Metrics

Use the scroll bar to navigate the data tables.

Published CVE Records

Comparison of published CVE Records by quarter for all years from 1999 to present.

A CVE Record contains descriptive data, (i.e., a brief description and at least one reference) about a vulnerability associated with a CVE ID. CVE Records are published by CVE Numbering Authorities (CNAs).

Year20242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999
Qtr411,0737,8766,2315,2004,3874,8223,6143,5701,5901,6522,5281,4161,2441,1331,0711,1001,5001,8841,7371,725376154104813930
Qtr38,5916,9366,4485,5414,1705,1504,3504,0371,7131,7472,2201,2971,9269881,0201,5471,3431,5641,6431,477741265304573218321
Qtr211,7167,1346,3655,0055,0114,0914,6133,6121,7751,4431,6601,1471,0589011,4081,3811,2791,8871,8872,0132296305933371980
Qtr18,6977,0156,0154,4154,8073,2453,9353,4261,3791,6521,5401,2821,0601,1281,1401,7041,5511,9871,6181,4932661746903326290
TOTAL40,07728,96125,05920,16118,37517,30816,51214,6456,4576,4947,9485,1425,2884,1504,6395,7325,6737,3226,8856,7081,6121,2231,6911,3231,438321

Reserved CVE IDs

Comparison of Reserved CVE IDs by year from 1999 to present.

A “Reserved” CVE ID is the initial state for a CVE Record; when the associated CVE ID is reserved by a CNA.

Year20242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999
Count52,31640,05134,55328,50630,68024,17921,40718,19614,4729,9599,4657,3347,3705,6305,3796,0945,9687,6077,0777,0411,3571,2091,9091,4451,178991

CVE Record Publications by All CNAs Combined Versus CNA-LRs

Comparison of CVE Records published by all CNAs combined versus CVE Records published by the two CNAs of Last Resort (CNA-LRs) (CISA* and MITRE) from 1999 to present.

Year202420232022202120202019201820172016-1999
All CNAs87%79%68%65%58%53%53%50%0%
CNA-LRs13%21%32%35%42%47%47%50%100%

*Note: CISA became a CNA-LR in calendar year 2020.

CNA Partners Added by Year

Comparison of CVE Numbering Authority (CNA) partners added by year from 1999 to present.

Currently, there are 450 CNAs (447 CNAs and 3 CNA-LRs) from 40 countries and 1 no country affiliation participating in the CVE Program.

Note: Occasionally, CNAs become inactive due to corporate mergers or changes in business activities. In these cases, deactivated CNAs are not removed from the recruitment total CNAs added for a calendar year in the table below. Therefore, the totals by year columns if added together will not match the program’s grand total numbers above.

Year202520242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999
January310413300100001000010000000N/A
February107921312100000000000600000N/A
March45539111200000000000000000N/A
April34635402310000400000000000N/A
MayTBA9851710100000000000000000N/A
JuneTBA68510111710000010000000000N/A
JulyTBA9462400400000000000000000N/A
AugustTBA6853122620000000100000000N/A
SeptemberTBA88184312000000030000000001
OctoberTBA791292102003000000000000000
NovemberTBA6910744011200000000000000000
DecemberTBA116372230700020000000000000
TOTAL2088845665361612302303034131106000001

CNA Enrichment Recognition

Getting more precise and quality vulnerability information in the hands of defenders and downstream customers on a timelier basis helps the cybersecurity community better address risks. Additional vulnerability-related information provides increased transparency, enables vulnerability root cause understanding, and helps prioritize vulnerability and incident response. Information standards and knowledge repositories like CVSS, CWE, and others help provide a common language for this additional information.

In April 2024, the CVE Program highlighted how its data format evolved to better facilitate automation and data enrichment. This means that CNAs, as the authoritative source of vulnerability information within their scope, and those with access to the most reliable source for accurate determinations, can easily provide data enrichment directly to a CVE Record, as opposed to waiting for a third-party to do so in a less timely and potentially less accurate manner. As such, the CVE Program called on all CNAs to provide this enrichment to their CVE Records directly, and, in so doing, contribute more substantially to the vulnerability management process. Many have answered that call.

