Insights

CNA scorecard

How well each CVE Numbering Authority fills the records it publishes, scored against a published set of rules: Describe, Scope, Assess, Act, 25 points each. Only what the assigner wrote itself counts; severity and weaknesses added later by an ADP are shown as a dependency, not as the assigner's work.

CNAs
GNAs

193

Ranked CNAs

163

Under the threshold

180 days

Rolling window

Grade A

Prepared 2026-10-07T15:17:02+00:00 by Vulnerability-Lookup v6.2.1-123-gafebd4e5 Methodology v1 since 2026-09-29 Ranked from 10 publications in the window API · Markdown

#	CNA	Grade	Score	Records
1	secur0	A	99.03	38
2	eef	A	96.31	294
3	temporal	A	95.73	11
4	palo_alto	A	95.24	86
5	isc	A	95.0	29
6	amzn	A	93.2	128
7	netgear	A	91.84	34
8	checkmk	A	91.42	16
9	watchguard	A	91.2	73
10	moxa	A	91.1	10
11	autodesk	B	89.9	29
12	sonatype	B	89.89	27
13	circl	B	89.78	233
14	cert-in	B	89.75	26
15	wso2	B	88.89	45
16	fluid attacks	B	88.81	62
17	docker	B	88.61	26
18	ibm	B	87.65	1,072
19	tplink	B	87.35	90
20	arista	B	87.25	89
21	dsf	B	85.54	21
22	incibe	B	85.48	114
23	kong	B	84.9	16
24	juniper	B	84.8	22
25	asustor1	B	84.8	12
26	harborist	B	84.69	11
27	concretecms	B	84.36	111
28	vulncheck	B	84.34	5,237
29	ni	B	83.99	28
30	silabs	B	83.88	33
31	bcorg	B	83.76	78
32	gv	B	83.66	80
33	typo3	B	83.61	52
34	herodevs	B	83.17	12
35	lenovo	B	83.13	41
36	solarwinds	B	83.07	23
37	f5	B	83.03	76
38	github_p	B	82.87	28
39	vuldb	B	82.09	3,761
40	nlnet labs	B	82.03	57
41	twcert	B	81.66	97
42	microsoft	B	81.57	2,674
43	rti	B	81.4	20
44	redhat	B	81.39	957
45	nozomi	B	81.0	60
46	tv	B	80.86	10
47	prjblk	B	80.78	11
48	cert-pl	B	80.55	219
49	sec-vlab	B	80.5	23
50	canonical	B	80.26	102
51	php	B	80.1	25
52	hitachi	B	79.83	18
53	mattermost	B	79.71	110
54	enisa	B	79.65	34
55	ncsc.ch	B	79.59	74
56	psf	B	79.53	34
57	wolfssl	B	79.52	52
58	zabbix	B	79.4	20
59	qnap	B	79.27	26
60	mandiant	B	79.25	12
61	progresssoftware	B	79.21	84
62	suse	B	79.08	96
63	deltaww	B	78.86	22
64	openssl	B	78.0	43
65	pandorafms	B	77.71	21
66	googlecloud	B	77.3	27
67	zephyr	B	76.95	150
68	jci	B	76.69	28
69	rapid7	B	76.2	53
70	apache	B	76.0	925
71	cyberdanube	B	76.0	20
72	fortra	B	75.97	18
73	gen	B	75.68	19
74	cisa-cg	B	75.66	127
75	certvde	B	75.59	145
76	acer	B	75.18	49
77	gitlab	C	74.95	261
78	jfrog	C	74.95	61
79	google	C	74.88	32
80	icscert	C	74.85	327
81	document fdn.	C	74.76	21
82	adobe	C	74.74	680
83	zuso art	C	74.73	11
84	patchstack	C	74.69	2,537
85	altium	C	74.67	12
86	rami.io	C	74.62	25
