.4 | 75 |
|
| 60 | Zabbix Zabbix
Latvia · mitre
|
B | 79.4 | 20 |
|
| 61 | Deltaww Delta Electronics, Inc.
Taiwan · icscert
|
B | 79.29 | 24 |
|
| 62 | Hitachi Hitachi, Ltd.
Japan · jpcert
|
B | 79.22 | 21 |
|
| 63 | suse SUSE
USA · mitre
|
B | 78.45 | 101 |
|
| 64 | PandoraFMS Pandora FMS
Spain · INCIBE
|
B | 78.15 | 13 |
|
| 65 | openssl OpenSSL Software Foundation
USA · mitre
|
B | 78.0 | 43 |
|
| 66 | ProgressSoftware Progress Software Corporation
USA · mitre
|
B | 77.8 | 141 |
|
| 67 | Fortra Fortra, LLC
USA · mitre
|
B | 77.26 | 13 |
|
| 68 | GoogleCloud Google Cloud
USA · Google
|
B | 77.11 | 27 |
|
| 69 | zephyr Zephyr Project
USA · mitre
|
B | 77.1 | 175 |
|
| 70 | glibc GNU C Library
USA · redhat
|
B | 76.5 | 14 |
|
| 71 | jci Johnson Controls
USA · icscert
|
B | 76.36 | 29 |
|
| 72 | rapid7 Rapid7, Inc.
USA · mitre
|
B | 76.04 | 62 |
|
| 73 | CyberDanube CyberDanube
Austria · icscert
|
B | 76.0 | 20 |
|
| 74 | apache Apache Software Foundation
USA · mitre
|
B | 75.98 | 1,004 |
|
| 75 | GEN Gen Digital Inc.
USA · mitre
|
B | 75.68 | 19 |
|
| 76 | cisa-cg Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government
USA · CISA
|
B | 75.66 | 127 |
|
| 77 | CERTVDE CERT@VDE
Germany · icscert
|
B | 75.59 | 145 |
|
| 78 | Google Google LLC
USA · mitre
|
B | 75.54 | 35 |
|
| 79 | brocade Brocade Communications Systems LLC, a Broadcom Company
USA · mitre
|
B | 75.46 | 70 |
|
| 80 | Acer Acer Inc.
Taiwan · mitre
|
B | 75.18 | 49 |
|
| 81 | icscert Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)
USA · CISA
|
B | 75.08 | 351 |
|
| 82 | OTRS EasyVista-OTRS GmbH
Germany · mitre
|
B | 75.0 | 17 |
|
| 83 | Patchstack Patchstack
Estonia · mitre
|
C | 74.96 | 2,956 |
|
| 84 | JFrog JFrog
Israel · mitre
|
C | 74.85 | 62 |
|
| 85 | Document_Fdn. Document Foundation, The
Germany · redhat
|
C | 74.76 | 21 |
|
| 86 | adobe Adobe Systems Incorporated
USA · mitre
|
C | 74.75 | 803 |
|
| 87 | ZUSO_ART ZUSO Advanced Research Team (ZUSO ART)
Taiwan · mitre
|
C | 74.73 | 11 |
|
| 88 | Altium Altium
USA · mitre
|
C | 74.67 | 12 |
|
| 89 | rami.io rami.io GmbH
Germany · mitre
|
C | 74.62 | 25 |
|
| 90 | GitLab GitLab Inc.
USA · mitre
|
C | 74.52 | 311 |
|
| 91 | TR-CERT TR-CERT (Computer Emergency Response Team of the Republic of Türkiye)
Türkiye · mitre
|
C | 74.51 | 269 |
|
| 92 | hp HP Inc.
USA · mitre
|
C | 74.43 | 35 |
|
| 93 | Perforce Perforce
USA · mitre
|
C | 73.96 | 17 |
|
| 94 | Rockwell Rockwell Automation
USA · icscert
|
C | 73.81 | 47 |
|
| 95 | OpenVPN OpenVPN Inc.
