[{"s":"2N","n":"2N Telekomunikace a.s.","co":"Czech Republic","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All products of 2N Telekomunikace a.s. including end-of-life/end-of-service products.","adv":"https://www.2n.com/en-GB/about-2n/cybersecurity/security-advisories","pol":"https://www.2n.com/en-GB/about-2n/cybersecurity/vulnerability-management","arab":0},{"s":"42Gears","n":"42Gears Mobility Systems Pvt Ltd","co":"India","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"42Gears branded products and technologies only.","adv":"https://www.42gears.com/security-and-compliance/","pol":"https://www.42gears.com/security-and-compliance/","arab":0},{"s":"9front","n":"9front Systems","co":"USA","t":["Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All software produced as part of the Plan9front open source operating system, as well as its applications and cyberinfrastructure. Vulnerabilities discovered by or reported to 9front Systems for all Plan 9 software not covered by the scope of another CNA.","adv":"http://bugs.9front.org/","pol":"http://bugs.9front.org/disclosure","arab":0},{"s":"Absolute","n":"Absolute Software","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Absolute issues only.","adv":"https://www.absolute.com/platform/security-information/vulnerability-archive/","pol":"https://www.absolute.com/platform/security-information/vulnerability-reporting-management","arab":0},{"s":"Acer","n":"Acer Inc.","co":"Taiwan","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Acer issues only.","adv":"https://www.acer.com/us-en/support/security-advisory","pol":"https://www.acer.com/us-en/support/security-advisory","arab":0},{"s":"Acronis","n":"Acronis International GmbH","co":"Switzerland","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Acronis products, including Acronis Cyber Protect, Acronis Cyber Protect Home Office, Acronis DeviceLock DLP, and Acronis Snap Deploy.","adv":"https://security-advisory.acronis.com/advisories","pol":"https://hackerone.com/acronis","arab":0},{"s":"adobe","n":"Adobe Systems Incorporated","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Adobe issues only.","adv":"https://helpx.adobe.com/security.html","pol":"https://hackerone.com/adobe","arab":0},{"s":"AMD","n":"Advanced Micro Devices Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"AMD branded products and technologies only. AMD does not evaluate, remediate, or issue CVE IDs for vulnerabilities that only affect End-of-Life/End-of-Support products and technologies.","adv":"https://www.amd.com/en/resources/product-security.html#security","pol":"https://www.amd.com/en/resources/product-security.html#vulnerability","arab":0},{"s":"airbus","n":"Airbus","co":"Netherlands","t":["Vendor","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Airbus products (supported products and end-of-life/end-of-service products), as well as vulnerabilities in third-party software discovered by Airbus that are not in another CNA’s scope.","adv":"https://airbus-seclab.github.io/","pol":"https://www.airbus.com/en/airbus-contact-us#:~:text=Vulnerability%20disclosure%20guidelines","arab":0},{"s":"Airlock","n":"Airlock by Ergon","co":"Switzerland","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Airlock issues only: Airlock SaaS, Airlock Identity and Access Management (IAM), Airlock Gateway, and Airlock Microgateway.","adv":"https://www.airlock.com/security-advisories","pol":"https://www.airlock.com/security-advisories","arab":0},{"s":"Airoha","n":"Airoha Technology Corp.","co":"Taiwan","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Airoha product issues only.","adv":"https://www.airoha.com/product-security-bulletin","pol":"https://www.airoha.com/about/governance/intellectual/security-contact#disclosure-policy","arab":0},{"s":"AISLE","n":"AISLE Incorporated","co":"Netherlands","t":["Vendor","Researcher"],"root":"EU Agency for Cybersecurity (ENISA)","roles":["CNA"],"scope":"All AISLE products as well as vulnerabilities discovered in third-party software not covered by other CNA’s scope.","adv":"https://aisle.com/cve-discoveries","pol":"https://aisle.com/vulnerability-disclosure","arab":0},{"s":"AlgoSec","n":"AlgoSec","co":"Israel","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"AlgoSec products only.","adv":"https://www.algosec.com/resources/guide/algosec-security-center/#:~:text=05-,Security%20advisories,-List%20of%20CVEs","pol":"https://www.algosec.com/resources/guide/algosec-security-center/#:~:text=Frequently%20asked%20questions-,Overview,-At%20AlgoSec%2C%20we","arab":0},{"s":"Alias","n":"Alias Robotics S.L.","co":"Spain","t":["Vendor","Researcher"],"root":"Spanish National Cybersecurity Institute, S.A. (INCIBE)","roles":["CNA"],"scope":"All Alias Robotics products, as well as vulnerabilities discovered by Alias Robotics that are not within another CNA’s scope.","adv":"https://github.com/aliasrobotics/RVD","pol":"https://github.com/aliasrobotics/RVD#disclosure-policy","arab":0},{"s":"alibaba","n":"Alibaba, Inc.","co":"China","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Projects listed on its <a href='https://github.com/alibaba' target='_blank'>Alibaba GitHub website</a> only.","adv":"https://security.alibaba.com/announcement.htm","pol":"https://github.com/alibaba/disclosure/blob/main/README.md","arab":0},{"s":"Almaviva","n":"Almaviva S.p.A.","co":"Italy","t":["Vendor","Hosted Service"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in Almaviva proprietary software solutions such as Joshua CybeRisk Vision, Jiano, Sofia, and Giotto, as well as Almaviva-developed IT solutions.","adv":"https://www.cyberiskvision.com/zero-day/","pol":"https://www.almaviva.it/it_IT/CNA_vulnerability_disclosure_policy","arab":0},{"s":"Altera","n":"Altera","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Altera products only.","adv":"https://www.altera.com/security/psirt","pol":"https://www.altera.com/security/psirt","arab":0},{"s":"Altium","n":"Altium","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in the following Altium products only: Altium Designer, A365, Octopart, and Altium Enterprise Server.","adv":"https://www.altium365.com/trust/security-advisories","pol":"https://www.altium365.com/trust/vulnerability-program","arab":0},{"s":"AMZN","n":"Amazon","co":"USA","t":["Vendor","Bug Bounty Provider","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Amazon and AWS products (including subsidiaries, supported, and EOL/EOS products), as well as vulnerabilities in third party software discovered by Amazon/AWS that are not in another CNA’s scope.","adv":"https://aws.amazon.com/security/security-bulletins","pol":"https://aws.amazon.com/security/vulnerability-reporting","arab":0},{"s":"AMI","n":"AMI","co":"USA","t":["Vendor","Open Source","Researcher"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Vulnerabilities in AMI firmware and software products, as well as vulnerabilities discovered by AMI that are not covered by another CNA scope.","adv":"https://www.ami.com/security-center/","pol":"https://www.ami.com/security-center/","arab":0},{"s":"Ampere","n":"Ampere Computing","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Ampere issues only.","adv":"https://amperecomputing.com/products/product-security.html","pol":"https://amperecomputing.com/products/product-security.html","arab":0},{"s":"ADI","n":"Analog Devices, Inc.","co":"USA","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Vulnerabilities in ADI firmware and software products.","adv":"https://www.analog.com/en/support/technical-support/product-security-response-center.html","pol":"https://www.analog.com/en/support/technical-support/product-security-response-center/vulnerability-disclosure-policy.html","arab":0},{"s":"google_android","n":"Android (associated with Google Inc. or Open Handset Alliance)","co":"USA","t":["Vendor","Open