87	securin	C	74.6	51
88	tr-cert	C	74.51	250
89	perforce	C	74.46	14
90	hp	C	74.36	36
91	glibc	C	74.12	16
92	rockwell	C	73.76	45
93	openvpn	C	73.5	23
94	ncsc-fi	C	73.48	10
95	zdi	C	72.95	130
96	divd	C	72.67	14
97	joomla	C	72.6	341
98	zohocorp	C	72.18	44
99	asus	C	72.14	41
100	tenable	C	71.94	48
101	fortinet	C	71.82	72
102	github_m	C	71.6	7,523
103	hdfg	C	71.25	12
104	runzero	C	70.94	26
105	eric	C	70.66	13
106	papercut	C	70.42	12
107	mongodb	C	70.36	184
108	hashicorp	C	70.0	40
109	okta	C	70.0	22
110	hiddenlayer	C	70.0	16
111	dell	C	69.72	440
112	turansec	C	69.67	188
113	grafana	C	69.59	47
114	foxit	C	69.51	70
115	oracle	C	69.28	3,007
116	incd	C	69.18	11
117	elastic	C	69.03	155
118	zte	C	68.95	30
119	wikimedia-foundation	C	68.88	81
120	fedora	C	68.56	34
121	hitachi energy	C	68.48	12
122	abb	C	68.12	16
123	zscaler	C	67.9	10
124	synology	C	67.28	46
125	postgresql	C	66.65	81
126	zyxel	C	66.53	15
127	cisco	C	66.45	337
128	checkpoint	C	65.68	17
129	snowflake	C	65.5	20
130	openjs	C	65.27	104
131	schneider	C	65.17	30
132	esri	C	65.11	22
133	sap	C	65.1	114
134	wordfence	C	65.0	2,112
135	siemens	C	65.0	71
136	@huntr_ai	C	65.0	43
137	nvidia	C	64.81	311
138	eclipse	C	64.45	112
139	hcl	C	64.43	185
140	vmware	C	64.27	254
141	redhat-cnalr	C	64.17	13
142	cpansec	C	64.05	267
143	3ds	C	63.75	12
144	jpcert	C	63.71	186
145	samsung.tv_appliance	C	63.25	59
146	amd	C	62.86	77
147	netscaler	C	62.68	17
148	ivanti	C	62.62	34
149	atlassian	C	61.5	11
150	qualcomm	C	61.49	89
151	zoom	C	61.21	14
152	openharmony	C	60.8	10
153	ox	C	60.62	74
154	commvault	C	60.57	14
155	gitea	C	60.48	117
156	snyk	C	60.28	18
157	intel	C	60.0	96
158	sn	C	60.0	10
159	freebsd	D	59.8	56
160	octopus	D	59.75	10
161	tanium	D	59.4	40
162	absolute	D	58.96	25
163	axis	D	58.95	10
164	hackerone	D	58.69	192
165	ubiquiti	D	58.45	29
166	huawei	D	57.06	80
167	jetbrains	D	57.04	150
168	xen	D	57.0	38
169	trendmicro	D	57.0	16
170	hpe	D	55.17	241
171	csa	D	55.17	32
172	imaginationtech	D	54.91	32
173	samsungmobile	D	54.51	110
174	arm	D	54.09	11
175	sonicwall	D	53.88	26
176	linux	D	53.53	6,624
177	drupal	D	52.06	103
178	unisoc	D	49.5	15
179	curl	D	49.44	35
180	hikvision	D	49.15	13
181	meta	D	48.75	12
182	mediatek	D	45.0	100
183	jenkins	E	44.28	132
184	devolutions	E	44.21	60
185	wpscan	E	44.05	1,482
186	chrome	E	42.58	3,007
187	certcc	E	42.03	143
188	go	E	41.53	59
189	google_android	E	39.94	198
190	mozilla	E	37.95	463
191	google_devices	E	37.74	144
192	apple	E	36.85	619
193	mitre	E	27.01	2,357

