Insights
CNA scorecard
How well each CVE Numbering Authority fills the records it publishes, scored against a published set of rules: Describe, Scope, Assess, Act, 25 points each. Only what the assigner wrote itself counts; severity and weaknesses added later by an ADP are shown as a dependency, not as the assigner's work.
192
Ranked CNAs
164
Under the threshold
180 days
Rolling window
10
Grade A
| # | CNA | Grade | Score | Records | Badge |
|---|---|---|---|---|---|
| 1 | Secur0 Secur0
Spain · INCIBE
|
A | 99.03 | 38 |
|
| 2 | EEF Erlang Ecosystem Foundation
USA · mitre
|
A | 96.31 | 294 |
|
| 3 | Temporal Temporal Technologies Inc.
USA · mitre
|
A | 95.73 | 11 |
|
| 4 | palo_alto Palo Alto Networks, Inc.
USA · mitre
|
A | 95.24 | 86 |
|
| 5 | isc Internet Systems Consortium (ISC)
USA · mitre
|
A | 95.0 | 29 |
|
| 6 | AMZN Amazon
USA · mitre
|
A | 93.16 | 125 |
|
| 7 | NETGEAR NETGEAR
USA · mitre
|
A | 91.84 | 34 |
|
| 8 | Checkmk Checkmk GmbH
Germany · mitre
|
A | 91.48 | 19 |
|
| 9 | WatchGuard WatchGuard Technologies, Inc.
USA · mitre
|
A | 91.2 | 73 |
|
| 10 | Moxa Moxa Inc.
Taiwan · icscert
|
A | 91.1 | 10 |
|
| 11 | autodesk Autodesk
USA · mitre
|
B | 89.9 | 29 |
|
| 12 | Sonatype Sonatype Inc.
USA · mitre
|
B | 89.89 | 27 |
|
| 13 | CIRCL Computer Incident Response Center Luxembourg (CIRCL)
Luxembourg · ENISA
|
B | 89.61 | 229 |
|
| 14 | CERT-In Indian Computer Emergency Response Team (CERT-In)
India · mitre
|
B | 89.56 | 24 |
|
| 15 | WSO2 WSO2 LLC
USA · mitre
|
B | 88.89 | 45 |
|
| 16 | Fluid_Attacks Fluid Attacks
Colombia · mitre
|
B | 88.81 | 62 |
|
| 17 | Docker Docker Inc.
USA · mitre
|
B | 88.61 | 26 |
|
| 18 | ibm IBM Corporation
USA · mitre
|
B | 87.65 | 1,048 |
|
| 19 | TPLink TP-Link Systems Inc.
USA · mitre
|
B | 87.34 | 88 |
|
| 20 | Arista Arista Networks, Inc.
USA · mitre
|
B | 86.41 | 65 |
|
| 21 | INCIBE Spanish National Cybersecurity Institute, S.A. (INCIBE)
Spain · mitre
|
B | 85.6 | 110 |
|
| 22 | DSF Django Software Foundation
USA · mitre
|
B | 84.96 | 17 |
|
| 23 | Kong Kong Inc.
USA · mitre
|
B | 84.9 | 16 |
|
| 24 | juniper Juniper Networks, Inc.
USA · mitre
|
B | 84.8 | 48 |
|
| 25 | ASUSTOR ASUSTOR, Inc.
Taiwan · mitre
|
B | 84.8 | 11 |
|
| 26 | harborist Harborist
USA · redhat
|
B | 84.69 | 11 |
|
| 27 | VulnCheck VulnCheck
USA · mitre
|
B | 84.37 | 5,244 |
|
| 28 | ConcreteCMS Concrete CMS
USA · mitre
|
B | 84.36 | 111 |
|
| 29 | NI National Instruments
USA · mitre
|
B | 83.99 | 28 |
|
| 30 | Silabs Silicon Labs
USA · mitre
|
B | 83.88 | 33 |
|
| 31 | bcorg Legion of the Bouncy Castle Inc.
Australia · mitre
|
B | 83.76 | 78 |
|
| 32 | GV GeoVision Inc.
Taiwan · mitre
|
B | 83.66 | 80 |
|
| 33 | TYPO3 TYPO3 Association
Switzerland · mitre
|
B | 83.61 | 52 |
|
| 34 | HeroDevs HeroDevs
USA · mitre
|
B | 83.17 | 12 |
|
| 35 | lenovo Lenovo Group Ltd.
USA · mitre
|
B | 83.13 | 41 |
|
| 36 | SolarWinds SolarWinds
USA · mitre
|
B | 83.07 | 23 |
|
| 37 | F5 F5, Inc.
USA · mitre
|
B | 83.03 | 76 |
|
| 38 | GitHub_P GitHub, Inc. (Products Only)
USA · mitre
|
B | 82.72 | 26 |
|
| 39 | VulDB VulDB
Switzerland · mitre
|
B | 82.04 | 3,818 |
|
| 40 | NLnet_Labs NLnet Labs
Netherlands · mitre
|
B | 82.03 | 57 |
|
| 41 | twcert TWCERT/CC
Taiwan · mitre
|
B | 81.66 | 97 |
|
| 42 | microsoft Microsoft Corporation
USA · mitre
|
B | 81.57 | 2,674 |
|
| 43 | redhat Red Hat, Inc.
