Insights

CNA scorecard

How well each CVE Numbering Authority fills the records it publishes, scored against a published set of rules: Describe, Scope, Assess, Act, 25 points each. Only what the assigner wrote itself counts; severity and weaknesses added later by an ADP are shown as a dependency, not as the assigner's work.

CNAs
GNAs

193

Ranked CNAs

163

Under the threshold

180 days

Rolling window

Grade A

Prepared 2026-10-02T06:17:03+00:00 by Vulnerability-Lookup v6.2.1-123-gafebd4e5 Methodology v1 since 2026-09-29 Ranked from 10 publications in the window API · Markdown

#	CNA	Grade	Score	Records
1	secur0	A	99.03	38
2	eef	A	96.35	294
3	temporal	A	95.73	11
4	palo_alto	A	95.24	86
5	isc	A	95.0	29
6	amzn	A	93.16	125
7	netgear	A	91.84	34
8	checkmk	A	91.51	21
9	watchguard	A	91.2	73
10	autodesk	B	89.9	29
11	sonatype	B	89.9	29
12	docker	B	89.85	15
13	cert-in	B	89.46	23
14	circl	B	89.23	221
15	wso2	B	88.89	45
16	fluid attacks	B	88.55	60
17	ibm	B	87.66	1,054
18	tplink	B	87.37	93
19	arista	B	86.41	65
20	incibe	B	86.33	92
21	kong	B	84.9	16
22	juniper	B	84.8	49
23	asustor1	B	84.8	11
24	concretecms	B	84.36	111
25	harborist	B	84.36	10
26	vulncheck	B	84.3	5,167
27	silabs	B	83.88	33
28	dsf	B	83.79	22
29	ni	B	83.69	33
30	gv	B	83.66	80
31	typo3	B	83.61	52
32	herodevs	B	83.17	12
33	lenovo	B	83.13	41
34	solarwinds	B	83.07	23
35	f5	B	83.03	76
36	github_p	B	82.72	26
37	nlnet labs	B	82.03	57
38	bcorg	B	81.99	42
39	vuldb	B	81.86	3,855
40	twcert	B	81.66	97
41	microsoft	B	81.57	2,673
42	redhat	B	81.53	919
43	rti	B	81.4	20
44	nozomi	B	81.0	60
45	tv	B	80.86	10
46	prjblk	B	80.78	11
47	cert-pl	B	80.67	221
48	sec-vlab	B	80.5	23
49	canonical	B	80.34	106
50	ncsc.ch	B	80.21	64
51	php	B	80.1	25
52	mattermost	B	79.71	113
53	enisa	B	79.65	34
54	psf	B	79.53	34
55	qnap	B	79.27	26
56	mandiant	B	79.25	12
57	zabbix	B	79.14	14
58	suse	B	79.08	96
59	hitachi	B	78.85	20
60	progresssoftware	B	78.81	78
61	deltaww	B	78.74	23
62	openssl	B	78.0	50
63	pandorafms	B	77.71	21
64	googlecloud	B	77.3	27
65	zephyr	B	76.92	146
66	jci	B	76.49	27
67	wolfssl	B	76.09	69
68	cyberdanube	B	76.0	20
69	fortra	B	75.97	18
70	rapid7	B	75.81	53
71	apache	B	75.68	862
72	gen	B	75.68	19
73	certvde	B	75.59	145
74	cisa-cg	B	75.51	124
75	acer	B	75.18	49
76	gitlab	B	75.12	274
77	jfrog	B	75.03	60
78	document fdn.	B	75.0	15
79	google	C	74.88	32
80	adobe	C	74.74	680
81	zuso art	C	74.73	11
82	altium	C	74.67	12
83	patchstack	C	74.64	2,478
84	icscert	C	74.64	321
85	tr-cert	C	74.49	239
