Metrics

Use the scroll bar to navigate the data tables.

Published CVE Records

Comparison of published CVE Records by quarter for all years from 1999 to present.

A CVE Record contains descriptive data, (i.e., a brief description and at least one reference) about a vulnerability associated with a CVE ID. CVE Records are published by CVE Numbering Authorities (CNAs).

Year202520242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999
Qtr412,79611,0737,8766,2315,2004,3874,8223,6143,5701,5901,6522,5281,4161,2441,1331,0711,1001,5001,8841,7371,725376154104813930
Qtr311,7388,5916,9366,4485,5414,1705,1504,3504,0371,7131,7472,2201,2971,9269881,0201,5471,3431,5641,6431,477741265304573218321
Qtr211,70111,7167,1346,3655,0055,0114,0914,6133,6121,7751,4431,6601,1471,0589011,4081,3811,2791,8871,8872,0132296305933371980
Qtr112,0098,6977,0156,0154,4154,8073,2453,9353,4261,3791,6521,5401,2821,0601,1281,1401,7041,5511,9871,6181,4932661746903326290
TOTAL48,24440,07728,96125,05920,16118,37517,30816,51214,6456,4576,4947,9485,1425,2884,1504,6395,7325,6737,3226,8856,7081,6121,2231,6911,3231,438321

Reserved CVE IDs

Comparison of Reserved CVE IDs by year from 1999 to present.

A “Reserved” CVE ID is the initial state for a CVE Record; when the associated CVE ID is reserved by a CNA.

Year202520242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999
Count70,72952,31640,05134,55328,50630,68024,17921,40718,19614,4729,9599,4657,3347,3705,6305,3796,0945,9687,6077,0777,0411,3571,2091,9091,4451,178991

CVE Record Publications by All CNAs Combined Versus CNA-LRs

Comparison of CVE Records published by all CNAs combined versus CVE Records published by the two Top-Level Root’s (CISA* and MITRE) CNAs of Last Resort (CNA-LRs) from 1999 to present.

As more CNAs are onboarded, the percentage of records published by CNA-LRs will decrease. A smaller percentage for the CNA-LRs is an expected and net positive outcome as this signals that more CNAs are publishing their own CVE Records.

Year2025202420232022202120202019201820172016-1999
All CNAs89%85%79%68%65%58%53%53%50%0%
CNA-LRs11%15%21%32%35%42%47%47%50%100%

*Note: CISA became a CNA-LR in calendar year 2020.

CNA Partners Added by Year

Comparison of CVE Numbering Authority (CNA) partners added by year from 1999 to present.

Currently, there are 491 CNAs (488 CNAs and 3 CNA-LRs) from 41 countries and 1 no country affiliation participating in the CVE Program.

Note: Occasionally, CNAs become inactive due to corporate mergers or changes in business activities. In these cases, deactivated CNAs are not removed from the recruitment total CNAs added for a calendar year in the table below. Therefore, the totals by year columns if added together will not match the program’s grand total numbers above.

Year2026202520242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999
January6310413300100001000010000000N/A
February1107921312100000000000600000N/A
MarchTBA35539111200000000000000000N/A
AprilTBA74635402310000400000000000N/A
MayTBA59851710100000000000000000N/A
JuneTBA468510111710000010000000000N/A
JulyTBA79462400400000000000000000N/A
AugustTBA86853122620000000100000000N/A
SeptemberTBA788184312000000030000000001
OctoberTBA5791292102003000000000000000
NovemberTBA46910744011200000000000000000
DecemberTBA1116372230700020000000000000
TOTAL76488845665361612302303034131106000001

CNA Enrichment Recognition

Getting more precise and quality vulnerability information in the hands of defenders and downstream customers on a timelier basis helps the cybersecurity community better address risks. Additional vulnerability-related information provides increased transparency, enables vulnerability root cause understanding, and helps prioritize vulnerability and incident response. Information standards and knowledge repositories like CVSS, CWE, and others help provide a common language for this additional information.

In April 2024, the CVE Program highlighted how its data format evolved to better facilitate automation and data enrichment. This means that CNAs, as the authoritative source of vulnerability information within their scope, and — in the case of Supplier CNAs — those with access to the most reliable source for accurate determinations, can easily provide data enrichment directly to a CVE Record as opposed to waiting for a third-party to do so in a less timely and potentially less accurate manner. As such, the CVE Program called on all CNAs to provide this enrichment to their CVE Records directly, and, in so doing, contribute more substantially to the vulnerability management process. Many have answered that call.