USA · mitre
|
C | 73.58 | 27 |
|
| 96 | DIVD Dutch Institute for Vulnerability Disclosure (DIVD)
Netherlands · ENISA
|
C | 73.46 | 14 |
|
| 97 | zdi Zero Day Initiative
Japan · mitre
|
C | 73.13 | 109 |
|
| 98 | Joomla Joomla! Project
USA · mitre
|
C | 72.66 | 342 |
|
| 99 | AHA Austin Hackers Anonymous
USA · mitre
|
C | 72.57 | 14 |
|
| 100 | Zohocorp Zohocorp
India · mitre
|
C | 72.26 | 43 |
|
| 101 | ASUS ASUSTeK Computer Incorporation
Taiwan · icscert
|
C | 72.07 | 39 |
|
| 102 | fortinet Fortinet, Inc.
USA · mitre
|
C | 71.89 | 56 |
|
| 103 | GitHub_M GitHub, Inc.
USA · mitre
|
C | 71.57 | 7,618 |
|
| 104 | runZero runZero, Inc.
USA · icscert
|
C | 71.48 | 30 |
|
| 105 | tenable Tenable Network Security, Inc.
USA · mitre
|
C | 71.33 | 52 |
|
| 106 | HDFG The HDF Group
USA · redhat
|
C | 71.25 | 12 |
|
| 107 | ERIC Ericsson
Sweden · mitre
|
C | 70.66 | 13 |
|
| 108 | PaperCut PaperCut Software Pty Ltd
Australia · mitre
|
C | 70.42 | 12 |
|
| 109 | GRAFANA Grafana Labs
USA · mitre
|
C | 70.32 | 48 |
|
| 110 | mongodb MongoDB, Inc.
USA · mitre
|
C | 70.3 | 205 |
|
| 111 | HashiCorp HashiCorp Inc.
USA · mitre
|
C | 70.0 | 41 |
|
| 112 | Okta Okta
USA · mitre
|
C | 70.0 | 29 |
|
| 113 | HiddenLayer HiddenLayer, Inc.
USA · mitre
|
C | 70.0 | 16 |
|
| 114 | dell Dell
USA · mitre
|
C | 69.68 | 442 |
|
| 115 | TuranSec Turan Security
Uzbekistan · mitre
|
C | 69.66 | 189 |
|
| 116 | Foxit Foxit Software Incorporated
USA · mitre
|
C | 69.5 | 69 |
|
| 117 | INCD Israel National Cyber Directorate (INCD)
Israel · mitre
|
C | 69.29 | 17 |
|
| 118 | oracle Oracle
USA · mitre
|
C | 69.28 | 2,905 |
|
| 119 | elastic Elastic
Netherlands · mitre
|
C | 69.03 | 155 |
|
| 120 | ZTE ZTE Corporation
China · mitre
|
C | 69.03 | 34 |
|
| 121 | wikimedia-foundation The Wikimedia Foundation
USA · mitre
|
C | 68.88 | 81 |
|
| 122 | fedora Fedora Project
USA · redhat
|
C | 68.56 | 34 |
|
| 123 | Hitachi_Energy Hitachi Energy
Switzerland · icscert
|
C | 68.48 | 12 |
|
| 124 | ABB Asea Brown Boveri Ltd. (ABB)
Switzerland · icscert
|
C | 67.94 | 16 |
|
| 125 | Zscaler Zscaler, Inc.
USA · mitre
|
C | 67.9 | 10 |
|
| 126 | synology Synology Inc.
Taiwan · mitre
|
C | 67.28 | 46 |
|
| 127 | PostgreSQL PostgreSQL
Canada · redhat
|
C | 67.18 | 88 |
|
| 128 | Zyxel Zyxel Corporation
Taiwan · mitre
|
C | 67.0 | 14 |
|
| 129 | Canva Canva
Australia · mitre
|
C | 66.75 | 12 |
|
| 130 | cisco Cisco Systems, Inc.
USA · mitre
|
C | 66.44 | 377 |
|
| 131 | checkpoint Check Point Software Ltd.
Israel · mitre
|
C | 65.68 | 17 |
|
| 132 | Citrix Citrix Systems, Inc.
