What is the OpenHarmony CNA?

OpenHarmony is a CVE Numbering Authority (CNA) — an organization authorized to assign CVE IDs to vulnerabilities in its scope. It has published 160 CVE records since 2022.

How many CVEs has OpenHarmony published?

OpenHarmony has published 160 CVE records, including 114 in the last two years.

What is OpenHarmony's CVE data quality grade?

RadicalNotion.AI grades OpenHarmony's CVE data quality as A, with an overall completeness score of 100%. This reflects how consistently its CVE records include vendor (100%), product (100%), CVSS (100%), and CWE (100%) information.

What products does OpenHarmony publish CVEs for?

OpenHarmony most frequently publishes CVEs for OpenHarmony, OpenHarmony v5.0.3 and prior versions, liteos_a, OpenHarmony v5.0.3.

Which vendors does OpenHarmony cover?

OpenHarmony publishes CVEs across 1 distinct vendors, most often OpenHarmony, openatom.

Is OpenHarmony actively publishing CVEs?

OpenHarmony is currently active, based on 114 CVEs in the last two years.

What is the average severity of OpenHarmony's CVEs?

The average CVSS base score across OpenHarmony's scored CVEs is 5.1.

How many critical CVEs has OpenHarmony published?

OpenHarmony has published 5 critical-severity CVEs and 68 high-severity CVEs.

What are the most common weakness types in OpenHarmony's CVEs?

OpenHarmony's CVEs most often map to these CWE weakness types: CWE-416 (Use After Free), CWE-125 (Out-of-bounds Read), CWE-787 (Out-of-bounds Write), CWE-20 (Improper Input Validation).

How does OpenHarmony rank among CNAs?

By total CVE volume, OpenHarmony ranks #96 of 370 CNAs, and it reports more complete CVE records than 60% of all CNAs.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

Grade A

Active

OpenHarmony

Name: OpenHarmony CNA CVE data quality report card
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE Numbering Authority

Latest CVE published August 11, 2025

160

CVEs published

Total assigned

2.9

Years active

2022–2025

5.1

Avg CVSS

Across scored CVEs

114

Recent CVEs

Last 2 years

Overview

OpenHarmony is a CVE Numbering Authority that has published 160 CVE records since 2022. It is currently classified as active, with 114 CVEs published in the last two years. Its CVE data quality is graded A (100% overall completeness).

Among the 370 CNAs tracked here, OpenHarmony ranks #96 by CVE volume and reports more complete records than 60% of all CNAs.

Data quality report card

How complete and consistent OpenHarmony's CVE records are, scored across vendor, product, CVSS, and CWE coverage.

A CVE record only requires a description to be published. “Completeness” measures how often OpenHarmony also fills in the optional — but extremely useful — fields that make a vulnerability actually actionable: the affected vendor and product, a CVSS severity score, and a CWE weakness type. A higher score means more of this CNA’s CVEs include those details, so defenders spend less time enriching records by hand.

Report card grade

A

100%

Overall score

Overall completeness100%

Vendor completeness100%

Product completeness100%

CVSS completeness100%

CWE completeness100%

100%

Update rate

Records revised after publishing

1

Vendor diversity

Distinct vendors covered

149 chars

Avg description length

Per CVE record

2022-09-09

First CVE date

Earliest assignment

2025-08-11

Latest CVE date

Most recent assignment

5.1

Average CVSS

Across scored CVEs

What these scores mean

Vendor completeness: The share of this CNA's CVEs that name an affected vendor.
Product completeness: The share that name a specific affected product.
CVSS completeness: The share that include a CVSS severity score.
CWE completeness: The share mapped to a CWE weakness type.
Update rate: How often this CNA revises CVE records after first publishing them.
Vendor diversity: How many distinct vendors this CNA publishes CVEs for.

Severity and exploitation

How the CVSS severity of OpenHarmony's published CVEs breaks down, and how many are known to be exploited in the wild.

Critical5

High68

Medium97

Low7

In CISA’s Known Exploited Vulnerabilities catalog

0

None of OpenHarmony's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Common weakness types

The CWE weakness categories OpenHarmony most often assigns to its CVEs. Follow any weakness to its full explanation.

Publishing activity by year

How many CVEs OpenHarmony has published each year.

2022

16

2023

17

2024

61

2025

66

2026

17

Top vendors

The vendors OpenHarmony publishes the most CVEs for.

OpenHarmony177 CVEs
openatom156 CVEs

Top products

The products OpenHarmony publishes the most CVEs for.

OpenHarmony177 CVEs
OpenHarmony v5.0.3 and prior versions2 CVEs
liteos_a1 CVEs
OpenHarmony v5.0.31 CVEs

Latest CVEs

The most recent CVEs assigned by OpenHarmony.