Source","Researcher"],"root":"Google LLC","roles":["CNA"],"scope":"Android issues, as well as vulnerabilities in third-party software discovered by Android that are not in another CNA’s scope.","adv":"https://source.android.com/security/bulletin","pol":"https://source.android.com/security/overview/updates-resources#report-issues","arab":0},{"s":"Antenna","n":"Antenna","co":"USA","t":["Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Antenna issues only.","adv":"https://antenna.dev/security/advisories","pol":"https://antenna.dev/security/reporting","arab":0},{"s":"Anthropic","n":"Anthropic, PBC","co":"USA","t":["Vendor","AI Researcher (Frontier AI Researcher CVE Numbering Authorities (CNAs) Pilot)"],"root":"MITRE Corporation","roles":["CNA"],"scope":"<strong>CNA Scope:</strong> Vulnerabilities in software, services, and open-source projects developed, maintained, or distributed by Anthropic. This includes Claude Code, Claude Desktop, browser extensions, the Model Context Protocol (MCP) SDKs and reference servers, Anthropic API client SDKs, and related developer tooling published under the Anthropic, anthropic-experimental, and modelcontextprot","adv":"https://trust.anthropic.com/resources#6a44049fd659a87d0068f0c5","pol":"https://www.anthropic.com/responsible-disclosure-policy","arab":0},{"s":"apache","n":"Apache Software Foundation","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Apache Software Foundation issues only.","adv":"https://www.openwall.com/lists/oss-security","pol":"https://www.apache.org/security/","arab":0},{"s":"AppCheck","n":"AppCheck Ltd.","co":"UK","t":["Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities discovered by AppCheck that are not within another CNA’s scope.","adv":"https://appcheck-ng.com/category/security-alerts/","pol":"https://appcheck-ng.com/security/","arab":0},{"s":"apple","n":"Apple Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Apple issues only.","adv":"https://support.apple.com/en-us/HT201222","pol":"https://support.apple.com/en-us/HT201220","arab":0},{"s":"arcinfo","n":"ARC Informatique","co":"France","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"ARC Informatique products and services.","adv":"https://www.pcvue.com/security","pol":"https://www.pcvue.com/policies/vuln_disclosure","arab":0},{"s":"ARCON","n":"ARCON Techsolutions Private Limited","co":"India","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in ARCON’s products only.","adv":"https://arconnet.com/security-advisories/","pol":"https://arconnet.com/product-security-disclosure/","arab":0},{"s":"Arista","n":"Arista Networks, Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Arista products only.","adv":"https://www.arista.com/en/support/advisories-notices","pol":"https://www.arista.com/en/support/advisories-notices","arab":0},{"s":"Arm","n":"Arm Limited","co":"UK","t":["Open Source","Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Arm-branded products and technologies and Arm-managed open source projects.","adv":"https://developer.arm.com/Arm%20Security%20Center","pol":"https://developer.arm.com/documentation/102850/0100","arab":0},{"s":"Armis","n":"Armis, Inc.","co":"USA","t":["Vendor","Researcher"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"All Armis products, as well as vulnerabilities in third-party software discovered by Armis that are not in another CNA’s scope.","adv":"https://www.armis.com/legal-compliance/security-advisories/","pol":"https://www.armis.com/legal-compliance/vulnerability-disclosure-policy/","arab":0},{"s":"Arteche","n":"Arteche","co":"Spain","t":["Vendor"],"root":"Spanish National Cybersecurity Institute, S.A. (INCIBE)","roles":["CNA"],"scope":"Arteche issues only.","adv":"https://www.arteche.com/en/cybersecurity-advisories","pol":"https://www.arteche.com/es/cmis/document/default/848286f4-236d-4b55-896b-c9e503ea688e","arab":0},{"s":"Arxscan","n":"Arxscan, Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Arxscan issues only.","adv":"https://arxscan.com/cybersecurity-vulnerability-policy/security-advisories","pol":"https://arxscan.com/cybersecurity-vulnerability-policy","arab":0},{"s":"ABB","n":"Asea Brown Boveri Ltd. (ABB)","co":"Switzerland","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"ABB issues only.","adv":"https://global.abb/group/en/technology/cyber-security/alerts-and-notifications","pol":"https://library.e.abb.com/public/5961d0d7e2a747728a531a79e3752c31/9ADB005059_ABB_SoftwareVulnerabilityWhitepaper_RevG.pdf?x-sign=y1gE9dzvYeyMAo08CtpfnMmrkal+yQmKEnAZzibtRGINn/cNyboac07SS64tnFN5","arab":0},{"s":"ASR","n":"ASR Microelectronics Co., Ltd.","co":"China","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"ASR products only.","adv":"https://www.asrmicro.com/en/goods/psirt","pol":"https://www.asrmicro.com/en/goods/policy","arab":0},{"s":"ASUS","n":"ASUSTeK Computer Incorporation","co":"Taiwan","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"ASUS issues only.","adv":"https://www.asus.com/content/asus-product-security-advisory/","pol":"https://www.asus.com/content/asus-product-security-advisory/","arab":0},{"s":"ASUSTOR","n":"ASUSTOR, Inc.","co":"Taiwan","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"ASUSTOR issues only.","adv":"https://www.asustor.com/security/security_advisory","pol":"https://www.asustor.com/security/security_advisory","arab":0},{"s":"ATIS","n":"ATISoluciones Diseño de Sistemas Electrónicos, S.L.","co":"Spain","t":["Vendor"],"root":"Spanish National Cybersecurity Institute, S.A. (INCIBE)","roles":["CNA"],"scope":"AtiSoluciones products only.","adv":"https://www.atisoluciones.com/incidentes-cve","pol":"https://www.atisoluciones.com/politica-cve","arab":0},{"s":"atlassian","n":"Atlassian","co":"Australia","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Atlassian products, as well as Atlassian-maintained projects hosted on <a href='https://bitbucket.org/' target='_blank'>https://bitbucket.org/</a> and <a href='https://github.com/atlassian/' target='_blank'>https://github.com/atlassian/</a>.","adv":"https://www.atlassian.com/trust/security/advisory-publishing-policy","pol":"https://bugcrowd.com/atlassian","arab":0},{"s":"AHA","n":"Austin Hackers Anonymous","co":"USA","t":["Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in the AHA! website and other AHA! controlled assets, as well as vulnerabilities identified in assets owned, operated, or maintained by another organization unless covered by the scope of another CNA.","adv":"https://takeonme.org/cve.html","pol":"https://takeonme.org/cve.html","arab":0},{"s":"autodesk","n":"Autodesk","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All currently supported <a href='https://knowledge.autodesk.com/support' target='_blank'>Autodesk Applications and Cloud Services</a>.","adv":"https://www.autodesk.com/trust/security-advisories","pol":"https://www.autodesk.com/trust/security/vulnerability-disclosure-policy","arab":0},{"s":"ASRG","n":"Automotive Security Research Group (ASRG)","co":"USA","t":["Researcher"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"All automotive and related infrastructure vulnerabilities that are not in another CNA’s scope.","adv":"https://www.asrg.io/security-advisories/","pol":"https://www.asrg.io/disclosure/","arab":0},{"s":"Automox","n":"Automox Inc.","co":"USA","t":["Vendor","Hosted Service"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All products created by Automox.","adv":"https://www.automox.com/platform/security/security-bulletin","pol":"https://www.automox.com/platform/security/responsible-disclosure","arab":0},{"s":"avaya","n":"Avaya, Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Avaya Generally Available (GA) products that are not in another CNA’s scope. A CVE ID will not be issued for End of Manufacturing Support (EoMS) products/versions.","adv":"https://support.avaya.com/security","pol":"https://downloads.avaya.com/css/P8/documents/100045520","arab":0},{"s":"Axis","n":"Axis Communications AB","co":"Sweden","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All products of Axis Communications AB including end-of-life/end-of-service products.","adv":"https://www.axis.com/support/cybersecurity/vulnerability-management","pol":"https://help.axis.com/en-us/axis-vulnerability-management-policy","arab":0},{"s":"AxxonSoft","n":"AxxonSoft Limited","co":"Ireland","t":["Vendor","Hosted Service"],"root":"MITRE Corporation","roles":["CNA"],"scope":"AxxonSoft products and solutions, Abetechs GmbH products and solutions (GRUNDIG security products, and C-WERK software solutions).","adv":"https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy/security-advisories","pol":"https://www.axxonsoft.com/legal/axxonsoft-vulnerability-disclosure-policy","arab":0},{"s":"azure-access","n":"Azure Access Technology","co":"USA","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Azure Access branded products and technologies only.","adv":"https://azure-access.com/security-advisories","pol":"https://azure-access.com/responsible-disclosure-policy","arab":0},{"s":"B.Braun","n":"B. Braun SE","co":"Germany","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"B. Braun’s commercially available products only.","adv":"https://www.bbraun.com/en/products-and-solutions/b--braun-product-security.html","pol":"https://www.bbraun.com/en/products-and-solutions/b--braun-product-security.html","arab":0},{"s":"BAE","n":"BAE Systems, Inc.","co":"USA","t":["Hosted Service"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"All products of BAE Systems.","adv":"https://www.geospatialexploitationproducts.com/socet-gxp/vulnerabilities-disclosure/","pol":"https://www.baesystems.com/en-us/vulnerability-disclosure","arab":0},{"s":"Baidu","n":"Baidu, Inc.","co":"China","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Projects listed on Baidu’s <a href='https://github.com/PaddlePaddle' target='_blank'>PaddlePaddle GitHub website</a> only.","adv":"https://github.com/PaddlePaddle/Paddle/tree/develop/security","pol":"https://github.com/PaddlePaddle/Paddle/security/policy","arab":0},{"s":"Baxter","n":"Baxter Healthcare","co":"USA","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Baxter’s commercially available products only.","adv":"https://www.baxter.com/product-security#additionalresources","pol":"https://www.baxter.com/product-security#disclosure","arab":0},{"s":"BECDX","n":"Beckman Coulter Diagnostics","co":"USA","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Beckman Coulter Diagnostics manufactured products and technologies only.","adv":"https://www.beckmancoulter.com/en/about-beckman-coulter/product-security/product-security-updates","pol":"https://www.beckmancoulter.com/en/about-beckman-coulter/product-security","arab":0},{"s":"BECLS","n":"Beckman Coulter Life Sciences","co":"USA","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Beckman Coulter Life Sciences manufactured products and technologies only.","adv":"https://www.beckman.com/about-us/compliance/coordinated-vulnerability-disclosure/product-security-updates","pol":"https://www.beckman.com/about-us/compliance/coordinated-vulnerability-disclosure","arab":0},{"s":"BD","n":"Becton, Dickinson and Company (BD)","co":"USA","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"BD software-enabled medical devices only.","adv":"https://cybersecurity.bd.com/bulletins-and-patches","pol":"https://cybersecurity.bd.com/vulnerability-disclosures","arab":0},{"s":"BT","n":"BeyondTrust Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All BeyondTrust products, including <a href='https://www.beyondtrust.com/products/password-safe' target='_blank'>PasswordSafe</a>, <a href='https://www.beyondtrust.com/products/privileged-remote-access' target='_blank'>Privileged Remote Access</a>, <a href='https://www.beyondtrust.com/products/remote-support' target='_blank'>Remote Support</a>, <a href='https://www.beyondtrust.com/products/privile","adv":"https://www.beyondtrust.com/trust-center/security-advisories","pol":"https://www.beyondtrust.com/disclosure","arab":0},{"s":"BHV","n":"Biohacking Village","co":"USA","t":["Researcher"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Vulnerabilities discovered by researchers in collaboration with Biohacking Village, with approval of Biohacking Village’s sponsors, that are not in another CNA’s scope.","adv":"https://www.villageb.io/security-advisory","pol":"https://www.villageb.io/cvd","arab":0},{"s":"Bitdefender","n":"Bitdefender","co":"Romania","t":["Vendor","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Bitdefender products, as well as vulnerabilities in third-party software discovered by Bitdefender that are not in another CNA’s scope.","adv":"https://www.bitdefender.com/support/security-advisories","pol":"https://www.bitdefender.com/media/materials/bug_bounty/Bitdefender_Bug_Bounty_Terms_and_Conditions.pdf","arab":0},{"s":"bizerba","n":"Bizerba SE & Co. KG","co":"Germany","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Bizerba products only.","adv":"https://www.bizerba.com/us/en/family-owned-and-operated-company-since-1866/corporate-governance-acting-responsibly-globally/bizerba-security-information","pol":"https://www.bizerba.com/int/en/family-owned-and-operated-company-since-1866/corporate-governance-acting-responsibly-globally/security-policy","arab":0},{"s":"BlackDuck","n":"Black Duck Software, Inc.","co":"USA","t":["Vendor","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Black Duck (formerly Synopsys Software Integrity Group) products, as well as vulnerabilities in third-party software discovered by Black Duck that are not in another CNA’s scope.","adv":"https://www.blackduck.com/blog/category.cyrc.html#1","pol":"https://www.blackduck.com/company/legal/vulnerability-disclosure-policy.html","arab":0},{"s":"BLSOPS","n":"Black Lantern Security","co":"USA","t":["Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in vendor products discovered by BLSOPS, or related parties, while performing vulnerability research or security assessments, unless covered by another CNA’s scope.","adv":"https://www.blacklanternsecurity.com/advisories/","pol":"https://www.blacklanternsecurity.com/disclosure-policy/","arab":0},{"s":"blackberry","n":"BlackBerry","co":"Canada","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All BlackBerry products identified on <a href='https://www.blackberry.com/us/en' target='_blank'>https://www.blackberry.com/us/en</a>.","adv":"https://www.blackberry.com/us/en/services/blackberry-product-security-incident-response","pol":"https://www.blackberry.com/us/en/services/blackberry-product-security-incident-response/report-an-issue/blackberry-coordinated-vulnerability-disclosure-policy","arab":0},{"s":"BombadilSystems","n":"Bombadil Systems LLC","co":"USA","t":["Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in third-party software discovered by Bombadil Systems that are not in another CNA’s scope.","adv":"https://bombadil.systems/advisories.html","pol":"https://bombadil.systems/disclosure.html","arab":0},{"s":"brocade","n":"Brocade Communications Systems LLC, a Broadcom Company","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Brocade products only.","adv":"https://www.broadcom.com/support/fibre-channel-networking/security-advisories","pol":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/21739","arab":0},{"s":"Bugcrowd","n":"Bugcrowd Inc.","co":"USA","t":["Bug Bounty Provider","Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities discovered by researchers in collaboration with Bugcrowd, with approval of Bugcrowd’s clients, and not in the scope of another CNA.","adv":"https://bugcrowd.com/crowdstream?filter=disclosures","pol":"https://bugcrowd.com/bugcrowd","arab":0},{"s":"Bull","n":"Bull