In recognition of these CNAs, the CVE Program publishes this “CNA Enrichment Recognition List” every two weeks. Currently, CNAs are added to the list if they provide CVSS and CWE information 98% of the time or more within the two-week period of their last published CVE Record. For more information about vulnerability information types like CVSS and CWE, see the CVE Record User Guide.

CNA Enrichment Recognition List

Last Updated:
Total CNAs: 249

  • 1E Limited
  • 9front Systems
  • Absolute Software
  • Acronis International GmbH
  • Adobe Systems Incorporated
  • Advanced Micro Devices Inc.
  • Alias Robotics S.L.
  • Amazon
  • AMI
  • ARC Informatique
  • Arista Networks, Inc.
  • Asea Brown Boveri Ltd.
  • ASR Microelectronics Co., Ltd.
  • ASUSTeK Computer Incorporation
  • ATISoluciones Diseño de Sistemas Electrónicos, S.L.
  • Austin Hackers Anonymous
  • Autodesk
  • Automotive Security Research Group (ASRG)
  • Avaya Inc.
  • Axis Communications AB
  • Baicells Technologies Co., Ltd.
  • Baxter Healthcare
  • Beckman Coulter Life Sciences
  • Becton, Dickinson and Company (BD)
  • BeyondTrust Inc.
  • Bitdefender
  • Bizerba SE & Co. KG
  • Black Duck Software, Inc.
  • Black Lantern Security
  • BlackBerry
  • Brocade Communications Systems LLC, a Broadcom Company
  • Canon EMEA
  • Canon Inc.
  • Canonical Ltd.
  • Carrier Global Corporation
  • Cato Networks
  • CERT.PL
  • CERT@VDE
  • Check Point Software Technologies Ltd.
  • Checkmarx
  • Checkmk GmbH
  • cirosec GmbH
  • Cisco Systems, Inc.
  • ClickHouse, Inc.
  • Cloudflare, Inc.
  • Concrete CMS
  • Crafter CMS
  • CrowdStrike Holdings, Inc.
  • CyberArk Labs
  • CyberDanube
  • Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government
  • Dassault Systèmes
  • Delinea, Inc.
  • Dell EMC
  • Delta Electronics, Inc.
  • Dfinity Foundation
  • DirectCyber
  • Docker Inc.
  • dotCMS LLC
  • Dragos, Inc.
  • Dutch Institute for Vulnerability Disclosure (DIVD)
  • Eaton
  • Eclipse Foundation
  • Elastic
  • EnterpriseDB Corporation
  • Environmental Systems Research Institute, Inc. (Esri)
  • Ericsson
  • ESET, spol. s r.o.
  • EU Agency for Cybersecurity (ENISA)
  • Exodus Intelligence
  • F5 Networks
  • Fedora Project (Infrastructure Software)
  • Fluid Attacks
  • Forcepoint
  • Forescout Technologies
  • Fortinet, Inc.
  • Fortra, LLC
  • FPT SOFTWARE CO., LTD
  • Gallagher Group Ltd
  • GE Healthcare
  • Genetec Inc.
  • Gitea Limited
  • GitHub (maintainer security advisories)
  • GitHub Inc, (Products Only)
  • GitLab Inc.
  • Glyph & Cog, LLC
  • Google LLC
  • Government Technology Agency of Singapore Cyber Security Group (GovTech CSG)
  • Grafana Labs
  • Gridware Cybersecurity
  • Hanwha Vision Co., Ltd.
  • HashiCorp Inc.
  • HCL Software
  • HeroDevs
  • HiddenLayer, Inc.
  • Hillstone Networks Inc.
  • Hitachi Vantara
  • Hitachi, Ltd.
  • Honeywell International Inc.
  • HP Inc.
  • Huawei Technologies
  • HYPR Corp
  • IBM Corporation
  • ICS-CERT
  • Indian Computer Emergency Response Team (CERT-In)
  • Intel Corporation
  • Internet Systems Consortium (ISC)