USA · mitre
|
B | 81.51 | 934 |
|
| 44 | RTI Real-Time Innovations, Inc.
USA · mitre
|
B | 81.4 | 20 |
|
| 45 | Nozomi Nozomi Networks Inc.
USA · mitre
|
B | 81.0 | 60 |
|
| 46 | TeamViewer TeamViewer Germany GmbH
Germany · mitre
|
B | 80.86 | 10 |
|
| 47 | PRJBLK Project Black
Australia · mitre
|
B | 80.78 | 11 |
|
| 48 | CERT-PL CERT.PL
Poland · ENISA
|
B | 80.55 | 219 |
|
| 49 | SEC-VLab SEC Consult Vulnerability Lab
Austria · mitre
|
B | 80.5 | 23 |
|
| 50 | canonical Canonical Ltd.
UK · mitre
|
B | 80.41 | 106 |
|
| 51 | php PHP Group
USA · mitre
|
B | 80.1 | 25 |
|
| 52 | Hitachi Hitachi, Ltd.
Japan · jpcert
|
B | 79.83 | 18 |
|
| 53 | Mattermost Mattermost, Inc.
USA · mitre
|
B | 79.71 | 110 |
|
| 54 | ENISA EU Agency for Cybersecurity (ENISA)
Greece · mitre
|
B | 79.65 | 34 |
|
| 55 | NCSC.ch Switzerland National Cyber Security Centre (NCSC)
Switzerland · mitre
|
B | 79.59 | 74 |
|
| 56 | PSF Python Software Foundation
USA · mitre
|
B | 79.53 | 34 |
|
| 57 | Zabbix Zabbix
Latvia · mitre
|
B | 79.4 | 20 |
|
| 58 | qnap QNAP Systems, Inc.
Taiwan · mitre
|
B | 79.27 | 26 |
|
| 59 | Mandiant Mandiant Inc.
USA · Google
|
B | 79.25 | 12 |
|
| 60 | ProgressSoftware Progress Software Corporation
USA · mitre
|
B | 79.11 | 83 |
|
| 61 | suse SUSE
USA · mitre
|
B | 79.08 | 96 |
|
| 62 | Deltaww Delta Electronics, Inc.
Taiwan · icscert
|
B | 78.86 | 22 |
|
| 63 | openssl OpenSSL Software Foundation
USA · mitre
|
B | 78.0 | 43 |
|
| 64 | PandoraFMS Pandora FMS
Spain · INCIBE
|
B | 77.71 | 21 |
|
| 65 | GoogleCloud Google Cloud
USA · Google
|
B | 77.3 | 27 |
|
| 66 | zephyr Zephyr Project
USA · mitre
|
B | 76.94 | 148 |
|
| 67 | jci Johnson Controls
USA · icscert
|
B | 76.49 | 27 |
|
| 68 | wolfSSL wolfSSL Inc.
USA · icscert
|
B | 76.09 | 69 |
|
| 69 | CyberDanube CyberDanube
Austria · icscert
|
B | 76.0 | 20 |
|
| 70 | rapid7 Rapid7, Inc.
USA · mitre
|
B | 75.98 | 55 |
|
| 71 | Fortra Fortra, LLC
USA · mitre
|
B | 75.97 | 18 |
|
| 72 | apache Apache Software Foundation
USA · mitre
|
B | 75.93 | 926 |
|
| 73 | GEN Gen Digital Inc.
USA · mitre
|
B | 75.68 | 19 |
|
| 74 | cisa-cg Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government
USA · CISA
|
B | 75.66 | 127 |
|
| 75 | CERTVDE CERT@VDE
Germany · icscert
|
B | 75.59 | 145 |
|
| 76 | Acer Acer Inc.
Taiwan · mitre
|
B | 75.18 | 49 |
|
| 77 | JFrog JFrog
Israel · mitre
|
B | 75.03 | 60 |
|
| 78 | GitLab GitLab Inc.
USA · mitre
|
C | 74.95 | 261 |
|
| 79 | Google Google LLC
USA · mitre
|
C | 74.88 | 32 |
|
| 80 | icscert Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)
USA · CISA
|
C | 74.85 | 332 |
|
| 81 | Document_Fdn. Document Foundation, The
Germany · redhat
|
C | 74.76 | 21 |
|
| 82 | adobe Adobe Systems Incorporated
USA · mitre
|
C | 74.74 | 680 |
|
| 83 | ZUSO_ART ZUSO Advanced Research Team (ZUSO ART)
Taiwan · mitre
|
C | 74.73 | 11 |
|
| 84 | Altium Altium
USA · mitre
|
C | 74.67 | 12 |
|
| 85 | Patchstack Patchstack
Estonia · mitre
|
C | 74.65 | 2,522 |
|
| 86 | rami.io rami.io GmbH
Germany · mitre
|
C | 74.62 | 25 |
|
| 87 | TR-CERT TR-CERT (Computer Emergency Response Team of the Republic of Türkiye)
Türkiye · mitre
|
C | 74.5 | 248 |
|
| 88 | Perforce Perforce
USA · mitre
|
C | 74.46 | 14 |
|
| 89 | hp HP Inc.