SAS","co":"France","t":["Vendor"],"root":"EU Agency for Cybersecurity (ENISA)","roles":["CNA"],"scope":"Products and technologies branded by Bull and its subsidiaries, unless covered by the scope of another CNA as well as vulnerabilities in third-party software and hardware discovered by Bull and its subsidiaries that are not in another CNA’s scope.","adv":"https://myatos.my.site.com/psmcustomer/s/topic/0TObD0000000XonWAE/psirt?language=en_US","pol":"https://myatos.my.site.com/psmcustomer/s/article/Responsible-Disclosure?language=en_US","arab":0},{"s":"ByteDance","n":"ByteDance, Ltd.","co":"China","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"ByteDance issues only.","adv":"https://src.bytedance.com/announcement","pol":"https://bytedance.larkoffice.com/docx/DmandP3o9oEQBdx0fkycqMHNnPd","arab":0},{"s":"ca","n":"CA Technologies - A Broadcom Company","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"CA Technologies issues only. Note that Broadcom PSIRT handles all CA issues.","adv":"https://support.broadcom.com/security-advisory/security-advisories-list.html?segment=ES","pol":"https://www.broadcom.com/support/resources/product-security-center","arab":0},{"s":"Caliptra","n":"Caliptra Project","co":"USA","t":["Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Caliptra Project components and vulnerabilities that are not in another CNA’s scope.","adv":"https://github.com/chipsalliance/Caliptra/security/advisories","pol":"https://github.com/chipsalliance/Caliptra/security/policy","arab":0},{"s":"Canon_EMEA","n":"Canon EMEA","co":"UK","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Products, services, and solutions developed by Canon EMEA, Canon USA Inc., and those from IRIS, NT-ware, Onyx Graphics Inc., and Therefore Corporation, which are not under the Canon Brand.","adv":"https://www.canon-europe.com/psirt/advisory-information","pol":"https://www.canon-europe.com/psirt","arab":0},{"s":"Canon","n":"Canon Inc.","co":"Japan","t":["Vendor"],"root":"JPCERT/CC","roles":["CNA"],"scope":"Vulnerabilities in products and services under the Canon brand.","adv":"https://psirt.canon/advisory-information/","pol":"https://psirt.canon/vulnerability-disclosure-policy/","arab":0},{"s":"canonical","n":"Canonical Ltd.","co":"UK","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Canonical issues (including Ubuntu Linux) only.","adv":"https://usn.ubuntu.com/","pol":"https://ubuntu.com/security/disclosure-policy","arab":0},{"s":"Canva","n":"Canva","co":"Australia","t":["Vendor","Open Source","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Canva products, including open-source software published and maintained by Canva, as well as vulnerabilities in third-party software discovered by Canva that are not in another CNA’s scope.","adv":"https://trust.canva.com/","pol":"https://www.canva.com/security/vulnerability-disclosure/","arab":0},{"s":"Carrier","n":"Carrier Global Corporation","co":"USA","t":["Hosted Service","Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Carrier Global products only.","adv":"https://www.corporate.carrier.com/product-security/advisories-resources/","pol":"https://www.corporate.carrier.com/product-security/reporting-response-disclosures/","arab":0},{"s":"Cato","n":"Cato Networks","co":"Israel","t":["Vendor","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Cato Networks products and vulnerabilities in third-party products affecting Cato products unless covered by the scope of another CNA.","adv":"https://securityadvisories.catonetworks.com/","pol":"https://event.catonetworks.com/securityissuesreport","arab":0},{"s":"Censys","n":"Censys","co":"USA","t":["Vendor","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Censys products, and vulnerabilities discovered by Censys that are not in another CNA’s scope.","adv":"https://censys.io/blog","pol":"https://censys.io/vulnerability-disclosure","arab":0},{"s":"Centreon","n":"Centreon","co":"France","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Centreon product issues only.","adv":"https://thewatch.centreon.com/latest-security-bulletins-64","pol":"https://vdp.centreon.com/p/centreon-VDP","arab":0},{"s":"CEP","n":"Cepheid","co":"USA","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Cepheid products.","adv":"https://www.cepheid.com/en-US/legal/product-security/product-security-updates.html","pol":"https://www.cepheid.com/en-US/legal/product-security.html","arab":0},{"s":"CERT-PL","n":"CERT.PL","co":"Poland","t":["CERT"],"root":"EU Agency for Cybersecurity (ENISA)","roles":["CNA"],"scope":"Vulnerabilities in software discovered by CERT.PL, and vulnerabilities reported to CERT.PL for coordinated disclosure, which are not in another CNA’s scope.","adv":"https://cert.pl/cve/","pol":"https://cert.pl/cvd/","arab":0},{"s":"CERTVDE","n":"CERT@VDE","co":"Germany","t":["CERT"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["Root","CNA"],"scope":"<strong>Root Scope:</strong> Organizations that are cooperative partners of CERT@VDE.<br/><strong>CNA Scope:</strong> Products of CERT@VDE cooperative partners and brands listed at <a href='https://cert.vde.com/en/cna/' target='_blank'>https://cert.vde.com/en/cna/</a>. Also, industrial and infrastructure control systems (and its components) of European Union (EU) based vendors unless covered by th","adv":"https://cert.vde.com/en-us/advisories","pol":"https://cert.vde.com/en/more/certvde/disclosure-policy/","arab":0},{"s":"certcc","n":"CERT/CC","co":"USA","t":["CERT"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerability assignment related to its vulnerability coordination role.","adv":"https://www.kb.cert.org/vuls/bypublished/desc/","pol":"https://certcc.github.io/CERT-Guide-to-CVD/tutorials/coord_certcc/","arab":0},{"s":"chainguard","n":"Chainguard, Inc.","co":"USA","t":["Vendor","Hosted Service","Open Source","Researcher"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Chainguard Containers/Libraries/VMs, tooling, and vulnerabilities introduced by our packaging or patching of Wolfi packages (upstream flaws in packaged software excluded).<br/><br/>Additionally, vulnerabilities in open source projects identified through the Athena coalition, where upstream has remediated without an assigned identifier, or where no maintainer is active, and no more specific CNA cov","adv":"https://images.chainguard.dev/security","pol":"https://www.chainguard.dev/legal/coordinated-vulnerability-handling-policy","arab":0},{"s":"checkpoint","n":"Check Point Software Ltd.","co":"Israel","t":["Vendor","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Check Point Security Gateways product line only, and any vulnerabilities discovered by Check Point that are not in another CNA’s scope.","adv":"https://www.checkpoint.com/advisories/","pol":"https://cpr-zero.checkpoint.com/policy/","arab":0},{"s":"Checkmarx","n":"Checkmarx","co":"Israel","t":["Vendor","Open Source","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in Checkmarx products and open source vulnerabilities discovered by, or reported to, Checkmarx, that are not in another CNA’s scope.","adv":"https://advisory.checkmarx.net/","pol":"https://devhub.checkmarx.com/disclosure-policy/","arab":0},{"s":"Checkmk","n":"Checkmk GmbH","co":"Germany","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All products of Checkmk GmbH including Checkmk and Checkmk Appliance, Nagvis, Robotmk, and packages published on <a href='https://exchange.checkmk.com/' target='_blank'>exchange.checkmk.com</a>.","adv":"https://checkmk.com/werks","pol":"https://checkmk.com/responsible-disclosure-policy","arab":0},{"s":"Chrome","n":"Chrome","co":"USA","t":["Vendor","Open Source","Researcher"],"root":"Google LLC","roles":["CNA"],"scope":"Chrome issues and projects that are not in another