  • Israel National Cyber Directorate
  • Ivanti
  • Jamf
  • JetBrains s.r.o.
  • JFROG
  • Johnson Controls
  • JPCERT/CC
  • Juniper Networks, Inc.
  • Kaspersky
  • KrCERT/CC
  • Kubernetes
  • Lenovo Group Ltd.
  • Lexmark International Inc.
  • LG Electronics
  • Liferay, Inc.
  • Logitech
  • M-Files Corporation
  • Mattermost, Inc
  • Mautic
  • Microchip Technology
  • Microsoft Corporation
  • Milestone Systems A/S
  • Mitsubishi Electric Corporation
  • MongoDB
  • Moxa Inc.
  • N-able
  • National Cyber Security Centre - Netherlands (NCSC-NL)
  • National Cyber Security Centre Finland
  • National Cyber Security Centre SK-CERT
  • National Instruments
  • NetApp, Inc.
  • Netflix, Inc.
  • Netskope
  • NLnet Labs
  • NortonLifeLock Inc
  • Nozomi Networks Inc.
  • Nvidia Corporation
  • Odoo
  • Okta
  • OMRON Corporation
  • ONEKEY GmbH
  • Open Design Alliance
  • Open-Xchange
  • OpenAnolis
  • openEuler
  • OpenHarmony
  • OpenText (formerly Micro Focus)
  • OPPO
  • OTRS AG
  • Palantir Technologies
  • Palo Alto Networks
  • Panasonic Holdings Corporation
  • Pandora FMS
  • PaperCut Software Pty Ltd
  • Patchstack OÜ
  • Pegasystems
  • Pentraze Cybersecurity
  • Perforce
  • Phoenix Technologies, Inc.
  • Ping Identity Corporation
  • PlexTrac, Inc.
  • Progress Software Corporation
  • Proofpoint Inc.
  • Protect AI
  • Pure Storage, Inc.
  • QNAP Systems, Inc.
  • Qualcomm, Inc.
  • rami.io GmbH
  • Rapid7, Inc.
  • Real-Time Innovations, Inc.
  • Red Hat CNA-LR
  • Red Hat, Inc.
  • Robert Bosch GmbH
  • Roche Diagnostics
  • SailPoint Technologies
  • Samsung TV & Appliance
  • SAP SE
  • SBA Research gGmbH
  • Schneider Electric SE
  • Seal Security
  • SEC Consult Vulnerability Lab
  • Secomea
  • Securin
  • ServiceNow
  • SHENZHEN CoolKit Technology CO., LTD.
  • SICK AG
  • Siemens
  • Silicon Labs
  • Snow Software
  • Snyk
  • SoftIron
  • SolarWinds
  • Sonatype Inc.
  • Sophos
  • Spanish National Cybersecurity Institute, S.A.
  • Splunk
  • STAR Labs SG Pte. Ltd.
  • Super Micro Computer, Inc.
  • Suse
  • Switzerland National Cyber Security Centre (NCSC)
  • Synaptics
  • Synology Inc.
  • Talos
  • TeamViewer Germany GmbH
  • Teltonika Networks
  • Temporal Technologies Inc.
  • Tenable Network Security, Inc.
  • Thales Group
  • The Document Foundation
  • The Tcpdump Group
  • TianoCore.org
  • Tigera
  • Toshiba Corporation
  • TR-CERT (Computer Emergency Response Team of the Republic of Turkey)
  • Trellix
  • TWCERT/CC
  • TXOne Networks, Inc.
  • upKeeper Solutions
  • Vivo Mobile Communication Technology Co., LTD.
  • VulDB
  • VulnCheck
  • VULSec Labs
  • WatchGuard Technologies, Inc.
  • Western Digital
  • Wind River Systems Inc.
  • Wiz, Inc.
  • Wordfence
  • WSO2 LLC
  • Xerox Corporation
  • Xiaomi Technology Co Ltd
  • Yandex N.V.
  • Yokogawa Group
  • Yugabyte, Inc.
  • Zabbix
  • Zephyr Project
  • Zero Day Initiative
  • Zohocorp
  • Zoom Video Communications, Inc.
  • Zscaler, Inc.
  • ZTE Corporation
  • ZUSO Advanced Research Team (ZUSO ART)
  • Zyxel Corporation
Provide feedback for this page