USA · mitre
|
C | 74.36 | 36 |
|
| 90 | glibc GNU C Library
USA · redhat
|
C | 74.12 | 16 |
|
| 91 | securin Securin
USA · mitre
|
C | 73.89 | 53 |
|
| 92 | Rockwell Rockwell Automation
USA · icscert
|
C | 73.76 | 45 |
|
| 93 | OpenVPN OpenVPN Inc.
USA · mitre
|
C | 73.5 | 23 |
|
| 94 | NCSC-FI National Cyber Security Centre Finland (NCSC-FI)
Finland · ENISA
|
C | 73.48 | 10 |
|
| 95 | zdi Zero Day Initiative
Japan · mitre
|
C | 72.95 | 130 |
|
| 96 | Joomla Joomla! Project
USA · mitre
|
C | 72.59 | 339 |
|
| 97 | Zohocorp Zohocorp
India · mitre
|
C | 72.18 | 44 |
|
| 98 | ASUS ASUSTeK Computer Incorporation
Taiwan · icscert
|
C | 72.15 | 37 |
|
| 99 | DIVD Dutch Institute for Vulnerability Disclosure (DIVD)
Netherlands · ENISA
|
C | 71.99 | 14 |
|
| 100 | tenable Tenable Network Security, Inc.
USA · mitre
|
C | 71.94 | 48 |
|
| 101 | fortinet Fortinet, Inc.
USA · mitre
|
C | 71.82 | 72 |
|
| 102 | GitHub_M GitHub, Inc.
USA · mitre
|
C | 71.61 | 7,465 |
|
| 103 | HDFG The HDF Group
USA · redhat
|
C | 71.5 | 10 |
|
| 104 | runZero runZero, Inc.
USA · icscert
|
C | 70.94 | 26 |
|
| 105 | ERIC Ericsson
Sweden · mitre
|
C | 70.66 | 13 |
|
| 106 | PaperCut PaperCut Software Pty Ltd
Australia · mitre
|
C | 70.42 | 12 |
|
| 107 | mongodb MongoDB, Inc.
USA · mitre
|
C | 70.36 | 184 |
|
| 108 | HashiCorp HashiCorp Inc.
USA · mitre
|
C | 70.0 | 40 |
|
| 109 | Okta Okta
USA · mitre
|
C | 70.0 | 22 |
|
| 110 | HiddenLayer HiddenLayer, Inc.
USA · mitre
|
C | 70.0 | 16 |
|
| 111 | dell Dell
USA · mitre
|
C | 69.71 | 418 |
|
| 112 | TuranSec Turan Security
Uzbekistan · redhat
|
C | 69.67 | 188 |
|
| 113 | GRAFANA Grafana Labs
USA · mitre
|
C | 69.59 | 47 |
|
| 114 | Foxit Foxit Software Incorporated
USA · mitre
|
C | 69.51 | 70 |
|
| 115 | oracle Oracle
USA · mitre
|
C | 69.28 | 3,007 |
|
| 116 | INCD Israel National Cyber Directorate (INCD)
Israel · mitre
|
C | 69.18 | 11 |
|
| 117 | elastic Elastic
Netherlands · mitre
|
C | 69.14 | 141 |
|
| 118 | ZTE ZTE Corporation
China · mitre
|
C | 68.95 | 30 |
|
| 119 | wikimedia-foundation The Wikimedia Foundation
USA · mitre
|
C | 68.88 | 81 |
|
| 120 | fedora Fedora Project
USA · redhat
|
C | 68.56 | 34 |
|
| 121 | Hitachi_Energy Hitachi Energy
Switzerland · icscert
|
C | 68.48 | 12 |
|
| 122 | ABB Asea Brown Boveri Ltd. (ABB)
Switzerland · icscert
|
C | 68.12 | 16 |
|
| 123 | Zscaler Zscaler, Inc.
USA · mitre
|
C | 67.9 | 10 |
|
| 124 | synology Synology Inc.
Taiwan · mitre
|
C | 67.38 | 48 |
|
| 125 | PostgreSQL PostgreSQL
Canada · redhat
|
C | 66.65 | 81 |
|
| 126 | Zyxel Zyxel Corporation
Taiwan · mitre
|
C | 66.53 | 15 |
|
| 127 | cisco Cisco Systems, Inc.
USA · mitre
|
C | 66.45 | 337 |
|
| 128 | checkpoint Check Point Software Ltd.
Israel · mitre
|
C | 65.68 | 17 |
|
| 129 | snowflake | C | 65.5 | 20 |
|
| 130 | openjs OpenJS Foundation
USA · redhat
|
C | 65.27 | 104 |
|
| 131 | schneider Schneider Electric
France · mitre
|
C | 65.17 | 30 |
|
| 132 | Esri Environmental Systems Research Institute, Inc.