CNA’s scope.","adv":"https://chromereleases.googleblog.com/","pol":"https://www.google.com/about/appsecurity/","arab":0},{"s":"ChromeOS","n":"ChromeOS Project","co":"USA","t":["Vendor","Bug Bounty Provider"],"root":"Google LLC","roles":["CNA"],"scope":"Vulnerabilities that are (1) reported to ChromeOS Security, (2) affect ChromeOS device software and hardware, including our open source dependencies, and (3) are not covered by another CNA’s scope.","adv":"https://chromereleases.googleblog.com/","pol":"https://www.google.com/about/appsecurity/research/","arab":0},{"s":"Ciena","n":"Ciena Corporation","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Ciena and Blue Planet branded products and technologies only.","adv":"https://www.ciena.com/product-security","pol":"https://www.ciena.com/__data/assets/pdf_file/0026/128933/Notice-of-Vulnerability-Disclosure-Policy-VDP.pdf","arab":0},{"s":"Circutor","n":"Circutor","co":"Spain","t":["Vendor"],"root":"Spanish National Cybersecurity Institute, S.A. (INCIBE)","roles":["CNA"],"scope":"All vulnerabilities affecting Circutor and Circontrol products.","adv":"https://circutor.com/soporte/ciberseguridad/","pol":"https://circutor.sharepoint.com/:b:/s/GestorDocumental/IQBd8ld4COldTb18_WDDF_OvAZRXTbSyciP5rYwXBDoDyVw?e=gL9GNd","arab":0},{"s":"cirosec","n":"cirosec GmbH","co":"Germany","t":["Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities discovered by or reported to cirosec researchers that are not in another CNA’s scope.","adv":"https://cirosec.de/en/blog/#vulnerabilities","pol":"https://cirosec.de/cirosec-responsible-disclosure-policy/","arab":0},{"s":"cisco","n":"Cisco Systems, Inc.","co":"USA","t":["Hosted Service","Open Source","Researcher","Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Cisco products, and any third-party research targets that are not in another CNA’s scope. Cisco will not issue a CVE ID for issues reported on products that are past the Last Day of Support milestone, as defined on Cisco’s End-of-Life Policy, which is available at <a href='https://www.cisco.com/c/en/us/products/eos-eol-policy.html' target='_blank'>https://www.cisco.com/c/en/us/products/eos-eol","adv":"https://tools.cisco.com/security/center/resources/security_vulnerability_policy.html#sa","pol":"https://www.cisco.com/c/en/us/about/security-center/security-vulnerability-policy.html","arab":0},{"s":"Citrix","n":"Citrix Systems, Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Citrix issues only.","adv":"https://support.citrix.com/securitybulletins","pol":"https://www.citrix.com/about/trust-center/vulnerability-process.html","arab":0},{"s":"ClickHouse","n":"ClickHouse, Inc.","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"ClickHouse-owned products, not including end-of-life components.","adv":"https://clickhouse.com/docs/en/whats-new/security-changelog","pol":"https://github.com/ClickHouse/ClickHouse/security/policy","arab":0},{"s":"CSAI","n":"Cloud Security Alliance","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in software developed and maintained by the Cloud Security Alliance (github.com/CloudSecurityAlliance/*).","adv":"https://labs.cloudsecurityalliance.org/advisories/","pol":"https://github.com/CloudSecurityAlliance/csa-product-security/blob/main/docs/vulnerability-disclosure-policy.md","arab":0},{"s":"cloudflare","n":"Cloudflare, Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Cloudflare products, projects hosted at <a href='https://github.com/cloudflare/' target='_blank'>https://github.com/cloudflare/</a>, and any vulnerabilities discovered by Cloudflare that are not in another CNA’s scope.","adv":"https://hackerone.com/cloudflare/hacktivity","pol":"https://www.cloudflare.com/disclosure/","arab":0},{"s":"CODRA","n":"CODRA","co":"France","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"CODRA’s products and related services.","adv":"https://my.codra.net/en-gb/csirt","pol":"https://my.codra.net/en-gb/messages/csirt-disclosure-policy","arab":0},{"s":"Commvault","n":"Commvault Systems Inc.","co":"USA","t":["Vendor","Hosted Service"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in Commvault SaaS and software products only.","adv":"https://documentation.commvault.com/securityadvisories","pol":"https://trust.commvault.com/resources?s=vwnojdk0a0vsbx0qknnb&amp;name=vulnerability-disclosure-policy#689bba5cdc60fd4597bfd694","arab":0},{"s":"CIRCL","n":"Computer Incident Response Center Luxembourg (CIRCL)","co":"Luxembourg","t":["CERT"],"root":"EU Agency for Cybersecurity (ENISA)","roles":["CNA"],"scope":"Vulnerability assignment related to vulnerability coordination in Luxembourg, which may include reports on software, products, hardware, or services submitted to CIRCL in its role as the national authority for vulnerability coordination in Luxembourg and within the CSIRTs network.","adv":"https://vulnerability.circl.lu/search?assigner=CIRCL","pol":"https://www.circl.lu/pub/coordinated-vulnerability-disclosure/","arab":0},{"s":"ConcreteCMS","n":"Concrete CMS","co":"USA","t":["Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Concrete CMS Core versions 8.5 and above.","adv":"https://www.concretecms.org/about/project-news/security","pol":"https://www.concretecms.org/security","arab":0},{"s":"ConnectWise","n":"ConnectWise LLC","co":"USA","t":["Vendor","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All ConnectWise products and services and vulnerabilities discovered by ConnectWise in third party products that are not within another CNA’s scope.","adv":"https://www.connectwise.com/company/trust/security-bulletins","pol":"https://www.connectwise.com/company/trust/security/vulnerability-disclosure-policy","arab":0},{"s":"CPANSec","n":"CPAN Security Group","co":"Canada","t":["Open Source"],"root":"Red Hat, Inc.","roles":["CNA"],"scope":"Vulnerabilities in Perl and CPAN Modules (including End-of-Life Perl versions) found at <a href='https://perl.org' target='_blank'>https://perl.org</a>, <a href='https://cpan.org' target='_blank'>https://cpan.org</a>, or <a href='https://metacpan.org/' target='_blank'>https://metacpan.org/</a>, excluding distributions of Perl or CPAN Modules maintained by third-party redistributors.","adv":"https://lists.security.metacpan.org/cve-announce/","pol":"https://security.metacpan.org/docs/cna-disclosure-policy.html","arab":0},{"s":"Crafter_CMS","n":"Crafter CMS","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"<a href='https://craftercms.org/' target='_blank'>Crafter CMS</a> issues only.","adv":"https://docs.craftercms.org/en/4.0/security/advisory.html","pol":"https://docs.craftercms.org/en/4.0/security/security-policies.html","arab":0},{"s":"Crestron","n":"Crestron Electronics, Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Crestron products.","adv":"https://www.crestron.com/Security/Security_Advisories","pol":"https://www.crestron.com/Security/Report-A-Product-Vulnerability","arab":0},{"s":"Cribl","n":"Cribl, Inc.","co":"USA","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Vulnerabilities identified in Cribl products, and vulnerabilities discovered by, or reported to, Cribl that are not in another CNA’s scope.","adv":"https://trust.cribl.io/notifications","pol":"https://cribl.io/vulnerability-disclosure-program/","arab":0},{"s":"CrowdStrike","n":"CrowdStrike Holdings, Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All CrowdStrike products.","adv":"https://www.crowdstrike.com/security-advisories/","pol":"https://www.crowdstrike.com/report-a-security-bug/","arab":0},{"s":"CTOne","n":"CTOne Inc.","co":"Taiwan","t":["Vendor","Researcher","Bug Bounty Provider"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Vulnerabilities in cellular (LTE/4G/5G) devices and protocols that are not in another CNA’s