In recognition of these CNAs, the CVE Program publishes this “CNA Enrichment Recognition List” once per month. Currently, any CNA who has published a record in the past six months is placed on the list if they have been providing CVSS and CWE information consistently in the recent past. In particular, the requirement is CVSS and CWE information in at least 98% of their records that were published within two weeks of their most recently published record.

For more information about vulnerability information types like CVSS and CWE, see the CVE Record User Guide.

CNA Enrichment Recognition List

Last Updated:
Total CNAs: 256

  • Acronis International GmbH
  • Adobe Systems Incorporated
  • Advanced Micro Devices Inc.
  • Airbus
  • AlgoSec
  • Altera
  • Altium
  • Amazon
  • AMI
  • ARC Informatique
  • Arista Networks, Inc.
  • Armis, Inc.
  • Asea Brown Boveri Ltd.
  • ASR Microelectronics Co., Ltd.
  • ASUSTeK Computer Incorporation
  • ASUSTOR Inc.
  • ATISoluciones Diseño de Sistemas Electrónicos, S.L.
  • Austin Hackers Anonymous
  • Autodesk
  • Automotive Security Research Group (ASRG)
  • Axis Communications AB
  • AxxonSoft Limited
  • Azure Access Technology
  • Bitdefender
  • Bizerba SE & Co. KG
  • Black Duck Software, Inc.
  • Black Lantern Security
  • BlackBerry
  • Bugcrowd Inc.
  • CA Technologies
  • Canon EMEA
  • Canon Inc.
  • Canonical Ltd.
  • Carrier Global Corporation
  • Centreon
  • CERT.PL
  • CERT@VDE
  • Check Point Software Technologies Ltd.
  • Checkmarx
  • Checkmk GmbH
  • Cisco Systems, Inc.
  • Citrix Systems, Inc.
  • Cloudflare, Inc.
  • Commvault Systems Inc
  • Concrete CMS
  • ConnectWise LLC
  • Crestron Electronics, Inc.
  • CrowdStrike Holdings, Inc.
  • CyberArk Labs
  • CyberDanube
  • Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government
  • Dahua Technologies
  • Danfoss
  • Dassault Systèmes
  • Delinea, Inc.
  • Dell EMC
  • Delta Electronics, Inc.
  • Digi International Inc.
  • Docker Inc.
  • dotCMS LLC
  • Dragos, Inc.
  • Eaton
  • Eclipse Foundation
  • Elastic
  • EnterpriseDB Corporation
  • Environmental Systems Research Institute, Inc. (Esri)
  • Ericsson
  • Erlang Ecosystem Foundation
  • ESET, spol. s r.o.
  • EU Agency for Cybersecurity (ENISA)
  • Extreme Networks, Inc.
  • F5 Networks
  • Fedora Project (Infrastructure Software)
  • Fermax Technologies SLU
  • Financial Security Institute (FSI)
  • Flexera Software LLC
  • floragunn GmbH
  • Fluid Attacks
  • Fortinet, Inc.
  • Fortra, LLC
  • Foxit Software Incorporated
  • Gallagher Group Ltd
  • GE Vernova
  • Genetec Inc.
  • GitHub (maintainer security advisories)
  • GitHub Inc, (Products Only)
  • GitLab Inc.
  • Glyph & Cog, LLC
  • Google Cloud
  • Google LLC
  • Gridware Cybersecurity
  • Hallo Welt! GmbH
  • Hanwha Vision Co., Ltd.
  • Harborist
  • HashiCorp Inc.
  • HeroDevs
  • HiddenLayer, Inc.
  • Hitachi Energy
  • Hitachi Vantara
  • Hitachi, Ltd.
  • Honeywell International Inc.
  • Honor Device Co., Ltd.
  • HP Inc.
  • HYPR Corp
  • IBM Corporation
  • ICS-CERT
  • Indian Computer Emergency Response Team (CERT-In)
  • Insyde Software
  • Intel Corporation