Under the threshold (163)

Fewer than 10 publications in the window. The score is indicative and these are not ranked: three perfect records are not evidence of a practice.

hackrtu	100.0	4 records
nutanix	96.8	1 record
tqtc	95.14	7 records
chainguard	93.0	3 records
illumos	93.0	2 records
echo	93.0	1 record
neo4j	92.8	3 records
arcinfo	91.8	2 records
fti	91.8	2 records
ca	91.8	1 record
qt	90.78	9 records
rust	90.5	2 records
cribl	89.8	5 records
milestone	89.8	1 record
roche	89.8	1 record
strongdm	89.8	1 record
vestel	89.8	1 record
tigera	89.0	6 records
checkmarx	89.0	2 records
omicron	88.47	3 records
schutzwerk	88.0	4 records
crestron	88.0	1 record
danfoss	88.0	1 record
algosec	87.0	1 record
bull	86.8	1 record
hackrate	86.66	7 records
delinea	86.3	4 records
postiz	85.5	4 records
microchip	85.26	7 records
flexera	85.2	3 records
mitsubishi	84.8	5 records
canon_emea	84.8	2 records
nx	84.8	2 records
asrg	84.38	8 records
softing	84.0	1 record
fermax	83.55	4 records
libreswan	83.5	4 records
netskope	83.2	6 records
star_labs	83.0	1 record
tha-psirt	82.85	4 records
sra	82.74	7 records
tcpdump	82.57	7 records
ptc	82.55	4 records
blackduck	82.3	4 records
m-files corporation	82.3	4 records
payara	82.3	2 records
logitech	82.0	1 record
wibu	81.8	8 records
purestorage	81.5	2 records
altera	80.88	8 records
opennms	80.4	5 records
tlt_net	80.0	3 records
vaadin	80.0	3 records
hsi	80.0	1 record
nintendo	80.0	1 record
extremenetworks	79.87	3 records
thinkstappliedresearch	79.8	7 records
linqi	79.8	4 records
sick ag	79.8	2 records
centreon	79.8	1 record
brocade	79.44	9 records
ping identity	79.4	5 records
dotcms	79.0	2 records
kubernetes	79.0	2 records
toreon	79.0	2 records
krcert	78.5	6 records
bitdefender	78.33	3 records
forcepoint	78.0	3 records
lge	77.0	1 record
n-able	76.9	6 records
seal	76.86	7 records
medtronic	76.8	2 records
symantec	75.3	4 records
otrs	75.0	9 records
bt	75.0	6 records
caliptra	75.0	5 records
hanwha_vision	75.0	3 records
watchdog	75.0	3 records
elan	75.0	1 record
proton	75.0	1 record
yandex	75.0	1 record
alibaba	74.93	3 records
tml	74.3	6 records
kaspersky	74.14	9 records
cato	74.0	3 records
digi	73.87	3 records
opentext	73.54	7 records
yeswehack	73.33	3 records
canon	72.8	9 records
tcs-cert	72.5	6 records
pega	72.38	8 records
blackberry	72.26	7 records
eset	72.0	6 records
fsoft	72.0	1 record
sophos	72.0	1 record
tro	72.0	1 record
airbus	71.85	8 records
iqsight	71.8	1 record
connectwise	71.75	4 records
aha	71.25	4 records
anthropic	71.2	4 records
honeywell	71.07	7 records
crowdstrike	71.0	2 records
upkeeper	70.0	3 records
bizerba	70.0	2 records
bombadilsystems	70.0	2 records
supermicro	70.0	2 records
ami	70.0	1 record
omron	70.0	1 record
opengauss	70.0	1 record
pentraze	70.0	1 record
blsops	69.29	7 records
bcny	69.25	4 records
hitvan	69.25	4 records
fsi	69.2	5 records
sba-research	69.0	8 records
asr	69.0	3 records
bosch	68.8	9 records
jaspersoft	68.5	2 records
trellix	68.5	2 records
citrix	68.2	5 records
everpure	68.0	3 records
acronis	67.92	8 records
windriver	67.9	5 records
oppo	67.75	4 records
edb	67.5	6 records
secomea	67.5	2 records
vivo	67.0	4 records
gandc	67.0	1 record
hypr	67.0	1 record
dahua	66.67	3 records
netapp	66.64	5 records
canva	66.4	5 records
cloudflare	65.96	5 records
sailpoint	65.5	4 records
securifera	65.0	7 records
seagate	65.0	3 records
fb	65.0	1 record
yokogawagroup	65.0	1 record
txone	64.8	1 record
9front	64.3	2 records
genetec	64.17	6 records
insyde	64.12	8 records
nec	63.5	4 records
sk-cert	63.5	2 records
talos	63.1	8 records
eaton	62.43	8 records
panasonic_holdings_corporation	62.0	1 record
mautic	60.0	7 records
gallagher	60.0	4 records
spotfire	60.0	1 record
bugcrowd	59.67	9 records
systemd	59.67	3 records
ly-corporation	57.5	8 records
ciena	57.45	4 records
omnissa	57.0	2 records
tibco	57.0	1 record
oai	54.17	6 records
tecnomobile	53.5	2 records
honor	52.0	3 records
naver	51.8	1 record
nokia	39.62	8 records
debian	35.0	2 records

The ranked CNAs graded A over the window: a mean score of 90 or more across their publications.

99.03 · 38 records

96.31 · 294 records

95.73 · 11 records

95.24 · 86 records

95.0 · 29 records

93.2 · 128 records

91.84 · 34 records

91.42 · 16 records

91.2 · 73 records

91.1 · 10 records

The rules Each record earns a credit in 0..1 per rule; the record's score is the weighted sum, the assigner's is the mean.

Describe: can a reader tell what the vulnerability is? (25 points)

Description (10): An English description that is not a placeholder: full credit from 200 characters, 0.7 from 80, 0.4 from 40, none below.
Title (5): A title.
Cwe (10): A weakness as a CWE identifier in problemTypes; a free-text problem type without one earns a quarter.

Scope: can a reader tell whether they are affected? (25 points)

Affected (10): An affected entry naming both a vendor and a product; one side missing or 'n/a' earns half.
Versions (8): An affected entry stating versions, as a version or a bound; a defaultStatus alone earns half.
Cpe (7): A CPE on an affected entry, or a cpeApplicability block.

Assess: can a reader tell how bad it is? (25 points)

Severity (15): A severity statement in the CNA container: a CVSS v3 or v4 vector, an SSVC decision, or a vendor rating as an 'other' metric. A CVSS v2 vector alone earns half.
Modern severity (5): A CVSS v4 vector or an SSVC decision.
Impacts (5): An impacts entry (a CAPEC identifier or an impact description).

Act: can a reader tell what to do about it? (25 points)

References (7): At least one reference.
Reference tags (5): At least one reference carrying tags.
Remediation (8): A reference tagged 'patch'; one tagged 'vendor-advisory', 'mitigation' or 'release-notes' earns 0.6.
Solutions (5): A solution or a workaround.

Grades: A from 90, B from 75, C from 60, D from 45, E from 0. Timeliness is displayed on each assigner's page and never scored: a long reservation-to-publication delay is a disclosure embargo as often as a backlog. The full text, with the methodology history, is in the documentation.