scope.","adv":"https://ctone.com/published-product-vulnerabilities/","pol":"https://ctone.com//wp-content/uploads/2024/07/CTOne-Vulnerability-Disclosure-Policy.pdf","arab":0},{"s":"curl","n":"curl","co":"Sweden","t":["Open Source"],"root":"Red Hat, Inc.","roles":["CNA"],"scope":"All products made and managed by the curl project. This includes curl, libcurl, and trurl.","adv":"https://curl.se/docs/security.html","pol":"https://curl.se/dev/vuln-disclosure.html","arab":0},{"s":"CSA","n":"Cyber Security Agency of Singapore","co":"Singapore","t":["CERT"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities reported to CSA unless covered by the scope of another CNA.","adv":"https://www.csa.gov.sg/alerts-advisories","pol":"https://www.csa.gov.sg/resources/singcert/csa-as-a-cve-numbering-authority--cna-","arab":0},{"s":"CSW","n":"Cyber Security Works Pvt. Ltd.","co":"India","t":["Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in third-party software discovered by CSW that are not in another CNA’s scope.","adv":"https://cybersecurityworks.com/zerodays-vulnerability-list/","pol":"https://cybersecurityworks.com/vulnerability-disclosure-policy.php","arab":0},{"s":"CyberArk","n":"CyberArk Labs","co":"Israel","t":["Vendor","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities discovered by CyberArk Labs that are not in another CNA’s scope.","adv":"https://labs.cyberark.com/cyberark-labs-security-advisories/","pol":"https://labs.cyberark.com/coordinated-disclosure-policy/","arab":0},{"s":"CyberDanube","n":"CyberDanube","co":"Austria","t":["Researcher","Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"All CyberDanube products, as well as vulnerabilities in third-party hardware/software discovered by CyberDanube or partners actively engaged in vulnerability research coordination, which are not within the scope of another CNA.","adv":"https://cyberdanube.com/en/blogs/","pol":"https://cyberdanube.com/en/responsible-disclosure-policy/","arab":0},{"s":"CISA","n":"Cybersecurity and Infrastructure Security Agency (CISA)","co":"USA","t":["N/A"],"root":"n/a","roles":["Top-Level Root","ADP"],"scope":"<strong>Top-Level Root Scope:</strong> Vulnerabilities that are (1) reported to or observed by CISA and (2) affect critical infrastructure, U.S. civilian government, industrial control systems, or medical devices, and (3) are not covered by another CNA’s scope.<br/><strong>ADP Scope:</strong> View scope <a href='/ProgramOrganization/ADPs#ActiveAdps'>here</a>.","adv":"https://www.cisa.gov/news-events/cybersecurity-advisories","pol":"https://www.cisa.gov/coordinated-vulnerability-disclosure-process","arab":0},{"s":"icscert","n":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","co":"USA","t":["CERT"],"root":"Cybersecurity and Infrastructure Security Agency (CISA)","roles":["Root","CNA-LR"],"scope":"Vulnerabilities that are (1) reported to or observed by CISA, (2) affect industrial control systems or medical devices, and (3) are not covered by another CNA’s scope.","adv":"https://cisa.gov/icsa","pol":"https://www.cisa.gov/coordinated-vulnerability-disclosure-process","arab":0},{"s":"cisa-cg","n":"Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government","co":"USA","t":["CERT"],"root":"Cybersecurity and Infrastructure Security Agency (CISA)","roles":["CNA"],"scope":"Vulnerabilities that are (1) reported to or observed by CISA, (2) affect critical infrastructure or U.S. civilian government, and (3) are not covered by another CNA’s scope.","adv":"https://www.cisa.gov/news-events/cybersecurity-advisories","pol":"https://www.cisa.gov/coordinated-vulnerability-disclosure-process","arab":0},{"s":"cygence","n":"Cygence Pty Ltd","co":"Australia","t":["Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Issues in third-party products identified by, or reported, to Cygence, unless covered by the scope of another CNA.","adv":"https://www.cygence.com.au/vulnerability-disclosures","pol":"https://www.cygence.com.au/disclosure-policy","arab":0},{"s":"Cynet","n":"Cynet Security Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in Cynet Security products and services, including the Cynet Platform (formerly marketed as Cynet360 and All in One), endpoint agents (Windows, macOS, Linux), Cynet-managed APIs, web applications, and internet-facing infrastructure operated by Cynet Security.","adv":"https://cynet.com/security-advisories","pol":"https://www.cynet.com/cynet-responsible-disclosure-policy/","arab":0},{"s":"Cytiva","n":"Cytiva","co":"USA","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Cytiva branded products only.","adv":"https://www.cytivalifesciences.com/en/se/product-security","pol":"https://www.cytivalifesciences.com/en/se/product-security/disclosure-process","arab":0},{"s":"dahua","n":"Dahua Technologies","co":"China","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Dahua consumer Internet of Things (IoT) products, excludes End-of-Life products.","adv":"https://www.dahuasecurity.com/aboutUs/trustedCenter/trustworthy","pol":"https://www.dahuasecurity.com/aboutUs/trustedCenter/trustworthy","arab":0},{"s":"Danfoss","n":"Danfoss","co":"Denmark","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Danfoss products only.","adv":"https://www.danfoss.com/en/service-and-support/coordinated-vulnerability-disclosure/danfoss-security-advisories/","pol":"https://www.danfoss.com/en/service-and-support/coordinated-vulnerability-disclosure/vulnerability-disclosure-policy/","arab":0},{"s":"Dassault_Systemes","n":"Dassault Systèmes","co":"France","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All websites of the corporate group and of any subsidiaries, including but not limited to <a href='https://www.3ds.com' target='_blank'>www.3ds.com</a> and <a href='https://www.solidworks.com' target='_blank'>www.solidworks.com</a>; all Software as a Service solutions, such as 3DEXPERIENCE or ScienceCloud, but also any online hosting linked to our brands; and all Dassault Systèmes licensed softwar","adv":"https://www.3ds.com/vulnerability/advisories","pol":"https://www.3ds.com/vulnerability","arab":0},{"s":"debian","n":"Debian GNU/Linux","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Debian issues only.","adv":"https://www.debian.org/security/#DSAS","pol":"https://www.debian.org/security/disclosure-policy","arab":0},{"s":"Delinea","n":"Delinea, Inc.","co":"USA","t":["Vendor","Hosted Service","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in Delinea products or services listed on <a href='https://www.delinea.com' target='_blank'>delinea.com</a>, or vulnerabilities in third-party products or services discovered by or reported to Delinea, unless covered by the scope of another CNA.","adv":"https://trust.delinea.com/","pol":"https://trust.delinea.com/?itemUid=56583ca0-6561-4cf3-a150-8c0c45d214cf","arab":0},{"s":"dell","n":"Dell","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Dell, Dell EMC, and VCE issues only.","adv":"https://www.dell.com/support/security/en-us","pol":"https://www.dell.com/support/contents/us/en/04/article/product-support/self-support-knowledgebase/security-antivirus/alerts-vulnerabilities/dell-vulnerability-response-policy","arab":0},{"s":"Deltaww","n":"Delta Electronics, Inc.","co":"Taiwan","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Delta Electronics products as listed on <a href='https://www.deltaww.com' target='_blank'>www.deltaww.com</a>.","adv":"https://www.deltaww.com/en-US/Cybersecurity_Advisory","pol":"https://www.deltaww.com/en-US/information/Cybersecurity-Vulnerability-Management-Policy","arab":0},{"s":"DevCycle","n":"DevCycle","co":"Canada","t":["Vendor","Hosted Service","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All DevCycle products (including end-of-life/end-of-service products) as listed on <a