USA · mitre
|
C | 65.11 | 22 |
|
| 133 | sap SAP SE
Germany · mitre
|
C | 65.1 | 114 |
|
| 134 | Wordfence Wordfence
USA · mitre
|
C | 65.0 | 2,121 |
|
| 135 | siemens Siemens
Germany · icscert
|
C | 65.0 | 71 |
|
| 136 | @huntr_ai Protect AI (formerly huntr.dev)
USA · mitre
|
C | 65.0 | 44 |
|
| 137 | nvidia NVIDIA Corporation
USA · mitre
|
C | 64.82 | 309 |
|
| 138 | eclipse Eclipse Foundation
Belgium · mitre
|
C | 64.44 | 111 |
|
| 139 | HCL HCL Software
India · mitre
|
C | 64.43 | 185 |
|
| 140 | vmware VMware by Broadcom
USA · mitre
|
C | 64.19 | 253 |
|
| 141 | redhat-cnalr | C | 64.17 | 13 |
|
| 142 | CPANSec CPAN Security Group
Canada · redhat
|
C | 64.05 | 267 |
|
| 143 | 3ds | C | 63.75 | 12 |
|
| 144 | jpcert JPCERT/CC
Japan · mitre
|
C | 63.72 | 185 |
|
| 145 | samsung.tv_appliance Samsung TV & Appliance
South Korea · mitre
|
C | 63.23 | 60 |
|
| 146 | AMD Advanced Micro Devices Inc.
USA · mitre
|
C | 62.84 | 76 |
|
| 147 | NetScaler NetScaler
USA · mitre
|
C | 62.68 | 17 |
|
| 148 | ivanti Ivanti
USA · mitre
|
C | 62.62 | 34 |
|
| 149 | atlassian Atlassian
Australia · mitre
|
C | 61.5 | 11 |
|
| 150 | qualcomm Qualcomm, Inc.
USA · mitre
|
C | 61.49 | 89 |
|
| 151 | Zoom Zoom Communications, Inc.
USA · mitre
|
C | 61.21 | 14 |
|
| 152 | OpenHarmony OpenHarmony
China · mitre
|
C | 60.8 | 10 |
|
| 153 | OX Open-Xchange
Germany · mitre
|
C | 60.62 | 74 |
|
| 154 | Commvault Commvault Systems Inc.
USA · mitre
|
C | 60.57 | 14 |
|
| 155 | Gitea Gitea Limited
China · mitre
|
C | 60.53 | 87 |
|
| 156 | snyk Snyk
UK · mitre
|
C | 60.28 | 18 |
|
| 157 | intel Intel Corporation
USA · mitre
|
C | 60.0 | 96 |
|
| 158 | SN ServiceNow
USA · mitre
|
C | 60.0 | 10 |
|
| 159 | freebsd FreeBSD
USA · mitre
|
D | 59.8 | 56 |
|
| 160 | Tanium Tanium Inc.
USA · mitre
|
D | 59.4 | 40 |
|
| 161 | Absolute Absolute Software
USA · mitre
|
D | 58.96 | 25 |
|
| 162 | Axis Axis Communications AB
Sweden · mitre
|
D | 58.95 | 10 |
|
| 163 | hackerone HackerOne
USA · mitre
|
D | 58.58 | 186 |
|
| 164 | Ubiquiti Ubiquiti, Inc.
USA · mitre
|
D | 58.45 | 29 |
|
| 165 | huawei Huawei Technologies
China · mitre
|
D | 57.06 | 80 |
|
| 166 | JetBrains JetBrains s.r.o.
Czech Republic · mitre
|
D | 57.04 | 148 |
|
| 167 | XEN Xen Project
UK · mitre
|
D | 57.0 | 38 |
|
| 168 | trendmicro Trend Micro, Inc.
Japan · mitre
|
D | 57.0 | 16 |
|
| 169 | hpe Hewlett Packard Enterprise (HPE)
USA · mitre
|
D | 55.26 | 204 |
|
| 170 | CSA Cyber Security Agency of Singapore
Singapore · mitre
|
D | 55.17 | 32 |
|
| 171 | imaginationtech Imagination Technologies
UK · mitre
|
D | 54.91 | 32 |
|
| 172 | Samsung_Mobile Samsung Mobile
South Korea · mitre
|
D | 54.51 | 110 |
|
| 173 | Arm Arm Limited
UK · mitre
|
D | 54.09 | 11 |
|
| 174 | sonicwall SonicWall, Inc.
USA · mitre
|
D | 53.53 | 26 |
|
| 175 | Linux kernel.org
USA · mitre
|
D | 53.41 | 6,623 |
|
| 176 | drupal Drupal.org
USA · mitre
|
D | 52.06 | 103 |
|
| 177 | Unisoc Unisoc (Shanghai) Technologies Co., Ltd.
China · mitre
|
D | 49.5 | 15 |
|
| 178 | curl curl
Sweden · redhat
|
D | 49.44 | 35 |
|
| 179 | hikvision Hangzhou Hikvision Digital Technology Co., Ltd.