USA · mitre
|
C | 65.6 | 10 |
|
| 133 | snowflake | C | 65.53 | 19 |
|
| 134 | schneider Schneider Electric
France · mitre
|
C | 65.48 | 23 |
|
| 135 | openjs OpenJS Foundation
USA · redhat
|
C | 65.16 | 110 |
|
| 136 | sap SAP SE
Germany · mitre
|
C | 65.12 | 117 |
|
| 137 | Esri Environmental Systems Research Institute, Inc.
USA · mitre
|
C | 65.11 | 23 |
|
| 138 | Wordfence Wordfence
USA · mitre
|
C | 65.0 | 2,263 |
|
| 139 | siemens Siemens
Germany · icscert
|
C | 65.0 | 99 |
|
| 140 | @huntr_ai Protect AI (formerly huntr.dev)
USA · mitre
|
C | 65.0 | 41 |
|
| 141 | nvidia NVIDIA Corporation
USA · mitre
|
C | 64.82 | 326 |
|
| 142 | HCL HCL Software
India · mitre
|
C | 64.48 | 182 |
|
| 143 | vmware VMware by Broadcom
USA · mitre
|
C | 64.47 | 247 |
|
| 144 | redhat-cnalr | C | 64.17 | 13 |
|
| 145 | jpcert JPCERT/CC
Japan · mitre
|
C | 63.75 | 178 |
|
| 146 | CPANSec CPAN Security Group
Canada · redhat
|
C | 63.44 | 287 |
|
| 147 | samsung.tv_appliance Samsung TV & Appliance
South Korea · mitre
|
C | 63.33 | 46 |
|
| 148 | 3ds | C | 63.33 | 18 |
|
| 149 | OX Open-Xchange
Germany · mitre
|
C | 62.94 | 52 |
|
| 150 | eclipse Eclipse Foundation
Belgium · mitre
|
C | 62.81 | 146 |
|
| 151 | AMD Advanced Micro Devices Inc.
USA · mitre
|
C | 62.78 | 74 |
|
| 152 | ivanti Ivanti
USA · mitre
|
C | 62.69 | 39 |
|
| 153 | NetScaler NetScaler
USA · mitre
|
C | 62.53 | 18 |
|
| 154 | qualcomm Qualcomm, Inc.
USA · mitre
|
C | 61.49 | 89 |
|
| 155 | atlassian Atlassian
Australia · mitre
|
C | 61.2 | 10 |
|
| 156 | Commvault Commvault Systems Inc.
USA · mitre
|
C | 60.88 | 24 |
|
| 157 | OpenHarmony OpenHarmony
China · mitre
|
C | 60.8 | 10 |
|
| 158 | Gitea Gitea Limited
China · mitre
|
C | 60.51 | 165 |
|
| 159 | snyk Snyk
UK · mitre
|
C | 60.29 | 17 |
|
| 160 | Zoom Zoom Communications, Inc.
USA · mitre
|
C | 60.28 | 18 |
|
| 161 | Octopus Octopus Deploy
Australia · mitre
|
C | 60.23 | 11 |
|
| 162 | intel Intel Corporation
USA · mitre
|
C | 60.0 | 96 |
|
| 163 | SN ServiceNow
USA · mitre
|
C | 60.0 | 10 |
|
| 164 | freebsd FreeBSD
USA · mitre
|
D | 59.8 | 67 |
|
| 165 | Tanium Tanium Inc.
USA · mitre
|
D | 59.16 | 37 |
|
| 166 | Absolute Absolute Software
USA · mitre
|
D | 59.1 | 29 |
|
| 167 | hackerone HackerOne
USA · mitre
|
D | 58.95 | 187 |
|
| 168 | Axis Axis Communications AB
Sweden · mitre
|
D | 58.95 | 10 |
|
| 169 | Ubiquiti Ubiquiti, Inc.
USA · mitre
|
D | 58.46 | 35 |
|
| 170 | hpe Hewlett Packard Enterprise (HPE)
USA · mitre
|
D | 57.06 | 288 |
|
| 171 | JetBrains JetBrains s.r.o.
Czech Republic · mitre
|
D | 57.04 | 155 |
|
| 172 | huawei Huawei Technologies
China · mitre
|
D | 57.0 | 60 |
|
| 173 | trendmicro Trend Micro, Inc.