href='https://devcycle.com/' target='_blank'>https://devcycle.com/</a>.","adv":"https://github.com/DevCycleHQ/.github/blob/main/.github/SECURITY.md#previous-vulnerabilities-reported","pol":"https://github.com/DevCycleHQ/.github/blob/main/.github/SECURITY.md","arab":0},{"s":"DEVOLUTIONS","n":"Devolutions Inc.","co":"Canada","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Devolutions products only.","adv":"https://devolutions.net/security/advisories/","pol":"https://devolutions.net/security","arab":0},{"s":"Dfinity","n":"DFINITY Foundation","co":"Switzerland","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Internet Computer projects as found on the following GitHub pages: <a href='https://github.com/dfinity' target='_blank'>https://github.com/dfinity</a> and <a href='https://github.com/dfinity-lab' target='_blank'>https://github.com/dfinity-lab</a>.","adv":"https://internetcomputer.org/security-advisories","pol":"https://github.com/dfinity/ic/security/policy","arab":0},{"s":"Digi","n":"Digi International Inc.","co":"USA","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Digi branded products and services only.","adv":"https://www.digi.com/resources/security","pol":"https://www.digi.com/resources/security/submit-security-vulnerability","arab":0},{"s":"directcyber","n":"DirectCyber","co":"Australia","t":["Researcher","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Issues in third-party products identified by or reported to DirectCyber, unless covered by the scope of another CNA.","adv":"https://directcyber.com.au/advisory.html","pol":"https://directcyber.com.au/report.html","arab":0},{"s":"DSF","n":"Django Software Foundation","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Only supported and end-of-life Django versions available at <a href='https://www.djangoproject.com/download/' target='_blank'>https://www.djangoproject.com/download/</a> and projects listed at <a href='https://github.com/django' target='_blank'>https://github.com/django</a> (such as Django, channels, and daphne), excluding distributions maintained by third-party redistributors.","adv":"https://docs.djangoproject.com/en/stable/releases/security/","pol":"https://www.djangoproject.com/foundation/cve-numbering-authority/","arab":0},{"s":"Docker","n":"Docker Inc.","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Docker products, including Docker Desktop and Docker Hub, as well as Docker maintained open source projects.","adv":"https://docs.docker.com/security/","pol":"https://www.docker.com/trust/vulnerability-disclosure-policy/","arab":0},{"s":"Document_Fdn.","n":"Document Foundation, The","co":"Germany","t":["Vendor","Open Source"],"root":"Red Hat, Inc.","roles":["CNA"],"scope":"Projects within The Document Foundation only, e.g., LibreOffice, LibreOffice Online; The Document Foundation discourages reporting denial of service bugs as security issues.","adv":"https://www.libreoffice.org/security-info/","pol":"https://www.libreoffice.org/security/","arab":0},{"s":"dotCMS","n":"dotCMS LLC","co":"USA","t":["Hosted Service"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All dotCMS product services including the vulnerabilities reported in our open source core located at <a href='https://github.com/dotCMS/core' target='_blank'>https://github.com/dotCMS/core</a>.","adv":"https://www.dotcms.com/docs/latest/known-security-issues","pol":"https://www.dotcms.com/docs/latest/responsible-disclosure-policy","arab":0},{"s":"Dragos","n":"Dragos, Inc.","co":"USA","t":["Vendor","Researcher"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Dragos products and third-party products it researches related to operational technology (OT)/industrial control systems (ICS) not covered by another CNA.","adv":"https://www.dragos.com/advisories/","pol":"https://www.dragos.com/vulnerabilities-policy","arab":0},{"s":"Dremio","n":"Dremio Corporation","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Dremio Corporation products.","adv":"https://docs.dremio.com/current/reference/bulletins/","pol":"https://www.dremio.com/platform/security/responsible-disclosure-limitations/","arab":0},{"s":"drupal","n":"Drupal.org","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All projects hosted under <a href='https://www.drupal.org' target='_blank'>drupal.org</a>, including End of Life (EOL) code.","adv":"https://www.drupal.org/security","pol":"https://www.drupal.org/drupal-security-team/security-advisory-process-and-permissions-policy","arab":0},{"s":"DTEX","n":"DTEX Systems, Inc.","co":"USA","t":["Vendor","Hosted Service"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All DTEX products, including DTEX Forwarder for Mac, DTEX Forwarder for Linux, DTEX Forwarder for Windows, and DTEX platform including DTEX Analytics Server.","adv":"https://advisories.dtexsystems.com","pol":"https://advisories.dtexsystems.com/vulnerability-disclosure-policy.pdf","arab":0},{"s":"DualVS","n":"Dual Vipers LLC","co":"USA","t":["Hosted Service","Open Source","Researcher","Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Dual Vipers projects and products (both open and closed source), as well as vulnerabilities in third-party software discovered by Dual Vipers that are not in another CNA’s scope.","adv":"https://advisory.dualvs.com","pol":"https://advisory.dualvs.com/VDP.html","arab":0},{"s":"DIVD","n":"Dutch Institute for Vulnerability Disclosure (DIVD)","co":"Netherlands","t":["Researcher"],"root":"EU Agency for Cybersecurity (ENISA)","roles":["CNA"],"scope":"Vulnerabilities in software discovered by DIVD, and vulnerabilities reported to DIVD for coordinated disclosure, which are not in another CNA’s scope.","adv":"https://csirt.divd.nl/cves/","pol":"https://www.divd.nl/code/","arab":0},{"s":"OTRS","n":"EasyVista-OTRS GmbH","co":"Germany","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities affecting the products, their security-relevant components, and functionality developed and maintained by companies within the EasyVista Group, including: <br/><br/><strong>OTRS</strong> - OTRS and features developed and maintained by OTRS GmbH; OTRS container distribution bundle, including container images customized, configured, or maintained by OTRS GmbH; OTRS SaaS and platform ","adv":"https://otrs.com/overview-release-notes-security-advisories/security-advisories/","pol":"https://otrs.com/vulnerability-disclosure-policy/","arab":0},{"s":"Eaton","n":"Eaton","co":"Ireland","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Eaton issues only.","adv":"https://www.eaton.com/us/en-us/company/news-insights/cybersecurity/security-notifications.html","pol":"https://www.eaton.com/us/en-us/company/news-insights/cybersecurity/vulnerabilitydisclosure.html","arab":0},{"s":"Echo","n":"Echo Software Ltd.","co":"Israel","t":["Vendor","Open Source","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in Echo products, as well as vulnerabilities discovered by or reported to Echo that are not in another CNA’s scope.","adv":"https://www.echohq.com/vulnerability-disclosure","pol":"https://www.echohq.com/vulnerability-disclosure","arab":0},{"s":"eclipse","n":"Eclipse Foundation","co":"Belgium","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All projects hosted by the Eclipse Foundation as listed at <a href='https://www.eclipse.org/projects/' target='_blank'>https://www.eclipse.org/projects/</a> and services provided by the Eclipse Foundation to support open source projects as listed at <a href='https://www.eclipsestatus.io/' target='_blank'>https://www.eclipsestatus.io/</a>.","adv":"https://www.eclipse.org/security/known.php","pol":"https://www.eclipse.org/security","arab":0},{"s":"eclypsium","n":"Eclypsium, Inc.","co":"USA","t":["Vendor","Researcher"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"All software created and distributed by Eclypsium, as well as vulnerabilities discovered by, or reported to, Eclypsium that are not in another CNA’s