China · mitre
|
D | 49.15 | 13 |
|
| 180 | Meta Meta Platforms, Inc.
USA · mitre
|
D | 48.75 | 12 |
|
| 181 | MediaTek MediaTek, Inc.
Taiwan · mitre
|
D | 45.0 | 100 |
|
| 182 | jenkins Jenkins Project
USA · mitre
|
E | 44.28 | 132 |
|
| 183 | DEVOLUTIONS Devolutions Inc.
Canada · mitre
|
E | 44.17 | 57 |
|
| 184 | WPScan WPScan
France · mitre
|
E | 44.03 | 1,460 |
|
| 185 | Chrome Chrome
USA · Google
|
E | 42.44 | 2,760 |
|
| 186 | certcc CERT/CC
USA · mitre
|
E | 42.04 | 152 |
|
| 187 | Go Go Project
USA · Google
|
E | 41.53 | 59 |
|
| 188 | google_android Android (associated with Google Inc. or Open Handset Alliance)
USA · Google
|
E | 39.94 | 198 |
|
| 189 | mozilla Mozilla Corporation
USA · mitre
|
E | 37.95 | 463 |
|
| 190 | Google_Devices Google Devices
USA · Google
|
E | 37.75 | 138 |
|
| 191 | apple Apple Inc.
USA · mitre
|
E | 36.85 | 619 |
|
| 192 | mitre MITRE Corporation
USA
|
E | 26.96 | 2,341 |
|
Under the threshold (164)
Fewer than 10 publications in the window. The score is indicative and these are not ranked: three perfect records are not evidence of a practice.
| HackRTU HackRTU
Spain · INCIBE
|
100.0 | 4 records |
| Nutanix Nutanix
USA · mitre
|
96.8 | 1 record |
| tqtc | 95.14 | 7 records |
| chainguard Chainguard, Inc.
USA · icscert
|
93.0 | 3 records |
| illumos The illumos project
USA · redhat
|
93.0 | 2 records |
| Echo Echo Software Ltd.
Israel · mitre
|
93.0 | 1 record |
| Neo4j Neo4j
Sweden · mitre
|
92.8 | 3 records |
| arcinfo ARC Informatique
France · icscert
|
91.8 | 2 records |
| FTI Fsas Technologies
Germany · mitre
|
91.8 | 2 records |
| ca CA Technologies - A Broadcom Company
USA · mitre
|
91.8 | 1 record |
| Qt Qt Group
Finland · mitre
|
90.78 | 9 records |
| rust The Rust Project
USA · redhat
|
90.5 | 2 records |
| flexera Flexera Software LLC
USA · mitre
|
90.3 | 2 records |
| Cribl Cribl, Inc.
USA · icscert
|
89.8 | 5 records |
| milestonesys Milestone Systems A/S
Denmark · mitre
|
89.8 | 1 record |
| Roche Roche Diagnostics
Switzerland · icscert
|
89.8 | 1 record |
| StrongDM StrongDM
USA · mitre
|
89.8 | 1 record |
| Vestel Vestel Electronics Industry & Trade Co.
Türkiye · mitre
|
89.8 | 1 record |
| Tigera Tigera, Inc.
USA · mitre
|
89.0 | 6 records |
| Checkmarx Checkmarx
Israel · mitre
|
89.0 | 2 records |
| OMICRON OMICRON electronics
Austria · icscert
|
88.47 | 3 records |
| SCHUTZWERK SCHUTZWERK GmbH
Germany · mitre
|
88.0 | 4 records |
| Crestron Crestron Electronics, Inc.
USA · mitre
|
88.0 | 1 record |
| Danfoss Danfoss
Denmark · icscert
|
88.0 | 1 record |
| AlgoSec AlgoSec
Israel · mitre
|
87.0 | 1 record |
| Bull Bull SAS
France · ENISA
|
86.8 | 1 record |
| Hackrate Hackrate Kft.
Hungary · icscert
|
86.66 | 7 records |
| Delinea Delinea, Inc.
USA · mitre
|
86.3 | 4 records |
| postiz Postiz
USA · mitre
|
85.5 | 4 records |
| Microchip Microchip Technology
USA · mitre
|
85.26 | 7 records |
| Mitsubishi Mitsubishi Electric Corporation
Japan · jpcert
|
84.8 | 5 records |
| Canon_EMEA Canon EMEA
UK · mitre
|
84.8 | 2 records |
| NX Network Optix
USA · mitre
|
84.8 | 2 records |
| ASRG Automotive Security Research Group (ASRG)
USA · icscert
|
84.38 | 8 records |
| Softing Softing
Germany · mitre
|
84.0 | 1 record |
| FERMAX Fermax Technologies SLU
Spain · INCIBE
|
83.55 | 4 records |
| libreswan Libreswan Project
No country affiliation · mitre
|
83.5 | 4 records |
| Netskope Netskope
USA · mitre
|
83.2 | 6 records |
| STAR_Labs STAR Labs SG Pte. Ltd.