Japan · mitre
|
D | 57.0 | 16 |
|
| 174 | XEN Xen Project
UK · mitre
|
D | 55.78 | 46 |
|
| 175 | CSA Cyber Security Agency of Singapore
Singapore · mitre
|
D | 55.32 | 33 |
|
| 176 | imaginationtech Imagination Technologies
UK · mitre
|
D | 54.9 | 31 |
|
| 177 | Samsung_Mobile Samsung Mobile
South Korea · mitre
|
D | 54.55 | 126 |
|
| 178 | Arm Arm Limited
UK · mitre
|
D | 54.09 | 11 |
|
| 179 | sonicwall SonicWall, Inc.
USA · mitre
|
D | 53.94 | 28 |
|
| 180 | Linux kernel.org
USA · mitre
|
D | 53.07 | 6,996 |
|
| 181 | Unisoc Unisoc (Shanghai) Technologies Co., Ltd.
China · mitre
|
D | 52.08 | 18 |
|
| 182 | drupal Drupal.org
USA · mitre
|
D | 52.06 | 103 |
|
| 183 | curl curl
Sweden · redhat
|
D | 49.17 | 36 |
|
| 184 | hikvision Hangzhou Hikvision Digital Technology Co., Ltd.
China · mitre
|
D | 49.15 | 13 |
|
| 185 | Meta Meta Platforms, Inc.
USA · mitre
|
D | 48.75 | 12 |
|
| 186 | MediaTek MediaTek, Inc.
Taiwan · mitre
|
D | 45.0 | 100 |
|
| 187 | jenkins Jenkins Project
USA · mitre
|
E | 44.28 | 132 |
|
| 188 | DEVOLUTIONS Devolutions Inc.
Canada · mitre
|
E | 44.26 | 64 |
|
| 189 | WPScan WPScan
France · mitre
|
E | 44.11 | 1,723 |
|
| 190 | Chrome Chrome
USA · Google
|
E | 42.58 | 3,023 |
|
| 191 | certcc CERT/CC
USA · mitre
|
E | 42.08 | 154 |
|
| 192 | Go Go Project
USA · Google
|
E | 41.76 | 73 |
|
| 193 | google_android Android (associated with Google Inc. or Open Handset Alliance)
USA · Google
|
E | 39.94 | 198 |
|
| 194 | mozilla Mozilla Corporation
USA · mitre
|
E | 37.88 | 504 |
|
| 195 | Google_Devices Google Devices
USA · Google
|
E | 37.74 | 144 |
|
| 196 | apple Apple Inc.
USA · mitre
|
E | 36.85 | 618 |
|
| 197 | mitre MITRE Corporation
USA
|
E | 28.03 | 2,348 |
|
Under the threshold (162)
Fewer than 10 publications in the window. The score is indicative and these are not ranked: three perfect records are not evidence of a practice.
| HackRTU HackRTU
Spain · INCIBE
|
100.0 | 4 records |
| Nutanix Nutanix
USA · mitre
|
96.8 | 2 records |
| tqtc | 95.14 | 7 records |
| chainguard Chainguard, Inc.
USA · icscert
|
93.0 | 3 records |
| Echo Echo Software Ltd.
Israel · mitre
|
93.0 | 1 record |
| arcinfo ARC Informatique
France · icscert
|
91.8 | 2 records |
| FTI Fsas Technologies
Germany · mitre
|
91.8 | 2 records |
| ca CA Technologies - A Broadcom Company
USA · mitre
|
91.8 | 1 record |
| Neo4j Neo4j
Sweden · mitre
|
90.88 | 5 records |
| rust The Rust Project
USA · redhat
|
90.5 | 2 records |
| Cribl Cribl, Inc.
USA · icscert
|
89.8 | 5 records |
| milestonesys Milestone Systems A/S
Denmark · mitre
|
89.8 | 1 record |
| Roche Roche Diagnostics
Switzerland · icscert
|
89.8 | 1 record |
| sirius Sirius Computer, Inc.
USA · mitre
|
89.8 | 1 record |
| StrongDM StrongDM
USA · mitre
|
89.8 | 1 record |
| Vestel Vestel Electronics Industry & Trade Co.
