Security

CVE Numbering Authority (CNA)

A CVE Numbering Authority is an organization authorized to assign CVE IDs and publish CVE records for vulnerabilities within its scope. Its CVSS score can differ from the rating the affected vendor publishes.

Deep dive

Learn Article

Why Vendor Severity and CVSS Scores Disagree on the Same Bug

Vendor severity and CVSS scores measure different things, and KEV adds a third signal. Here is how to triage a bug when the ratings disagree.

intermediate 5 min read

Back to glossary