Singapore · mitre
|
83.0 | 1 record |
| THA-PSIRT Thales Group
France · mitre
|
82.85 | 4 records |
| SRA Security Risk Advisors (SRA)
USA · icscert
|
82.74 | 7 records |
| Tcpdump Tcpdump Group
Canada · mitre
|
82.57 | 7 records |
| PTC PTC Inc.
USA · icscert
|
82.55 | 4 records |
| BlackDuck Black Duck Software, Inc.
USA · mitre
|
82.3 | 4 records |
| M-Files M-Files Corporation
Finland · mitre
|
82.3 | 4 records |
| Payara Payara
UK · mitre
|
82.3 | 2 records |
| Logitech Logitech
Switzerland · mitre
|
82.0 | 1 record |
| wibu WIBU-SYSTEMS AG
Germany · ENISA
|
81.8 | 8 records |
| purestorage | 81.5 | 2 records |
| Altera Altera
USA · mitre
|
80.88 | 8 records |
| OpenNMS The OpenNMS Group
USA · mitre
|
80.4 | 5 records |
| tlt_net Teltonika Networks
Lithuania · icscert
|
80.0 | 3 records |
| Vaadin Vaadin Ltd.
Finland · mitre
|
80.0 | 3 records |
| hsi Haverford Systems, Inc.
USA · icscert
|
80.0 | 1 record |
| Nintendo Nintendo Co., Ltd.
Japan · jpcert
|
80.0 | 1 record |
| ExtremeNetworks Extreme Networks, Inc.
USA · mitre
|
79.87 | 3 records |
| ThinkstAppliedResearch Thinkst Applied Research
South Africa · mitre
|
79.8 | 7 records |
| linqi linqi GmbH
Germany · mitre
|
79.8 | 4 records |
| SICK_AG SICK AG
Germany · mitre
|
79.8 | 2 records |
| Centreon Centreon
France · mitre
|
79.8 | 1 record |
| brocade Brocade Communications Systems LLC, a Broadcom Company
USA · mitre
|
79.44 | 9 records |
| PingIdentity Ping Identity Corporation
USA · mitre
|
79.4 | 5 records |
| dotCMS dotCMS LLC
USA · mitre
|
79.0 | 2 records |
| kubernetes Kubernetes
USA · mitre
|
79.0 | 2 records |
| Toreon Toreon
Belgium · mitre
|
79.0 | 2 records |
| krcert KrCERT/CC
South Korea · mitre
|
78.5 | 6 records |
| Bitdefender Bitdefender
Romania · mitre
|
78.33 | 3 records |
| forcepoint Forcepoint
USA · mitre
|
78.0 | 3 records |
| LGE LG Electronics
South Korea · mitre
|
77.0 | 1 record |
| N-able N-able
USA · mitre
|
76.9 | 6 records |
| seal Seal Security
USA · mitre
|
76.86 | 7 records |
| Medtronic Medtronic
USA · icscert
|
76.8 | 2 records |
| symantec Symantec - A Division of Broadcom
USA · mitre
|
75.3 | 4 records |
| OTRS OTRS AG
Germany · mitre
|
75.0 | 9 records |
| BT BeyondTrust Inc.
USA · mitre
|
75.0 | 6 records |
| Caliptra Caliptra Project
USA · mitre
|
75.0 | 5 records |
| Hanwha_Vision Hanwha Vision Co., Ltd.
South Korea · mitre
|
75.0 | 3 records |
| watchdog WatchDogDevelopment.com, LLC
USA · mitre
|
75.0 | 3 records |
| ELAN ELAN Microelectronics Corp.
Taiwan · mitre
|
75.0 | 1 record |
| Proton Proton AG
Switzerland · mitre
|
75.0 | 1 record |
| yandex Yandex N.V.
Russia · mitre
|
75.0 | 1 record |
| alibaba Alibaba, Inc.
China · mitre
|
74.93 | 3 records |
| The_Missing_Link The Missing Link Australia (TML)
Australia · mitre
|
74.3 | 6 records |
| Kaspersky Kaspersky
Russia · mitre
|
74.14 | 9 records |
| Cato Cato Networks
Israel · mitre
|
74.0 | 3 records |
| Digi Digi International Inc.
USA · icscert
|
73.87 | 3 records |
| YesWeHack YesWeHack
France · ENISA
|
73.33 | 3 records |
| Canon Canon Inc.
Japan · jpcert
|
72.8 | 9 records |
| TCS-CERT TCS-CERT (Thales Cyber Solutions Customer’s CERT)
Belgium · THA-PSIRT
|
72.5 | 6 records |
| Pega Pegasystems Inc.
USA · mitre
|
72.38 | 8 records |
| blackberry BlackBerry
Canada · mitre
|
72.26 | 7 records |
| OpenText OpenText (formerly Micro Focus)
USA · mitre
|
72.17 | 6 records |
| ESET ESET, spol. s r.o.
Slovak Republic · ENISA
|
72.0 | 5 records |
| FSOFT FPT Software Co., Ltd.