Türkiye · mitre
|
89.8 | 1 record |
| Checkmarx Checkmarx
Israel · mitre
|
89.6 | 5 records |
| illumos The illumos project
USA · redhat
|
89.11 | 9 records |
| Tigera Tigera, Inc.
USA · mitre
|
89.0 | 6 records |
| OMICRON OMICRON electronics
Austria · icscert
|
88.47 | 3 records |
| SCHUTZWERK SCHUTZWERK GmbH
Germany · mitre
|
88.0 | 4 records |
| Crestron Crestron Electronics, Inc.
USA · mitre
|
88.0 | 1 record |
| Danfoss Danfoss
Denmark · icscert
|
88.0 | 1 record |
| AlgoSec AlgoSec
Israel · mitre
|
87.0 | 1 record |
| Bull Bull SAS
France · ENISA
|
86.8 | 1 record |
| Hackrate Hackrate Kft.
Hungary · icscert
|
86.66 | 7 records |
| Delinea Delinea, Inc.
USA · mitre
|
86.3 | 4 records |
| postiz Postiz
USA · mitre
|
86.0 | 5 records |
| libreswan Libreswan Project
No country affiliation · mitre
|
85.75 | 8 records |
| Microchip Microchip Technology
USA · mitre
|
85.33 | 6 records |
| Mitsubishi Mitsubishi Electric Corporation
Japan · jpcert
|
84.8 | 8 records |
| Canon_EMEA Canon EMEA
UK · mitre
|
84.8 | 2 records |
| NX Network Optix
USA · mitre
|
84.8 | 2 records |
| flock Flock
USA · icscert
|
84.8 | 1 record |
| ASRG Automotive Security Research Group (ASRG)
USA · icscert
|
84.38 | 8 records |
| Softing Softing
Germany · mitre
|
84.0 | 1 record |
| FERMAX Fermax Technologies SLU
Spain · INCIBE
|
83.55 | 4 records |
| STAR_Labs STAR Labs SG Pte. Ltd.
Singapore · mitre
|
83.0 | 1 record |
| THA-PSIRT Thales Group
France · mitre
|
82.85 | 4 records |
| Netskope Netskope
USA · mitre
|
82.74 | 7 records |
| SRA Security Risk Advisors (SRA)
USA · icscert
|
82.74 | 7 records |
| flexera Flexera Software LLC
USA · mitre
|
82.65 | 4 records |
| Tcpdump Tcpdump Group
Canada · mitre
|
82.57 | 7 records |
| PTC PTC Inc.
USA · icscert
|
82.55 | 4 records |
| BlackDuck Black Duck Software, Inc.
USA · mitre
|
82.3 | 4 records |
| M-Files M-Files Corporation
Finland · mitre
|
82.3 | 4 records |
| Payara Payara
UK · mitre
|
82.3 | 2 records |
| Logitech Logitech
Switzerland · mitre
|
82.0 | 1 record |
| Semtech Semtech Corporation
Canada · mitre
|
82.0 | 1 record |
| wibu WIBU-SYSTEMS AG
Germany · ENISA
|
81.8 | 8 records |
| PRJBLK Project Black
Australia · mitre
|
81.53 | 9 records |
| OpenNMS The OpenNMS Group
USA · mitre
|
81.14 | 7 records |
| Altera Altera
USA · mitre
|
80.88 | 8 records |
| tlt_net Teltonika Networks
Lithuania · icscert
|
80.0 | 4 records |
| Vaadin Vaadin Ltd.
Finland · mitre
|
80.0 | 3 records |
| hsi Haverford Systems, Inc.
USA · icscert
|
80.0 | 1 record |
| Nintendo Nintendo Co., Ltd.
Japan · jpcert
|
80.0 | 1 record |
| ExtremeNetworks Extreme Networks, Inc.
