Metrics

Use the scroll bar to navigate the data tables.

Published CVE Records

Comparison of published CVE Records by quarter for all years from 1999 to present.

A CVE Record contains descriptive data, (i.e., a brief description and at least one reference) about a vulnerability associated with a CVE ID. CVE Records are published by CVE Numbering Authorities (CNAs).

Year20242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999
Qtr411,0737,8766,2315,2004,3874,8223,6143,5701,5901,6522,5281,4161,2441,1331,0711,1001,5001,8841,7371,725376154104813930
Qtr38,5916,9366,4485,5414,1705,1504,3504,0371,7131,7472,2201,2971,9269881,0201,5471,3431,5641,6431,477741265304573218321
Qtr211,7167,1346,3655,0055,0114,0914,6133,6121,7751,4431,6601,1471,0589011,4081,3811,2791,8871,8872,0132296305933371980
Qtr18,6977,0156,0154,4154,8073,2453,9353,4261,3791,6521,5401,2821,0601,1281,1401,7041,5511,9871,6181,4932661746903326290
TOTAL40,07728,96125,05920,16118,37517,30816,51214,6456,4576,4947,9485,1425,2884,1504,6395,7325,6737,3226,8856,7081,6121,2231,6911,3231,438321

Reserved CVE IDs

Comparison of Reserved CVE IDs by year from 1999 to present.

A “Reserved” CVE ID is the initial state for a CVE Record; when the associated CVE ID is reserved by a CNA.

Year20242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999
Count52,31640,05134,55328,50630,68024,17921,40718,19614,4729,9599,4657,3347,3705,6305,3796,0945,9687,6077,0777,0411,3571,2091,9091,4451,178991

CVE Record Publications by All CNAs Combined Versus CNA-LRs

Comparison of CVE Records published by all CNAs combined versus CVE Records published by the two CNAs of Last Resort (CNA-LRs) (CISA* and MITRE) from 1999 to present.

Year202420232022202120202019201820172016-1999
All CNAs87%79%68%65%58%53%53%50%0%
CNA-LRs13%21%32%35%42%47%47%50%100%

*Note: CISA became a CNA-LR in calendar year 2020.

CNA Partners Added by Year

Comparison of CVE Numbering Authority (CNA) partners added by year from 1999 to present.

Currently, there are 455 CNAs (452 CNAs and 3 CNA-LRs) from 39 countries and 1 no country affiliation participating in the CVE Program.

Note: Occasionally, CNAs become inactive due to corporate mergers or changes in business activities. In these cases, deactivated CNAs are not removed from the recruitment total CNAs added for a calendar year in the table below. Therefore, the totals by year columns if added together will not match the program’s grand total numbers above.

Year202520242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999
January310413300100001000010000000N/A
February107921312100000000000600000N/A
March35539111200000000000000000N/A
April74635402310000400000000000N/A
May59851710100000000000000000N/A
June468510111710000010000000000N/A
JulyTBA9462400400000000000000000N/A
AugustTBA6853122620000000100000000N/A
SeptemberTBA88184312000000030000000001
OctoberTBA791292102003000000000000000
NovemberTBA6910744011200000000000000000
DecemberTBA116372230700020000000000000
TOTAL3288845665361612302303034131106000001

CNA Enrichment Recognition

Getting more precise and quality vulnerability information in the hands of defenders and downstream customers on a timelier basis helps the cybersecurity community better address risks. Additional vulnerability-related information provides increased transparency, enables vulnerability root cause understanding, and helps prioritize vulnerability and incident response. Information standards and knowledge repositories like CVSS, CWE, and others help provide a common language for this additional information.

In April 2024, the CVE Program highlighted how its data format evolved to better facilitate automation and data enrichment. This means that CNAs, as the authoritative source of vulnerability information within their scope, and — in the case of Supplier CNAs — those with access to the most reliable source for accurate determinations, can easily provide data enrichment directly to a CVE Record as opposed to waiting for a third-party to do so in a less timely and potentially less accurate manner. As such, the CVE Program called on all CNAs to provide this enrichment to their CVE Records directly, and, in so doing, contribute more substantially to the vulnerability management process. Many have answered that call.