86	rami.io	C	74.36	27
87	hp	C	74.21	35
88	glibc	C	74.12	16
89	securin	C	73.89	53
90	rockwell	C	73.76	45
91	runzero	C	73.74	38
92	openvpn	C	73.5	23
93	ncsc-fi	C	73.48	10
94	zdi	C	72.95	130
95	pega	C	72.9	10
96	joomla	C	72.53	331
97	zohocorp	C	72.18	44
98	asus	C	72.07	37
99	divd	C	71.99	14
100	tenable	C	71.94	48
101	fortinet	C	71.82	72
102	github_m	C	71.61	7,652
103	hdfg	C	71.5	10
104	eric	C	70.66	13
105	papercut	C	70.42	12
106	mongodb	C	70.31	183
107	hashicorp	C	70.0	41
108	okta	C	70.0	22
109	hiddenlayer	C	70.0	16
110	dell	C	69.72	422
111	turansec	C	69.7	188
112	wikimedia-foundation	C	69.64	93
113	foxit	C	69.51	70
114	grafana	C	69.48	46
115	oracle	C	69.28	3,007
116	elastic	C	69.18	147
117	incd	C	69.18	11
118	zte	C	68.95	30
119	fedora	C	68.56	34
120	hitachi energy	C	68.48	12
121	abb	C	68.12	16
122	zscaler	C	67.9	10
123	synology	C	67.38	48
124	postgresql	C	66.65	81
125	zyxel	C	66.53	15
126	cisco	C	66.45	337
127	checkpoint	C	65.68	17
128	snowflake	C	65.5	20
129	openjs	C	65.27	104
130	schneider	C	65.17	30
131	esri	C	65.11	22
132	sap	C	65.1	114
133	wordfence	C	65.0	2,109
134	siemens	C	65.0	71
135	@huntr_ai	C	65.0	48
136	nvidia	C	64.81	315
137	hcl	C	64.43	184
138	eclipse	C	64.35	111
139	redhat-cnalr	C	64.17	13
140	cpansec	C	64.15	265
141	vmware	C	64.14	251
142	3ds	C	63.75	12
143	jpcert	C	63.71	189
144	samsung.tv_appliance	C	63.23	60
145	netscaler	C	62.84	16
146	amd	C	62.78	74
147	ivanti	C	62.62	34
148	talos	C	62.07	12
149	atlassian	C	61.9	10
150	qualcomm	C	61.47	91
151	zoom	C	61.21	14
152	openharmony	C	60.8	10
153	ox	C	60.62	74
154	commvault	C	60.57	14
155	gitea	C	60.53	87
156	snyk	C	60.28	18
157	intel	C	60.0	97
158	sn	C	60.0	10
159	freebsd	D	59.8	56
160	tanium	D	59.4	40
161	absolute	D	58.96	25
162	axis	D	58.95	10
163	hackerone	D	58.61	183
164	ubiquiti	D	58.45	29
165	huawei	D	57.06	80
166	jetbrains	D	57.04	148
167	xen	D	57.0	38
168	trendmicro	D	57.0	16
169	hpe	D	55.3	204
170	csa	D	55.17	32
171	imaginationtech	D	54.91	32
172	samsungmobile	D	54.51	110
173	arm	D	54.09	11
174	linux	D	53.62	6,422
175	sonicwall	D	53.53	26
176	drupal	D	51.96	103
177	meta	D	50.0	12
178	unisoc	D	49.5	15
179	curl	D	49.44	35
180	hikvision	D	49.15	13
181	mediatek	D	45.0	73
182	jenkins	E	44.28	132
183	devolutions	E	44.17	57
184	wpscan	E	43.96	1,417
185	chrome	E	42.39	2,808
186	certcc	E	42.02	151
187	go	E	41.44	71
188	google_android	E	40.34	173
189	nokia	E	38.91	11
190	mozilla	E	37.96	467
191	google_devices	E	37.75	138
192	apple	E	36.85	619
193	mitre	E	26.5	2,392