USA · mitre
|
79.87 | 3 records |
| ThinkstAppliedResearch Thinkst Applied Research
South Africa · mitre
|
79.8 | 7 records |
| linqi linqi GmbH
Germany · mitre
|
79.8 | 4 records |
| SICK_AG SICK AG
Germany · mitre
|
79.8 | 3 records |
| Centreon Centreon
France · mitre
|
79.8 | 1 record |
| PingIdentity Ping Identity Corporation
USA · mitre
|
79.4 | 5 records |
| dotCMS dotCMS LLC
USA · mitre
|
79.0 | 2 records |
| kubernetes Kubernetes
USA · mitre
|
79.0 | 2 records |
| Toreon Toreon
Belgium · mitre
|
79.0 | 2 records |
| krcert KrCERT/CC
South Korea · mitre
|
78.5 | 6 records |
| Bitdefender Bitdefender
Romania · mitre
|
78.33 | 3 records |
| forcepoint Forcepoint
USA · mitre
|
78.0 | 3 records |
| CrowdStrike CrowdStrike Holdings, Inc.
USA · mitre
|
77.0 | 1 record |
| LGE LG Electronics
South Korea · mitre
|
77.0 | 1 record |
| N-able N-able
USA · mitre
|
76.9 | 6 records |
| seal Seal Security
USA · mitre
|
76.86 | 7 records |
| Medtronic Medtronic
USA · icscert
|
76.8 | 2 records |
| OpenText OpenText (formerly Micro Focus)
USA · mitre
|
76.37 | 7 records |
| NCSC-FI National Cyber Security Centre Finland (NCSC-FI)
Finland · ENISA
|
76.16 | 5 records |
| Cato Cato Networks
Israel · mitre
|
75.95 | 4 records |
| BT BeyondTrust Inc.
USA · mitre
|
75.0 | 7 records |
| Caliptra Caliptra Project
USA · mitre
|
75.0 | 5 records |
| Hanwha_Vision Hanwha Vision Co., Ltd.
South Korea · mitre
|
75.0 | 3 records |
| watchdog WatchDogDevelopment.com, LLC
USA · mitre
|
75.0 | 3 records |
| EA Electronic Arts, Inc.
USA · mitre
|
75.0 | 1 record |
| ELAN ELAN Microelectronics Corp.
Taiwan · mitre
|
75.0 | 1 record |
| Proton Proton AG
Switzerland · mitre
|
75.0 | 1 record |
| yandex Yandex N.V.
Russia · mitre
|
75.0 | 1 record |
| alibaba Alibaba, Inc.
China · mitre
|
74.9 | 2 records |
| The_Missing_Link The Missing Link Australia (TML)
Australia · mitre
|
74.3 | 6 records |
| symantec Symantec - A Division of Broadcom
USA · mitre
|
74.24 | 5 records |
| Kaspersky Kaspersky
Russia · mitre
|
74.14 | 9 records |
| Digi Digi International Inc.
USA · icscert
|
73.87 | 3 records |
| hitvan | 73.86 | 7 records |
| YesWeHack YesWeHack
France · ENISA
|
73.33 | 3 records |
| Canon Canon Inc.
Japan · jpcert
|
72.8 | 9 records |
| Pega Pegasystems Inc.
USA · mitre
|
72.5 | 6 records |
| TCS-CERT TCS-CERT (Thales Cyber Solutions Customer’s CERT)
Belgium · THA-PSIRT
|
72.5 | 6 records |
| blackberry BlackBerry
Canada · mitre
|
72.26 | 7 records |
| ESET ESET, spol. s r.o.
Slovak Republic · ENISA
|
72.0 | 6 records |
| cirosec cirosec GmbH
Germany · mitre
|
72.0 | 1 record |
| Sophos Sophos Limited
UK · mitre
|
72.0 | 1 record |
| TRO Teradyne Robotics
Denmark · icscert
|
72.0 | 1 record |
| airbus Airbus
Netherlands · mitre
|
71.85 | 8 records |
| IQSIGHT IQSIGHT B.V.
Netherlands · ENISA
|
71.8 | 1 record |
| Honeywell Honeywell International Inc.
USA · icscert
|
71.07 | 7 records |
| ConnectWise ConnectWise LLC
USA · mitre
|
70.67 | 3 records |
| netapp NetApp, Inc.
USA · mitre
|
70.14 | 5 records |
| BLSOPS Black Lantern Security
USA · mitre
|
70.0 | 8 records |
| AMI AMI
USA · icscert
|
70.0 | 6 records |
| openGauss openGauss Community
China · mitre
|
70.0 | 5 records |
| bizerba Bizerba SE & Co. KG
Germany · mitre
|
70.0 | 2 records |
| BombadilSystems Bombadil Systems LLC
USA · mitre
|
70.0 | 2 records |
| Supermicro Super Micro Computer, Inc.