CVE-2026-33565CWE-364
kernel_linux_common_modules has a Race Condition vulnerability
Low · CVSS 3.3
EPSS 0.1%2026-05-19
CVE-2026-28733CWE-416
filemanagement_storage_service has an use after free vulnerability
Medium · CVSS 6.5
EPSS 0.1%2026-05-19
CVE-2026-27766CWE-364
multimedia_audio_framework has a Race Condition vulnerability
Medium · CVSS 5.5
EPSS 0.1%2026-05-19
CVE-2026-25850CWE-281
filemanagement_storage_service has an improper preservation of permissions vulnerability
Medium · CVSS 5.5
EPSS 0.1%2026-05-19
CVE-2026-25781CWE-787
kernel_liteos_a has an out-of-bounds write vulnerability
High · CVSS 8.4
EPSS 0.1%2026-05-19
CVE-2026-28751CWE-20
filemanagement_storage_service has an improper input validation vulnerability
Low · CVSS 3.3
EPSS 0.1%2026-05-19
CVE-2026-27781CWE-190
kernel_liteos_a has an integer overflow vulnerability
Low · CVSS 3.3
EPSS 0.1%2026-05-19
CVE-2026-27648CWE-787
web_webview has an out-of-bounds write vulnerability
High · CVSS 8.8
EPSS 0.6%2026-05-19
CVE-2026-25110CWE-476
Sensors_medical_sensor has a NULL pointer dereference vulnerability
Low · CVSS 3.3
EPSS 0.1%2026-05-19
CVE-2026-24792CWE-364
web_webview has a Race Condition vulnerability
High · CVSS 8.1
EPSS 0.4%2026-05-19
CVE-2025-6969CWE-20
ability_ability_runtime an improper input validation vulnerability
Medium · CVSS 5.5
EPSS 0.1%2026-03-16
CVE-2025-26474CWE-20
communication_ipc an improper input validation vulnerability
Low · CVSS 3.3
EPSS 0.1%2026-03-16

Track new OpenHarmony CVEs as they are published and get AI-written analysis and remediation guidance.

Monitor OpenHarmony CVEs

Other CNAs

Compare data quality across other CVE Numbering Authorities.

mitreGrade F · 112,208 CVEs PatchstackGrade A · 14,729 CVEs VulDBGrade A · 12,140 CVEs microsoftGrade F · 11,701 CVEs redhatGrade F · 10,745 CVEs GitHub_MGrade A · 10,605 CVEs LinuxGrade F · 10,294 CVEs WordfenceGrade A · 8,652 CVEs

Browse all CNAs

Frequently asked questions

Common questions about the OpenHarmony CNA.

What is the OpenHarmony CNA?: OpenHarmony is a CVE Numbering Authority (CNA) — an organization authorized to assign CVE IDs to vulnerabilities in its scope. It has published 160 CVE records since 2022.
How many CVEs has OpenHarmony published?: OpenHarmony has published 160 CVE records, including 114 in the last two years.
What is OpenHarmony's CVE data quality grade?: RadicalNotion.AI grades OpenHarmony's CVE data quality as A, with an overall completeness score of 100%. This reflects how consistently its CVE records include vendor (100%), product (100%), CVSS (100%), and CWE (100%) information.
What products does OpenHarmony publish CVEs for?: OpenHarmony most frequently publishes CVEs for OpenHarmony, OpenHarmony v5.0.3 and prior versions, liteos_a, OpenHarmony v5.0.3.
Which vendors does OpenHarmony cover?: OpenHarmony publishes CVEs across 1 distinct vendors, most often OpenHarmony, openatom.
Is OpenHarmony actively publishing CVEs?: OpenHarmony is currently active, based on 114 CVEs in the last two years.
What is the average severity of OpenHarmony's CVEs?: The average CVSS base score across OpenHarmony's scored CVEs is 5.1.
How many critical CVEs has OpenHarmony published?: OpenHarmony has published 5 critical-severity CVEs and 68 high-severity CVEs.
Are any of OpenHarmony's CVEs in CISA's Known Exploited Vulnerabilities catalog?: No. None of OpenHarmony's CVEs are currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
What are the most common weakness types in OpenHarmony's CVEs?: OpenHarmony's CVEs most often map to these CWE weakness types: CWE-416 (Use After Free), CWE-125 (Out-of-bounds Read), CWE-787 (Out-of-bounds Write), CWE-20 (Improper Input Validation).
How does OpenHarmony rank among CNAs?: By total CVE volume, OpenHarmony ranks #96 of 370 CNAs, and it reports more complete CVE records than 60% of all CNAs.

References

CNA report-card grades are computed by RadicalNotion.AI from published CVE records. CVE data is sourced from the CVE Program.

Track OpenHarmony CVEs

Monitor new vulnerabilities as this CNA publishes them, with AI-written analysis and remediation guidance.

Start free See pricing