In recognition of these CNAs, the CVE Program publishes this “CNA Enrichment Recognition List” once per month. Currently, any CNA who has published a record in the past six months is placed on the list if they have been providing CVSS and CWE information consistently in the recent past. In particular, the requirement is CVSS and CWE information in at least 98% of their records that were published within two weeks of their most recently published record.

For more information about vulnerability information types like CVSS and CWE, see the CVE Record User Guide.

CNA Enrichment Recognition List

Last Updated:
Total CNAs: 229

  • 1E Limited
  • Acronis International GmbH
  • Adobe Systems Incorporated
  • Advanced Micro Devices Inc.
  • Alias Robotics S.L.
  • Amazon
  • AMI
  • ARC Informatique
  • Asea Brown Boveri Ltd.
  • ASUSTeK Computer Incorporation
  • ATISoluciones Diseño de Sistemas Electrónicos, S.L.
  • Austin Hackers Anonymous
  • Autodesk
  • Avaya Inc.
  • Axis Communications AB
  • Baxter Healthcare
  • Beckman Coulter Life Sciences
  • Becton, Dickinson and Company (BD)
  • BeyondTrust Inc.
  • Bitdefender
  • Bizerba SE & Co. KG
  • Black Duck Software, Inc.
  • Black Lantern Security
  • BlackBerry
  • Brocade Communications Systems LLC, a Broadcom Company
  • CA Technologies
  • Canon Inc.
  • Canonical Ltd.
  • Carrier Global Corporation
  • Cato Networks
  • Centreon
  • CERT.PL
  • CERT@VDE
  • Check Point Software Technologies Ltd.
  • Checkmarx
  • Checkmk GmbH
  • cirosec GmbH
  • Cisco Systems, Inc.
  • Cloudflare, Inc.
  • Concrete CMS
  • ConnectWise LLC
  • Crafter CMS
  • Crestron Electronics, Inc.
  • CrowdStrike Holdings, Inc.
  • CyberArk Labs
  • CyberDanube
  • Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government
  • Dahua Technologies
  • Danfoss
  • Dassault Systèmes
  • Delinea, Inc.
  • Dell EMC
  • Dfinity Foundation
  • Digi International Inc.
  • Docker Inc.
  • Dremio Corporation
  • Dutch Institute for Vulnerability Disclosure (DIVD)
  • Eaton
  • Eclipse Foundation
  • Edgewatch Security Intelligence
  • Elastic
  • EnterpriseDB Corporation
  • Environmental Systems Research Institute, Inc. (Esri)
  • Ericsson
  • ESET, spol. s r.o.
  • EU Agency for Cybersecurity (ENISA)
  • F5 Networks
  • Fedora Project (Infrastructure Software)
  • Financial Security Institute (FSI)
  • Fluid Attacks
  • Forcepoint
  • Forescout Technologies
  • Fortinet, Inc.
  • Fortra, LLC
  • FPT SOFTWARE CO., LTD
  • Gallagher Group Ltd
  • GE Vernova
  • GitHub (maintainer security advisories)
  • GitHub Inc, (Products Only)
  • GitLab Inc.
  • Glyph & Cog, LLC
  • Google LLC
  • Government Technology Agency of Singapore Cyber Security Group (GovTech CSG)
  • Grafana Labs
  • Gridware Cybersecurity
  • Hanwha Vision Co., Ltd.
  • HashiCorp Inc.
  • HCL Software
  • HeroDevs
  • Hillstone Networks Inc.
  • Hitachi Energy
  • Hitachi Vantara
  • Hitachi, Ltd.
  • Honeywell International Inc.
  • HP Inc.
  • Huawei Technologies
  • HYPR Corp