USA · mitre
|
70.0 | 2 records |
| upKeeper upKeeper Solutions
Sweden · mitre
|
70.0 | 2 records |
| Pentraze Pentraze Cybersecurity
Dominican Republic · mitre
|
70.0 | 1 record |
| Eaton Eaton
Ireland · mitre
|
69.8 | 3 records |
| BCNY The Browser Company of New York
USA · mitre
|
69.25 | 4 records |
| FSI Financial Security Institute (FSI)
South Korea · mitre
|
69.2 | 5 records |
| bosch Robert Bosch GmbH
Germany · icscert
|
69.05 | 8 records |
| sba-research SBA Research gGmbH
Austria · mitre
|
69.0 | 8 records |
| ASR ASR Microelectronics Co., Ltd.
China · icscert
|
69.0 | 3 records |
| Anthropic Anthropic, PBC
USA · mitre
|
68.96 | 5 records |
| Jaspersoft Jaspersoft
USA · mitre
|
68.5 | 2 records |
| Everpure Everpure, Inc.
USA · mitre
|
68.0 | 3 records |
| Trellix Trellix
USA · mitre
|
68.0 | 3 records |
| NCSC-NL National Cyber Security Centre Netherlands (NCSC-NL)
Netherlands · ENISA
|
68.0 | 1 record |
| Acronis Acronis International GmbH
Switzerland · mitre
|
67.92 | 8 records |
| WindRiver Wind River Systems Inc.
USA · icscert
|
67.9 | 5 records |
| OPPO OPPO Mobile Telecommunication Corp., Ltd.
China · mitre
|
67.75 | 4 records |
| EDB EnterpriseDB Corporation
USA · mitre
|
67.5 | 6 records |
| Secomea Secomea A/S
Denmark · icscert
|
67.5 | 2 records |
| Vivo Vivo Mobile Communication Co., Ltd.
China · mitre
|
67.0 | 4 records |
| HYPR HYPR Corp
USA · mitre
|
67.0 | 2 records |
| GandC Glyph & Cog, LLC
USA · redhat
|
67.0 | 1 record |
| dahua Dahua Technologies
China · mitre
|
66.67 | 3 records |
| cloudflare Cloudflare, Inc.
USA · mitre
|
65.96 | 5 records |
| SailPoint SailPoint Technologies
USA · mitre
|
65.67 | 3 records |
| Securifera Securifera, Inc.
USA · mitre
|
65.0 | 7 records |
| Seagate Seagate Technology
USA · mitre
|
65.0 | 3 records |
| FB Fujifilm Business Innovation Corp.
Japan · jpcert
|
65.0 | 1 record |
| YokogawaGroup Yokogawa Group
Japan · jpcert
|
65.0 | 1 record |
| TXOne TXOne Networks, Inc.
Taiwan · icscert
|
64.8 | 1 record |
| 9front 9front Systems
USA · mitre
|
64.3 | 2 records |
| Genetec Genetec Inc.
Canada · mitre
|
64.17 | 6 records |
| Insyde Insyde Software
USA · mitre
|
64.12 | 8 records |
| NEC NEC Corporation
Japan · jpcert
|
63.5 | 4 records |
| SK-CERT National Cyber Security Centre SK-CERT
Slovak Republic · ENISA
|
63.5 | 2 records |
| talos Talos
USA · mitre
|
63.1 | 8 records |
| Panasonic_Holdings_Corporation Panasonic Holdings Corporation
Japan · jpcert
|
62.0 | 1 record |
| Mautic Mautic
USA · mitre
|
60.0 | 7 records |
| Gallagher Gallagher Group Ltd.
New Zealand · icscert
|
60.0 | 4 records |
| Spotfire Spotfire
USA · mitre
|
60.0 | 1 record |
| systemd The systemd project
Germany · redhat
|
59.67 | 3 records |
| Bugcrowd Bugcrowd Inc.