Vietnam · mitre
|
72.0 | 1 record |
| Sophos Sophos Limited
UK · mitre
|
72.0 | 1 record |
| TRO Teradyne Robotics
Denmark · icscert
|
72.0 | 1 record |
| airbus Airbus
Netherlands · mitre
|
71.85 | 8 records |
| IQSIGHT IQSIGHT B.V.
Netherlands · ENISA
|
71.8 | 1 record |
| ConnectWise ConnectWise LLC
USA · mitre
|
71.75 | 4 records |
| Anthropic Anthropic, PBC
USA · mitre
|
71.6 | 3 records |
| AHA Austin Hackers Anonymous
USA · mitre
|
71.25 | 4 records |
| Honeywell Honeywell International Inc.
USA · icscert
|
71.07 | 7 records |
| CrowdStrike CrowdStrike Holdings, Inc.
USA · mitre
|
71.0 | 2 records |
| upKeeper upKeeper Solutions
Sweden · mitre
|
70.0 | 3 records |
| bizerba Bizerba SE & Co. KG
Germany · mitre
|
70.0 | 2 records |
| BombadilSystems Bombadil Systems LLC
USA · mitre
|
70.0 | 2 records |
| Supermicro Super Micro Computer, Inc.
USA · mitre
|
70.0 | 2 records |
| AMI AMI
USA · icscert
|
70.0 | 1 record |
| OMRON OMRON Corporation
Japan · jpcert
|
70.0 | 1 record |
| openGauss openGauss Community
China · mitre
|
70.0 | 1 record |
| Pentraze Pentraze Cybersecurity
Dominican Republic · mitre
|
70.0 | 1 record |
| BLSOPS Black Lantern Security
USA · mitre
|
69.29 | 7 records |
| BCNY The Browser Company of New York
USA · mitre
|
69.25 | 4 records |
| hitvan | 69.25 | 4 records |
| FSI Financial Security Institute (FSI)
South Korea · mitre
|
69.2 | 5 records |
| sba-research SBA Research gGmbH
Austria · mitre
|
69.0 | 8 records |
| ASR ASR Microelectronics Co., Ltd.
China · icscert
|
69.0 | 3 records |
| bosch Robert Bosch GmbH
Germany · icscert
|
68.8 | 9 records |
| Jaspersoft Jaspersoft
USA · mitre
|
68.5 | 2 records |
| Trellix Trellix
USA · mitre
|
68.5 | 2 records |
| Citrix Citrix Systems, Inc.
USA · mitre
|
68.2 | 5 records |
| Acronis Acronis International GmbH
Switzerland · mitre
|
68.13 | 9 records |
| Everpure Everpure, Inc.
USA · mitre
|
68.0 | 3 records |
| WindRiver Wind River Systems Inc.
USA · icscert
|
67.9 | 5 records |
| OPPO OPPO Mobile Telecommunication Corp., Ltd.
China · mitre
|
67.75 | 4 records |
| EDB EnterpriseDB Corporation
USA · mitre
|
67.5 | 6 records |
| Secomea Secomea A/S
Denmark · icscert
|
67.5 | 2 records |
| Vivo Vivo Mobile Communication Co., Ltd.
China · mitre
|
67.0 | 4 records |
| GandC Glyph & Cog, LLC
USA · redhat
|
67.0 | 1 record |
| HYPR HYPR Corp
USA · mitre
|
67.0 | 1 record |
| dahua Dahua Technologies
China · mitre
|
66.67 | 3 records |
| netapp NetApp, Inc.
USA · mitre
|
66.64 | 5 records |
| Canva Canva
Australia · mitre
|
66.4 | 5 records |
| cloudflare Cloudflare, Inc.
USA · mitre
|
65.96 | 5 records |
| SailPoint SailPoint Technologies
USA · mitre
|
65.5 | 4 records |
| Securifera Securifera, Inc.
USA · mitre
|
65.0 | 7 records |
| Seagate Seagate Technology
USA · mitre
|
65.0 | 3 records |
| FB Fujifilm Business Innovation Corp.
Japan · jpcert
|
65.0 | 1 record |
| YokogawaGroup Yokogawa Group
Japan · jpcert
|
65.0 | 1 record |
| TXOne TXOne Networks, Inc.
Taiwan · icscert
|
64.8 | 1 record |
| 9front 9front Systems
USA · mitre
|
64.3 | 2 records |
| Genetec Genetec Inc.
Canada · mitre
|
64.17 | 6 records |
| talos Talos
USA · mitre
|
64.13 | 6 records |
| Insyde Insyde Software
USA · mitre
|
64.12 | 8 records |
| NEC NEC Corporation
Japan · jpcert
|
63.5 | 4 records |
| SK-CERT National Cyber Security Centre SK-CERT
Slovak Republic · ENISA
|
63.5 | 2 records |
| Eaton Eaton
Ireland · mitre
|
62.43 | 8 records |
| Panasonic_Holdings_Corporation Panasonic Holdings Corporation
Japan · jpcert
|
62.0 | 1 record |
| Mautic Mautic
USA · mitre
|
60.0 | 7 records |
| Gallagher Gallagher Group Ltd.
