What is the certcc CNA?

certcc is a CVE Numbering Authority (CNA) — an organization authorized to assign CVE IDs to vulnerabilities in its scope. It has published 2,972 CVE records since 2005.

How many CVEs has certcc published?

certcc has published 2,972 CVE records, including 85 in the last two years.

What is certcc's CVE data quality grade?

RadicalNotion.AI grades certcc's CVE data quality as F, with an overall completeness score of 10.6%. This reflects how consistently its CVE records include vendor (14.5%), product (16.9%), CVSS (1.9%), and CWE (9.2%) information.

What products does certcc publish CVEs for?

certcc most frequently publishes CVEs for debian linux, ubuntu linux, fedora, leap, enterprise linux server.

Which vendors does certcc cover?

certcc publishes CVEs across 232 distinct vendors, most often debian, canonical, magzter, Red Hat, openSUSE.

Is certcc actively publishing CVEs?

certcc is currently active, based on 85 CVEs in the last two years.

What is the average severity of certcc's CVEs?

The average CVSS base score across certcc's scored CVEs is 7.4.

How many critical CVEs has certcc published?

certcc has published 436 critical-severity CVEs and 558 high-severity CVEs.

Are any of certcc's CVEs in CISA's Known Exploited Vulnerabilities catalog?

Yes. 7 of certcc's CVEs are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, meaning they are confirmed to be exploited in the wild.

What are the most common weakness types in certcc's CVEs?

certcc's CVEs most often map to these CWE weakness types: CWE-502 (Deserialization of Untrusted Data), CWE-798 (Use of Hard-coded Credentials), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-306 (Missing Authentication for Critical Function).

How does certcc rank among CNAs?

By total CVE volume, certcc ranks #20 of 370 CNAs, and it reports more complete CVE records than 1% of all CNAs.

Grade F

Active

certcc

Name: certcc CNA CVE data quality report card
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE Numbering Authority

Latest CVE published February 10, 2026

2,972

CVEs published

Total assigned

20.9

Years active

2005–2026

7.4

Avg CVSS

Across scored CVEs

Recent CVEs

Last 2 years

Overview

certcc is a CVE Numbering Authority that has published 2,972 CVE records since 2005. It is currently classified as active, with 85 CVEs published in the last two years. Its CVE data quality is graded F (10.6% overall completeness).

Among the 370 CNAs tracked here, certcc ranks #20 by CVE volume and reports more complete records than 1% of all CNAs.

Data quality report card

How complete and consistent certcc's CVE records are, scored across vendor, product, CVSS, and CWE coverage.

A CVE record only requires a description to be published. “Completeness” measures how often certcc also fills in the optional — but extremely useful — fields that make a vulnerability actually actionable: the affected vendor and product, a CVSS severity score, and a CWE weakness type. A higher score means more of this CNA’s CVEs include those details, so defenders spend less time enriching records by hand.

Report card grade

10.6%

Overall score

Overall completeness10.6%

Vendor completeness14.5%

Product completeness16.9%

CVSS completeness1.9%

CWE completeness9.2%

99.9%

Update rate

Records revised after publishing

232

Vendor diversity

Distinct vendors covered

267 chars

Avg description length

Per CVE record

2005-03-08

First CVE date

Earliest assignment

2026-02-10

Latest CVE date

Most recent assignment

7.4

Average CVSS

Across scored CVEs

What these scores mean

Vendor completeness: The share of this CNA's CVEs that name an affected vendor.
Product completeness: The share that name a specific affected product.
CVSS completeness: The share that include a CVSS severity score.
CWE completeness: The share mapped to a CWE weakness type.
Update rate: How often this CNA revises CVE records after first publishing them.
Vendor diversity: How many distinct vendors this CNA publishes CVEs for.

Severity and exploitation

How the CVSS severity of certcc's published CVEs breaks down, and how many are known to be exploited in the wild.

Critical436

High558

Medium2,033

Low42

1 additional CVE has no CVSS severity score.

In CISA’s Known Exploited Vulnerabilities catalog

7 of certcc's CVEs are confirmed exploited in the wild and carry a CISA remediation deadline.

Common weakness types

The CWE weakness categories certcc most often assigns to its CVEs. Follow any weakness to its full explanation.

Publishing activity by year

How many CVEs certcc has published each year.

2019

2020

2021

2022

2023

2024

2025

2026

113

Top vendors

The vendors certcc publishes the most CVEs for.

debian77 CVEs
canonical54 CVEs
magzter46 CVEs
Red Hat40 CVEs
openSUSE35 CVEs
Siemens35 CVEs
Microsoft Corporation33 CVEs
Broadcom32 CVEs

Latest CVEs

The most recent CVEs assigned by certcc.

