CVE data sources
RadicalNotion.AI collects CVE records from CVE Numbering Authorities (CNAs) and the Authorized Data Publisher (ADP).
What are CVE Numbering Authorities (CNAs)?
CVE Numbering Authorities (CNAs) are organizations authorized by the CVE Program to assign CVE IDs to vulnerabilities affecting products within their distinct scope.
CNAs assign unique CVE IDs to vulnerabilities in their scope and publish CVE records with technical detail. They coordinate disclosure with researchers and vendors and keep their records accurate and current.
There are four main types of CNAs. Vendor CNAs like Microsoft and Apple handle their own products; research CNAs discover vulnerabilities across multiple vendors; coordinator CNAs manage complex multi-vendor issues; and government CNAs focus on critical-infrastructure vulnerabilities.
Top 5 CNAs by CVE count
CVE assignments by organization (all-time totals).
Browse the CNA directory or read What is a CNA?.
CISA: the Authorized Data Publisher (ADP)
The Cybersecurity and Infrastructure Security Agency is the only Authorized Data Publisher in the CVE Program.
Sole ADP status
CISA is currently the only organization with Authorized Data Publisher status, so it can add data to any CVE record.
Data enhancement
CNAs provide the basic details, and CISA adds CVSS scores, exploitation status, and threat context.
KEV catalog
CISA maintains the Known Exploited Vulnerabilities catalog of CVEs exploited in the wild.
How CISA differs from CNAs
CNAs assign CVE IDs and create the initial records, and CISA adds data and a government perspective to existing records. Each CNA covers the products within its scope, while CISA covers every CVE that affects US critical infrastructure.
Each record gets technical detail from the CNA and national-security context from CISA.
Related: CNA vs. Root CNA vs. ADP, Vulnrichment, and the CISA KEV catalog.
The CVE lifecycle
A CVE record passes through four stages and keeps updating after publication.
CNA assigns the CVE
A CVE Numbering Authority assigns a unique CVE ID to a newly discovered vulnerability within its scope.
Initial publication
Basic vulnerability details are published to the CVE List and propagate to downstream databases.
CISA analysis
As the ADP, CISA adds threat context, exploitation status, and prioritization signals.
Enhanced record
The record gains CVSS scores, KEV status, and remediation guidance, and keeps updating over time.
Timeline: hours to weeks, depending on the vulnerability’s complexity and threat level. See the full CVE lifecycle guide.
CVE updates by year
Updates to existing CVE records far outnumber new CVEs, with over 108,000 updates in 2024.
New CVE publications grew to about 40,000 in 2024, while existing records received about 109,000 updates, about 2.7 updates per new CVE. CNAs and CISA keep adding CVSS scores, exploit information, affected versions, and remediation guidance, and a single CVE can be updated dozens of times.
Updates began to outpace new publications in 2019. At more than 100,000 updates and 40,000 new CVEs a year, no team can track the changes by hand.
CVEs published vs. updated per year
CVE publications and updates per year.
How we process CVE data
Continuous monitoring
We track updates from every CNA and from CISA as they are published.
Prioritization
AI analysis surfaces the vulnerabilities that pose risk to your infrastructure.
Validation
Each update is checked against multiple authoritative sources before it reaches you.
Search the CVE data
Open the dashboard or search CVEs from every CNA and CISA.