New Zealand · icscert
|
60.0 | 4 records |
| Spotfire Spotfire
USA · mitre
|
60.0 | 1 record |
| Bugcrowd Bugcrowd Inc.
USA · mitre
|
59.67 | 9 records |
| systemd The systemd project
Germany · redhat
|
59.67 | 3 records |
| Octopus Octopus Deploy
Australia · mitre
|
59.17 | 9 records |
| LY-Corporation LY Corporation
Japan · jpcert
|
57.5 | 8 records |
| Ciena Ciena Corporation
USA · mitre
|
57.45 | 4 records |
| Omnissa Omnissa, LLC
USA · mitre
|
57.0 | 2 records |
| tibco TIBCO Software Inc.
USA · mitre
|
57.0 | 1 record |
| OAI OpenAI
USA · mitre
|
54.17 | 6 records |
| TECNOMobile TECNO Mobile Limited
China · mitre
|
53.5 | 2 records |
| Honor Honor Device Co., Ltd.
China · mitre
|
52.0 | 3 records |
| naver Naver Corporation
South Korea · mitre
|
51.8 | 1 record |
| Nokia Nokia
Finland · mitre
|
39.62 | 8 records |
| debian Debian GNU/Linux
USA · mitre
|
35.0 | 2 records |
The ranked CNAs graded A over the window: a mean score of 90 or more across their publications.
A
99.03 · 38 records
A
96.31 · 294 records
A
95.73 · 11 records
A
95.24 · 86 records
A
95.0 · 29 records
A
93.16 · 125 records
A
91.84 · 34 records
A
91.48 · 19 records
A
91.2 · 73 records
A
91.1 · 10 records
Named practices with an objective threshold, over the window, among the ranked CNAs. A listing names what to change; the bottom of a ranking does not.
Severity supplied by an ADP for more than half the records
24
- apple 100% / 619
- jenkins 100% / 132
- MediaTek 100% / 100
- Go 100% / 59
- DEVOLUTIONS 100% / 57
- freebsd 100% / 56
- openssl 100% / 43
- curl 100% / 35
- imaginationtech 100% / 32
- sonicwall 100% / 26
- Arm 100% / 11
- Chrome 100% / 2760
- mozilla 100% / 463
- Google_Devices 99% / 138
- certcc 99% / 152
- CPANSec 98% / 267
- drupal 96% / 103
- google_android 91% / 198
- WPScan 90% / 1460
- Gitea 80% / 87
- mitre 74% / 2341
- apache 73% / 926
- XEN 71% / 38
- Meta 58% / 12
Descriptions under 100 characters on more than 30% of the records
6
- Tanium 98% / 40
- OpenHarmony 80% / 10
- Patchstack 66% / 2522
- Deltaww 59% / 22
- Gitea 48% / 87
- qualcomm 37% / 89
Affected products missing or 'n/a' on more than half the records
1
- mitre 78% / 2341
Known-exploited vulnerabilities published without a severity statement
10
- mitre 5 / 2341
- sonicwall 4 / 26
- Chrome 3 / 2760
- apple 2 / 619
- WPScan 1 / 1460
- Joomla 1 / 339
- google_android 1 / 198
- hackerone 1 / 186
- Google_Devices 1 / 138
- jenkins 1 / 132
The rules
Each record earns a credit in 0..1 per rule; the record's score is the weighted sum, the assigner's is the mean.
Describe: can a reader tell what the vulnerability is? (25 points)
- Description (10): An English description that is not a placeholder: full credit from 200 characters, 0.7 from 80, 0.4 from 40, none below.
- Title (5): A title.
- Cwe (10): A weakness as a CWE identifier in problemTypes; a free-text problem type without one earns a quarter.
Scope: can a reader tell whether they are affected? (25 points)
- Affected (10): An affected entry naming both a vendor and a product; one side missing or 'n/a' earns half.
- Versions (8): An affected entry stating versions, as a version or a bound; a defaultStatus alone earns half.
- Cpe (7): A CPE on an affected entry, or a cpeApplicability block.
Assess: can a reader tell how bad it is? (25 points)
- Severity (15): A severity statement in the CNA container: a CVSS v3 or v4 vector, an SSVC decision, or a vendor rating as an 'other' metric. A CVSS v2 vector alone earns half.
- Modern severity (5): A CVSS v4 vector or an SSVC decision.
- Impacts (5): An impacts entry (a CAPEC identifier or an impact description).
Act: can a reader tell what to do about it? (25 points)
- References (7): At least one reference.
- Reference tags (5): At least one reference carrying tags.
- Remediation (8): A reference tagged 'patch'; one tagged 'vendor-advisory', 'mitigation' or 'release-notes' earns 0.6.
- Solutions (5): A solution or a workaround.
Grades: A from 90, B from 75, C from 60, D from 45, E from 0. Timeliness is displayed on each assigner's page and never scored: a long reservation-to-publication delay is a disclosure embargo as often as a backlog. The full text, with the methodology history, is in the documentation.