  • Internet Systems Consortium (ISC)
  • Israel National Cyber Directorate
  • Ivanti
  • Jamf
  • Jaspersoft
  • JetBrains s.r.o.
  • JFROG
  • Johnson Controls
  • JPCERT/CC
  • Juniper Networks, Inc.
  • Kaspersky
  • KNIME AG
  • KrCERT/CC
  • Kubernetes
  • Larry Cashdollar
  • Legion of the Bouncy Castle Inc.
  • Lenovo Group Ltd.
  • Lexmark International Inc.
  • LG Electronics
  • Liferay, Inc.
  • M-Files Corporation
  • Maritime Hacking Village
  • Mattermost, Inc
  • Mautic
  • Medtronic
  • Microchip Technology
  • Microsoft Corporation
  • Milestone Systems A/S
  • Mitsubishi Electric Corporation
  • Monash University - Cyber Security Incident Response Team
  • Moxa Inc.
  • N-able
  • National Cyber Security Centre Finland
  • National Instruments
  • NEC Corporation
  • Neo4j
  • NETGEAR
  • Netskope
  • NLnet Labs
  • NortonLifeLock Inc
  • Nozomi Networks Inc.
  • Nvidia Corporation
  • Omnissa, LLC
  • OMRON Corporation
  • ONEKEY GmbH
  • Open Design Alliance
  • Open-Xchange
  • OpenHarmony
  • OpenJS Foundation
  • OpenText (formerly Micro Focus)
  • OpenVPN Inc.
  • OPPO
  • Palantir Technologies
  • Palo Alto Networks
  • Panasonic Holdings Corporation
  • PaperCut Software Pty Ltd
  • Pegasystems
  • PHP Group
  • Ping Identity Corporation
  • Progress Software Corporation
  • Proofpoint Inc.
  • Protect AI
  • Pure Storage, Inc.
  • QNAP Systems, Inc.
  • Qualcomm, Inc.
  • Qualys, Inc.
  • Radiometer Medical ApS
  • rami.io GmbH
  • Rapid7, Inc.
  • Real-Time Innovations, Inc.
  • Red Hat CNA-LR
  • Red Hat, Inc.
  • Ribose Limited
  • Robert Bosch GmbH
  • Roche Diagnostics
  • Rockwell Automation
  • S21sec Cyber Solutions by Thales
  • SailPoint Technologies
  • SAP SE
  • Schneider Electric SE
  • Seagate Technology
  • Security Risk Advisors
  • ServiceNow
  • SICK AG
  • Siemens
  • Silicon Labs
  • Snyk
  • Softing
  • SoftIron
  • SolarWinds
  • Solidigm
  • Sonatype Inc.
  • Sophos
  • StrongDM
  • Super Micro Computer, Inc.
  • Suse
  • Switzerland National Cyber Security Centre (NCSC)
  • Symantec - A Division of Broadcom
  • Synaptics
  • Synology Inc.
  • Talos
  • Tanium Inc.
  • TeamViewer Germany GmbH
  • Temporal Technologies Inc.
  • Tenable Network Security, Inc.
  • Teradyne Robotics
  • Thales Group
  • The Browser Company of New York
  • The Document Foundation
  • The Joomla! Project
  • The Missing Link Australia (TML)
  • The Qt Company
  • The Rust Project
  • The Tcpdump Group
  • The Wikimedia Foundation
  • TianoCore.org
  • TIBCO Software Inc.
  • Toreon
  • TP-Link Systems Inc.
  • TR-CERT (Computer Emergency Response Team of the Republic of Turkey)
  • Trend Micro, Inc.
  • TWCERT/CC
  • TYPO3 Association
  • upKeeper Solutions
  • Vaadin Ltd.
  • VMware
  • VulDB
  • VulnCheck
  • WatchGuard Technologies, Inc.
  • Western Digital
  • Wind River Systems Inc.
  • Wiz, Inc.
  • wolfSSL Inc.
  • Wordfence
  • WSO2 LLC
  • Xerox Corporation
  • Yandex N.V.
  • Yugabyte, Inc.
  • Zabbix
  • Zephyr Project
  • Zero Day Initiative
  • Zohocorp
  • Zoom Video Communications, Inc.
  • Zscaler, Inc.
  • ZTE Corporation
  • ZUSO Advanced Research Team (ZUSO ART)
  • Zyxel Corporation