USA · mitre
|
59.06 | 8 records |
| LY-Corporation LY Corporation
Japan · jpcert
|
57.5 | 7 records |
| Ciena Ciena Corporation
USA · mitre
|
57.45 | 4 records |
| Omnissa Omnissa, LLC
USA · mitre
|
57.0 | 2 records |
| Infoblox Infoblox Inc.
USA · mitre
|
57.0 | 1 record |
| tibco TIBCO Software Inc.
USA · mitre
|
57.0 | 1 record |
| OAI OpenAI
USA · mitre
|
54.17 | 6 records |
| TECNOMobile TECNO Mobile Limited
China · mitre
|
53.5 | 2 records |
| naver Naver Corporation
South Korea · mitre
|
51.8 | 1 record |
| Nokia Nokia
Finland · mitre
|
39.62 | 8 records |
| debian Debian GNU/Linux
USA · mitre
|
35.0 | 2 records |
The ranked CNAs graded A over the window: a mean score of 90 or more across their publications.
A
99.15 · 41 records
A
96.77 · 13 records
A
96.52 · 313 records
A
95.29 · 96 records
A
95.0 · 29 records
A
93.79 · 139 records
A
92.05 · 12 records
A
92.02 · 40 records
A
91.47 · 18 records
A
91.2 · 73 records
A
90.82 · 11 records
A
90.2 · 243 records
Named practices with an objective threshold, over the window, among the ranked CNAs. A listing names what to change; the bottom of a ranking does not.
Severity supplied by an ADP for more than half the records
24
- Chrome 100% / 3023
- apple 100% / 618
- jenkins 100% / 132
- MediaTek 100% / 100
- Go 100% / 73
- DEVOLUTIONS 100% / 64
- openssl 100% / 43
- curl 100% / 36
- imaginationtech 100% / 31
- sonicwall 100% / 28
- Arm 100% / 11
- Google_Devices 99% / 144
- freebsd 99% / 67
- mozilla 98% / 504
- certcc 97% / 154
- drupal 96% / 103
- google_android 92% / 198
- CPANSec 91% / 287
- WPScan 89% / 1723
- Gitea 83% / 165
- mitre 72% / 2348
- apache 68% / 1004
- XEN 61% / 46
- Meta 58% / 12
Descriptions under 100 characters on more than 30% of the records
5
- Tanium 97% / 37
- OpenHarmony 80% / 10
- Patchstack 59% / 2956
- Deltaww 54% / 24
- qualcomm 37% / 89
Affected products missing or 'n/a' on more than half the records
1
- mitre 76% / 2348
The rules
Each record earns a credit in 0..1 per rule; the record's score is the weighted sum, the assigner's is the mean.
Describe: can a reader tell what the vulnerability is? (25 points)
- Description (10): An English description that is not a placeholder: full credit from 200 characters, 0.7 from 80, 0.4 from 40, none below.
- Title (5): A title.
- Cwe (10): A weakness as a CWE identifier in problemTypes; a free-text problem type without one earns a quarter.
Scope: can a reader tell whether they are affected? (25 points)
- Affected (10): An affected entry naming both a vendor and a product; one side missing or 'n/a' earns half.
- Versions (8): An affected entry stating versions, as a version or a bound; a defaultStatus alone earns half.
- Cpe (7): A CPE on an affected entry, or a cpeApplicability block.
Assess: can a reader tell how bad it is? (25 points)
- Severity (15): A severity statement in the CNA container: a CVSS v3 or v4 vector, an SSVC decision, or a vendor rating as an 'other' metric. A CVSS v2 vector alone earns half.
- Modern severity (5): A CVSS v4 vector or an SSVC decision.
- Impacts (5): An impacts entry (a CAPEC identifier or an impact description).
Act: can a reader tell what to do about it? (25 points)
- References (7): At least one reference.
- Reference tags (5): At least one reference carrying tags.
- Remediation (8): A reference tagged 'patch'; one tagged 'vendor-advisory', 'mitigation' or 'release-notes' earns 0.6.
- Solutions (5): A solution or a workaround.
Grades: A from 90, B from 75, C from 60, D from 45, E from 0. Timeliness is displayed on each assigner's page and never scored: a long reservation-to-publication delay is a disclosure embargo as often as a backlog. The full text, with the methodology history, is in the documentation.