GandC
CVE Numbering Authority
Latest CVE published
Overview
GandC is a CVE Numbering Authority that has published 18 CVE records since 2023. It is currently classified as active, with 13 CVEs published in the last two years. Its CVE data quality is graded A (100% overall completeness).
Among the 370 CNAs tracked here, GandC ranks #254 by CVE volume and reports more complete records than 60% of all CNAs.
Data quality report card
How complete and consistent GandC's CVE records are, scored across vendor, product, CVSS, and CWE coverage.
A CVE record only requires a description to be published. “Completeness” measures how often GandC also fills in the optional — but extremely useful — fields that make a vulnerability actually actionable: the affected vendor and product, a CVSS severity score, and a CWE weakness type. A higher score means more of this CNA’s CVEs include those details, so defenders spend less time enriching records by hand.
Report card grade
100%
Overall score
What these scores mean
- Vendor completeness
- The share of this CNA's CVEs that name an affected vendor.
- Product completeness
- The share that name a specific affected product.
- CVSS completeness
- The share that include a CVSS severity score.
- CWE completeness
- The share mapped to a CWE weakness type.
- Update rate
- How often this CNA revises CVE records after first publishing them.
- Vendor diversity
- How many distinct vendors this CNA publishes CVEs for.
Severity and exploitation
How the CVSS severity of GandC's published CVEs breaks down, and how many are known to be exploited in the wild.
In CISA’s Known Exploited Vulnerabilities catalog
0
None of GandC's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Common weakness types
The CWE weakness categories GandC most often assigns to its CVEs. Follow any weakness to its full explanation.
Publishing activity by year
How many CVEs GandC has published each year.
Top vendors
The vendors GandC publishes the most CVEs for.
- Xpdf19 CVEs
- xpdfreader15 CVEs
- glyphandcog1 CVEs
Top products
The products GandC publishes the most CVEs for.
- Xpdf19 CVEs
Latest CVEs
The most recent CVEs assigned by GandC.
- CVE-2026-4407CWE-20
Out-of-bounds array write in Xpdf 4.06 due to missing validation
Low · CVSS 2.1EPSS 0.1%2026-03-18 - CVE-2025-11896CWE-674
Stack overflow in Xpdf 4.05 due to object loop in PDF CMap
Low · CVSS 2.1EPSS 0.2%2025-10-16 - CVE-2025-3154CWE-787
Out-of-bounds array write due to invalid VerticesPerRow in Xpdf 4.05
Low · CVSS 2.1EPSS 0.2%2025-04-02 - CVE-2025-2574CWE-190
Out-of-bounds array write in Xpdf 4.05 due to incorrect integer overflow checking
Low · CVSS 2.1EPSS 0.2%2025-03-20 - CVE-2024-7868CWE-457
Uninitialized variable in Xpdf 4.05 due to invalid JPEG header
Low · CVSS 2.1EPSS 0.4%2024-08-15 - CVE-2024-7867CWE-369Low · CVSS 2.1EPSS 0.2%2024-08-15
- CVE-2024-7866CWE-674
Stack overflow in Xpdf 4.05 due to object loop in PDF pattern
Low · CVSS 2.1EPSS 0.2%2024-08-15 - CVE-2024-4976CWE-787
Out-of-bounds array write in Xpdf 4.05 due to missing object type check
Low · CVSS 2.1EPSS 0.2%2024-05-15 - CVE-2024-4568CWE-674Medium · CVSS 5.5EPSS 0.2%2024-05-06
- CVE-2024-4141CWE-787Medium · CVSS 5.5EPSS 0.2%2024-04-24
- CVE-2024-3900CWE-787Medium · CVSS 5.5EPSS 0.2%2024-04-17
- CVE-2024-3248CWE-674
Stack overflow in Xpdf 4.05 due to object loop in attachments
Medium · CVSS 5.5EPSS 0.3%2024-04-02
Track new GandC CVEs as they are published and get AI-written analysis and remediation guidance.
Monitor GandC CVEsOther CNAs
Compare data quality across other CVE Numbering Authorities.
Frequently asked questions
Common questions about the GandC CNA.
- What is the GandC CNA?
- GandC is a CVE Numbering Authority (CNA) — an organization authorized to assign CVE IDs to vulnerabilities in its scope. It has published 18 CVE records since 2023.
- How many CVEs has GandC published?
- GandC has published 18 CVE records, including 13 in the last two years.
- What is GandC's CVE data quality grade?
- RadicalNotion.AI grades GandC's CVE data quality as A, with an overall completeness score of 100%. This reflects how consistently its CVE records include vendor (100%), product (100%), CVSS (100%), and CWE (100%) information.
- What products does GandC publish CVEs for?
- GandC most frequently publishes CVEs for Xpdf.
- Which vendors does GandC cover?
- GandC publishes CVEs across 1 distinct vendors, most often Xpdf, xpdfreader, glyphandcog.
- Is GandC actively publishing CVEs?
- GandC is currently active, based on 13 CVEs in the last two years.
- What is the average severity of GandC's CVEs?
- The average CVSS base score across GandC's scored CVEs is 2.6.
- How many critical CVEs has GandC published?
- GandC has published 1 critical-severity CVEs and 0 high-severity CVEs.
- Are any of GandC's CVEs in CISA's Known Exploited Vulnerabilities catalog?
- No. None of GandC's CVEs are currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
- What are the most common weakness types in GandC's CVEs?
- GandC's CVEs most often map to these CWE weakness types: CWE-674 (Uncontrolled Recursion), CWE-787 (Out-of-bounds Write), CWE-369 (Divide By Zero), CWE-833 (Deadlock).
- How does GandC rank among CNAs?
- By total CVE volume, GandC ranks #254 of 370 CNAs, and it reports more complete CVE records than 60% of all CNAs.
References
- Official CVE.org list of CNA partners (opens in a new tab)
- Learn: What is a CNA?
- CWE directory: the weakness types this CNA maps its CVEs to
CNA report-card grades are computed by RadicalNotion.AI from published CVE records. CVE data is sourced from the CVE Program.
Track GandC CVEs
Monitor new vulnerabilities as this CNA publishes them, with AI-written analysis and remediation guidance.