Under the threshold (163)

Fewer than 10 publications in the window. The score is indicative and these are not ranked: three perfect records are not evidence of a practice.

hackrtu	100.0	4 records
nutanix	96.8	1 record
tqtc	95.14	7 records
illumos	93.0	2 records
echo	93.0	1 record
neo4j	92.8	3 records
arcinfo	91.8	2 records
fti	91.8	2 records
ca	91.8	1 record
qt	91.25	8 records
rust	90.5	2 records
moxa	90.47	9 records
flexera	90.3	2 records
cribl	89.8	5 records
milestone	89.8	1 record
roche	89.8	1 record
strongdm	89.8	1 record
vestel	89.8	1 record
tigera	89.0	6 records
checkmarx	89.0	2 records
omicron	88.47	3 records
schutzwerk	88.0	4 records
crestron	88.0	1 record
danfoss	88.0	1 record
algosec	87.0	1 record
bull	86.8	1 record
hackrate	86.63	6 records
delinea	86.3	4 records
postiz	85.5	4 records
microchip	85.26	7 records
mitsubishi	84.8	7 records
canon_emea	84.8	2 records
nx	84.8	2 records
asrg	84.38	8 records
softing	84.0	1 record
fermax	83.55	4 records
libreswan	83.5	4 records
netskope	83.2	6 records
star_labs	83.0	1 record
tha-psirt	82.85	4 records
sra	82.74	7 records
tcpdump	82.57	7 records
ptc	82.55	4 records
blackduck	82.3	4 records
m-files corporation	82.3	4 records
payara	82.3	2 records
swi	82.0	3 records
logitech	82.0	1 record
wibu	81.8	7 records
purestorage	81.5	2 records
altera	80.88	8 records
opennms	80.4	5 records
tlt_net	80.0	3 records
vaadin	80.0	3 records
hsi	80.0	1 record
nintendo	80.0	1 record
extremenetworks	79.87	3 records
thinkstappliedresearch	79.8	7 records
linqi	79.8	4 records
sick ag	79.8	2 records
centreon	79.8	1 record
brocade	79.44	9 records
dotcms	79.0	2 records
kubernetes	79.0	2 records
toreon	79.0	2 records
ping identity	78.8	5 records
krcert	78.5	6 records
bitdefender	78.33	3 records
forcepoint	78.0	3 records
perforce	77.8	8 records
lge	77.0	1 record
n-able	76.9	6 records
seal	76.86	7 records
medtronic	76.8	2 records
symantec	75.3	4 records
otrs	75.0	9 records
bt	75.0	6 records
caliptra	75.0	5 records
hanwha_vision	75.0	3 records
watchdog	75.0	3 records
elan	75.0	1 record
proton	75.0	1 record
yandex	75.0	1 record
alibaba	74.93	3 records
tml	74.3	6 records
kaspersky	74.14	9 records
cato	74.0	3 records
yeswehack	73.33	3 records
canon	72.8	9 records
tcs-cert	72.5	6 records
blackberry	72.26	7 records
opentext	72.17	6 records
eset	72.0	5 records
fsoft	72.0	1 record
sophos	72.0	1 record
tro	72.0	1 record
airbus	71.85	8 records
iqsight	71.8	1 record
connectwise	71.75	4 records
anthropic	71.6	3 records
aha	71.25	4 records
crowdstrike	71.0	2 records
honeywell	70.94	8 records
digi	70.9	2 records
upkeeper	70.0	3 records
bizerba	70.0	2 records
bombadilsystems	70.0	2 records
supermicro	70.0	2 records
ami	70.0	1 record
omron	70.0	1 record
opengauss	70.0	1 record
pentraze	70.0	1 record
blsops	69.29	7 records
bcny	69.25	4 records
hitvan	69.25	4 records
fsi	69.2	5 records
sba-research	69.0	8 records
asr	69.0	3 records
bosch	68.8	9 records
jaspersoft	68.5	2 records
trellix	68.5	2 records
citrix	68.2	5 records
acronis	68.13	9 records
everpure	68.0	3 records
windriver	67.9	5 records
oppo	67.75	4 records
edb	67.5	6 records
secomea	67.5	2 records
vivo	67.0	4 records
gandc	67.0	1 record
hypr	67.0	1 record
dahua	66.67	3 records
netapp	66.64	5 records
canva	66.4	5 records
cloudflare	65.96	5 records
sailpoint	65.5	4 records
securifera	65.0	7 records
seagate	65.0	3 records
fb	65.0	1 record
yokogawagroup	65.0	1 record
txone	64.8	1 record
9front	64.3	2 records
genetec	64.17	6 records
insyde	64.12	8 records
nec	63.5	4 records
sk-cert	63.5	2 records
eaton	62.43	8 records
panasonic_holdings_corporation	62.0	1 record
mautic	60.0	7 records
gallagher	60.0	4 records
spotfire	60.0	1 record
bugcrowd	59.67	9 records
systemd	59.67	3 records
octopus	59.17	9 records
ly-corporation	57.5	8 records
ciena	57.45	4 records
omnissa	57.0	2 records
tibco	57.0	1 record
oai	54.17	6 records
tecnomobile	53.5	2 records
honor	52.0	3 records
naver	51.8	1 record
debian	35.0	2 records

The ranked CNAs graded A over the window: a mean score of 90 or more across their publications.

99.03 · 38 records

96.35 · 294 records

95.73 · 11 records

95.24 · 86 records

95.0 · 29 records

93.16 · 125 records

91.84 · 34 records

91.51 · 21 records

91.2 · 73 records

The rules Each record earns a credit in 0..1 per rule; the record's score is the weighted sum, the assigner's is the mean.

Describe: can a reader tell what the vulnerability is? (25 points)

Description (10): An English description that is not a placeholder: full credit from 200 characters, 0.7 from 80, 0.4 from 40, none below.
Title (5): A title.
Cwe (10): A weakness as a CWE identifier in problemTypes; a free-text problem type without one earns a quarter.

Scope: can a reader tell whether they are affected? (25 points)

Affected (10): An affected entry naming both a vendor and a product; one side missing or 'n/a' earns half.
Versions (8): An affected entry stating versions, as a version or a bound; a defaultStatus alone earns half.
Cpe (7): A CPE on an affected entry, or a cpeApplicability block.

Assess: can a reader tell how bad it is? (25 points)

Severity (15): A severity statement in the CNA container: a CVSS v3 or v4 vector, an SSVC decision, or a vendor rating as an 'other' metric. A CVSS v2 vector alone earns half.
Modern severity (5): A CVSS v4 vector or an SSVC decision.
Impacts (5): An impacts entry (a CAPEC identifier or an impact description).

Act: can a reader tell what to do about it? (25 points)

References (7): At least one reference.
Reference tags (5): At least one reference carrying tags.
Remediation (8): A reference tagged 'patch'; one tagged 'vendor-advisory', 'mitigation' or 'release-notes' earns 0.6.
Solutions (5): A solution or a workaround.

Grades: A from 90, B from 75, C from 60, D from 45, E from 0. Timeliness is displayed on each assigner's page and never scored: a long reservation-to-publication delay is a disclosure embargo as often as a backlog. The full text, with the methodology history, is in the documentation.