  • IBM Corporation
  • ICS-CERT
  • iManage LLC
  • Indian Computer Emergency Response Team (CERT-In)
  • Intel Corporation
  • Internet Systems Consortium (ISC)
  • Israel National Cyber Directorate
  • Ivanti
  • JetBrains s.r.o.
  • JFROG
  • Johnson Controls
  • JPCERT/CC
  • Kaspersky
  • Kong Inc.
  • Kubernetes
  • Lenovo Group Ltd.
  • Lexmark International Inc.
  • Liferay, Inc.
  • M-Files Corporation
  • Mattermost, Inc
  • Mautic
  • Microsoft Corporation
  • Milestone Systems A/S
  • Mitsubishi Electric Corporation
  • Monash University - Cyber Security Incident Response Team
  • MongoDB
  • Moxa Inc.
  • N-able
  • National Cyber Security Centre Finland
  • National Cyber Security Centre SK-CERT
  • National Instruments
  • NetApp, Inc.
  • Netskope
  • NLnet Labs
  • NortonLifeLock Inc
  • Nozomi Networks Inc.
  • Nvidia Corporation
  • Odoo
  • OMRON Corporation
  • ONEKEY GmbH
  • Open Design Alliance
  • Open-Xchange
  • OpenAnolis
  • openEuler
  • OpenHarmony
  • OpenText (formerly Micro Focus)
  • OPPO
  • OTRS AG
  • Palantir Technologies
  • Palo Alto Networks
  • Panasonic Holdings Corporation
  • Pandora FMS
  • PaperCut Software Pty Ltd
  • Patchstack OÜ
  • Pegasystems
  • Perforce
  • Philips
  • Phoenix Technologies, Inc.
  • Ping Identity Corporation
  • PlexTrac, Inc.
  • PostgreSQL
  • Proofpoint Inc.
  • Protect AI
  • Pure Storage, Inc.
  • Python Software Foundation
  • QNAP Systems, Inc.
  • Qualcomm, Inc.
  • Rapid7, Inc.
  • Real-Time Innovations, Inc.
  • Red Hat CNA-LR
  • Red Hat, Inc.
  • Robert Bosch GmbH
  • Roche Diagnostics
  • SailPoint Technologies
  • Samsung TV & Appliance
  • SAP SE
  • Saviynt Inc.
  • SBA Research gGmbH
  • Schneider Electric SE
  • Schweitzer Engineering Laboratories, Inc.
  • Seal Security
  • Secomea
  • ServiceNow
  • SICK AG
  • Siemens
  • Silicon Labs
  • Snyk
  • SoftIron
  • SolarWinds
  • Sonatype Inc.
  • Sophos
  • Spanish National Cybersecurity Institute, S.A.
  • Splunk
  • Super Micro Computer, Inc.
  • Switzerland National Cyber Security Centre (NCSC)
  • Symantec - A Division of Broadcom
  • Synaptics
  • Synology Inc.
  • Talos
  • TeamViewer Germany GmbH
  • Temporal Technologies Inc.
  • Tenable Network Security, Inc.
  • The Document Foundation
  • The Missing Link Australia (TML)
  • The Qt Company
  • The Wikimedia Foundation
  • TianoCore.org
  • TIBCO Software Inc.
  • TP-Link Systems Inc.
  • TR-CERT (Computer Emergency Response Team of the Republic of Turkey)
  • Trellix
  • TWCERT/CC
  • TXOne Networks, Inc.
  • Vivo Mobile Communication Technology Co., LTD.
  • VulDB
  • VulnCheck
  • VULSec Labs
  • WatchGuard Technologies, Inc.
  • Wind River Systems Inc.
  • Wordfence
  • Xerox Corporation
  • Xiaomi Technology Co Ltd
  • Yandex N.V.
  • Yokogawa Group
  • Zabbix
  • Zephyr Project
  • Zero Day Initiative
  • Zohocorp
  • Zoom Video Communications, Inc.
  • ZTE Corporation
  • ZUSO Advanced Research Team (ZUSO ART)
  • Zyxel Corporation
Provide feedback for this page