CVE-2026-14890CWE-502
CVE-2026-14890
Critical · CVSS 9.1
EPSS 0.7%2026-07-16
CVE-2026-14961CWE-269
CVE-2026-14961
Medium · CVSS 6.2
EPSS 0.1%2026-07-15
CVE-2026-14960CWE-284
CVE-2026-14960
Critical · CVSS 9.8
EPSS 0.4%2026-07-15
CVE-2026-15146
CVE-2026-15146
Medium · CVSS 5.9
EPSS 0.1%2026-07-10
CVE-2026-13462
PayRange for Android, version 7.0.7, contains an SSL bypass vulnerability
High · CVSS 7.5
EPSS 0.2%2026-07-09
CVE-2026-13461
PayRange version 7.0.7 contains a JavaScript injection vulnerability
Critical · CVSS 9.6
EPSS 0.3%2026-07-09
CVE-2026-14261
CVE-2026-14261
Critical · CVSS 9.1
EPSS 0.6%2026-07-09
CVE-2026-12116
CVE-2026-12116
Critical · CVSS 9.8
EPSS 0.4%2026-07-09
CVE-2026-10706
Exposure of Sensitive Information to an Unauthorized attacker
High · CVSS 7.5
EPSS 0.3%2026-07-08
CVE-2026-10708
Insufficiently Protected Credentials
High · CVSS 7.5
EPSS 0.2%2026-07-08
CVE-2026-11405
Hidden backdoor authentication mechanism in multiple versions of Tenda firmware allows admin access to web management interface
Critical · CVSS 9.8
EPSS 0.7%2026-07-06
CVE-2026-13753
CVE-2026-13753
High · CVSS 7.5
EPSS 0.3%2026-07-06

Track new certcc CVEs as they are published and get AI-written analysis and remediation guidance.

Monitor certcc CVEs

Other CNAs

Compare data quality across other CVE Numbering Authorities.

mitreGrade F · 112,208 CVEs PatchstackGrade A · 14,729 CVEs VulDBGrade A · 12,140 CVEs microsoftGrade F · 11,701 CVEs redhatGrade F · 10,745 CVEs GitHub_MGrade A · 10,605 CVEs LinuxGrade F · 10,294 CVEs WordfenceGrade A · 8,652 CVEs

Browse all CNAs

Frequently asked questions

Common questions about the certcc CNA.

What is the certcc CNA?: certcc is a CVE Numbering Authority (CNA) — an organization authorized to assign CVE IDs to vulnerabilities in its scope. It has published 2,972 CVE records since 2005.
How many CVEs has certcc published?: certcc has published 2,972 CVE records, including 85 in the last two years.
What is certcc's CVE data quality grade?: RadicalNotion.AI grades certcc's CVE data quality as F, with an overall completeness score of 10.6%. This reflects how consistently its CVE records include vendor (14.5%), product (16.9%), CVSS (1.9%), and CWE (9.2%) information.
What products does certcc publish CVEs for?: certcc most frequently publishes CVEs for debian linux, ubuntu linux, fedora, leap, enterprise linux server.
Which vendors does certcc cover?: certcc publishes CVEs across 232 distinct vendors, most often debian, canonical, magzter, Red Hat, openSUSE.
Is certcc actively publishing CVEs?: certcc is currently active, based on 85 CVEs in the last two years.
What is the average severity of certcc's CVEs?: The average CVSS base score across certcc's scored CVEs is 7.4.
How many critical CVEs has certcc published?: certcc has published 436 critical-severity CVEs and 558 high-severity CVEs.
Are any of certcc's CVEs in CISA's Known Exploited Vulnerabilities catalog?: Yes. 7 of certcc's CVEs are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, meaning they are confirmed to be exploited in the wild.
What are the most common weakness types in certcc's CVEs?: certcc's CVEs most often map to these CWE weakness types: CWE-502 (Deserialization of Untrusted Data), CWE-798 (Use of Hard-coded Credentials), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-306 (Missing Authentication for Critical Function).
How does certcc rank among CNAs?: By total CVE volume, certcc ranks #20 of 370 CNAs, and it reports more complete CVE records than 1% of all CNAs.

References

CNA report-card grades are computed by RadicalNotion.AI from published CVE records. CVE data is sourced from the CVE Program.

Track certcc CVEs

Monitor new vulnerabilities as this CNA publishes them, with AI-written analysis and remediation guidance.

Start free See pricing