CVE Numbering Authorities

CVE Numbering Authorities (CNAs) are organizations from around the world that are authorized to assign CVE IDs to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities. These CVE IDs are provided to researchers, vulnerability disclosers, and information technology vendors.

Participation in this program is voluntary, and the benefits of participation include the ability to publicly disclose a vulnerability with an already assigned CVE ID, the ability to control the disclosure of vulnerability information without pre-publishing, and notification of vulnerabilities in products within a CNA's scope by researchers who request a CVE ID from them.

To review the products covered by each CNA, visit the Request a CVE ID page.

CNAs

Documentation for CNAs

CNA Working Group





Growth of CNA Program Worldwide


There are 146 organizations from 25 countries participating as CNAs as of November 20, 2020:

CNAs World Map - November 20, 2020

CNAs World Map as of November 20, 2020

  • Vendors and Projects: 132
  • Vulnerability Researchers: 25
  • National and Industry CERTs: 7
  • Bug Bounty Programs: 2
  • Root CNAs: 1
  • Top-Level Root CNAs: 2

Number of CNAs by country as shown at right:

  • Australia: 1
  • Austria: 1
  • Belgium: 1
  • Canada: 5
  • China: 12
  • Denmark: 1
  • Finland: 1
  • France: 1
  • Germany: 8
  • India: 2
  • Ireland: 1
  • Israel: 3
  • Japan: 3
  • Latvia: 1
  • Netherlands: 3
  • New Zealand: 1
  • Norway: 1
  • Romania: 1
  • Russia: 2
  • South Korea: 2
  • Spain: 2
  • Switzerland: 2
  • Taiwan: 3
  • UK: 2
  • USA: 86

View the current list of CNAs.




How to Become a CNA

  1. Contact the CNA Coordination Team.
  2. Fill out the registration form.
  3. Attend an introductory session.
  4. Successfully create CVE ID entries from examples.

Why Become a CNA?

Thank you for your interest in becoming a CVE Numbering Authority (CNA).

Benefits

Cost

Requirements

Questions?




CNA Onboarding Slides & Videos

These videos and slides on the CNA Onboarding Guidance playlist on the CVE Program Channel on YouTube should be reviewed by new CNAs in the order presented below prior to your onboarding meeting with the CNA Coordination Team.


 view as slides: English | Japanese



 view as slides: English | Japanese



 view as slides: English | Japanese



 view as slides: English | Japanese



 view as slides: English | Japanese



CVE Entry GitHub Submissions slides

 view as slides (only): English |  Git setup documents





 view as slides: English | Japanese



Onboarding Questions or Help:




Submitting CVE Entry Information to CVE Team

Please use one of the following two methods to submit CVE Entry information to the CVE Team.

(1) CVE Request Web Form

Submitting through the CVE Request Web Form:
  1. Visit the CVE Request web form.
  2. Select “Notify CVE about a publication” and enter your email address.
  3. Fill in the form.
  4. NOTE: “Link to the advisory” and “CVE IDs of vulnerabilities to be published” fields are required.
  5. The assignment information (in Flat File, CSV, or JSON format) should be entered in the “Additional information and CVE ID description updates” field.
  6. NOTE: Alternatively, you can send the CVE Entry information as a file attachment in a reply to an email message generated by CVE’s ticketing system when the submission has been received.
  7. Enter the security code.
  8. Press “Submit Request.”

(2) Git

Page Last Updated or Reviewed: November 19, 2020