scope.","adv":"https://eclypsium.com/advisories","pol":"https://eclypsium.com/vulnerability-disclosure-policy","arab":0},{"s":"Edgewatch","n":"Edgewatch Security Intelligence","co":"Spain","t":["Hosted Service","Researcher"],"root":"Spanish National Cybersecurity Institute, S.A. (INCIBE)","roles":["CNA"],"scope":"Vulnerabilities in third-party software discovered by Edgewatch that are not in another CNA’s scope.","adv":"https://edgewatch.com/vulnerability-advisories/","pol":"https://edgewatch.com/legal/disclosure/","arab":0},{"s":"ELAN","n":"ELAN Microelectronics Corp.","co":"Taiwan","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"ELAN issues only.","adv":"https://www.emc.com.tw/emc/en/Product/Solution/TouchpadSolutions","pol":"https://www.emc.com.tw/emc/tw/vulnerability-disclosure-policy","arab":0},{"s":"elastic","n":"Elastic","co":"Netherlands","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Elasticsearch, Kibana, Beats, Logstash, X-Pack, and Elastic Cloud Enterprise products only.","adv":"https://www.elastic.co/community/security","pol":"https://www.elastic.co/community/security","arab":0},{"s":"EA","n":"Electronic Arts, Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"EA issues only.","adv":"https://www.ea.com/security/advisories","pol":"https://www.ea.com/security/disclosure","arab":0},{"s":"EDB","n":"EnterpriseDB Corporation","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All EnterpriseDB products and vulnerabilities identified in open source libraries used by EnterpriseDB products unless covered by another CNA’s scope.","adv":"https://www.enterprisedb.com/docs/security/advisories/","pol":"https://www.enterprisedb.com/docs/security/vulnerability-disclosure-policy/","arab":0},{"s":"Entrust","n":"Entrust Corporation","co":"USA","t":["Vendor","Hosted Service"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"All products under the following brand names: Entrust, Datacard, Entrust Datacard, nCipher, Onfido, Hytrust, SafeLayer, Antelop, Evidos, SMS Passcode.","adv":"https://www.entrust.com/knowledgebase/content-type/security-advisory","pol":"https://www.entrust.com/legal-compliance/security#responsibledisclosure","arab":0},{"s":"Esri","n":"Environmental Systems Research Institute, Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Esri products only, including ArcGIS.","adv":"https://trust.arcgis.com/en/","pol":"https://trust.arcgis.com/en/security-concern/","arab":0},{"s":"ERIC","n":"Ericsson","co":"Sweden","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Ericsson issues only.","adv":"https://www.ericsson.com/en/about-us/security/security-bulletins","pol":"https://www.ericsson.com/en/about-us/security/ericsson-product-security-and-vulnerability-disclosure-policy","arab":0},{"s":"EEF","n":"Erlang Ecosystem Foundation","co":"USA","t":["Consortium","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in active packages hosted on <a href='https://hex.pm/' target='_blank'>Hex.pm</a>, and in active projects hosted under the GitHub organizations <a href='https://github.com/elixir-lang' target='_blank'>@elixir-lang</a>, <a href='https://github.com/erlang' target='_blank'>@erlang</a>, <a href='https://github.com/erlef-cna' target='_blank'>@erlef-cna</a>, <a href='https://github.com/e","adv":"https://cna.erlef.org/cves","pol":"https://cna.erlef.org/security-policy","arab":0},{"s":"esaqa","n":"esaqa GmbH","co":"Germany","t":["Vendor"],"root":"EU Agency for Cybersecurity (ENISA)","roles":["CNA"],"scope":"All products developed and maintained by esaqa GmbH.","adv":"https://gitlab.com/esaqa/esaqa/security-advisories","pol":"https://esaqa.com/vulnerability-disclosure-policy","arab":0},{"s":"ESET","n":"ESET, spol. s r.o.","co":"Slovak Republic","t":["Vendor"],"root":"EU Agency for Cybersecurity (ENISA)","roles":["CNA"],"scope":"All ESET products only and vulnerabilities discovered by ESET that are not covered by another CNA’s scope.","adv":"https://support-feed.eset.com/advisories/","pol":"https://www.eset.com/int/security-vulnerability-reporting/","arab":0},{"s":"ENISA","n":"EU Agency for Cybersecurity (ENISA)","co":"Greece","t":["Consortium"],"root":"MITRE Corporation","roles":["Root","CNA"],"scope":"<strong>Root Scope:</strong> European Union (EU) member states/EU authorities, EU CSIRTs network members, and cooperative partners under ENISA’s mandate as well as other CNAs who choose ENISA as their Root.<br/><br/><strong>CNA Scope:</strong> Vulnerabilities in information technology (IT) products discovered by European Union (EU) Computer Security Incident Response Teams (CSIRTs) or reported to ","adv":"https://github.com/enisaeu/CNW/tree/main/advisories","pol":"https://csirtsnetwork.eu/homepage?tab=cvd","arab":0},{"s":"Everpure","n":"Everpure, Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Everpure (formerly Pure Storage, Inc.) products only.","adv":"https://support.purestorage.com/bundle/m_security_bulletins/page/Pure_Security/topics/concept/c_security_bulletins.html","pol":"https://support.purestorage.com/bundle/m_product_security_policy/page/Employee_Handbooks/Technical_Services/PSIRT/topics/concept/c_pure_storage_vulnerability_reporting_and_disclosure_policy.html","arab":0},{"s":"XI","n":"Exodus Intelligence","co":"USA","t":["Bug Bounty Provider","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities discovered by Exodus Intelligence as well as acquisitions from independent researchers via its Research Sponsorship Program (RSP).","adv":"https://blog.exodusintel.com/advisories/","pol":"https://blog.exodusintel.com/2021/03/17/2021-disclosure-policy/","arab":0},{"s":"ExtremeNetworks","n":"Extreme Networks, Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities discovered in Extreme Networks, Inc.’s products and services.","adv":"https://extreme-networks.my.site.com/ExtrSearch#q=cve&t=Knowledge&sort=relevancy&f:@sfrecordtypename=[Security_Advisory]","pol":"https://www.extremenetworks.com/support/psirt","arab":0},{"s":"F5","n":"F5, Inc.","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All F5 products and services, commercial and open source, which have not yet reached End of Technical Support (EoTS). All legacy acquisition products and brands including, but not limited to, NGINX, Shape Security, Volterra, and Threat Stack. F5 does not issue CVEs for products which are no longer supported.","adv":"https://my.f5.com/manage/s/new-updated-articles#sort=%40f5_updated_published_date%20descending&amp;f:@f5_document_type=[Security%20Advisory]&amp;periodFilter=4&amp;dateField=0","pol":"https://support.f5.com/csp/article/K4602","arab":0},{"s":"fedora","n":"Fedora Project","co":"USA","t":["Vendor","Open Source"],"root":"Red Hat, Inc.","roles":["CNA"],"scope":"Vulnerabilities in open source projects affecting the Fedora Project, that are not covered by a more specific CNA. CVEs can be assigned to vulnerabilities affecting end-of-life or unsupported releases by the Fedora Project.","adv":"https://bodhi.fedoraproject.org/updates/?type=security","pol":"https://fedoraproject.org/wiki/Security_Bugs#Reporting_a_Security_Vulnerability","arab":0},{"s":"FERMAX","n":"Fermax Technologies SLU","co":"Spain","t":["Vendor"],"root":"Spanish National Cybersecurity Institute, S.A. (INCIBE)","roles":["CNA"],"scope":"Vulnerabilities discovered in the services and applications of the MeetMe and DuoxMe products that are not covered by another CNA’s scope.","adv":"https://www.fermax.com/security-advisories","pol":"https://www.fermax.com/legal/en/vulnerability-management-policy","arab":0},{"s":"Fidelis","n":"Fidelis Security, LLC","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Fidelis issues only.","adv":"https://support.fidelissecurity.com/hc/en-us/categories/360001842694-Advisories-News-and-Policies","pol":"https://fidelissecurity.com/security","arab":0},{"s":"FSI","n":"Financial Security Institute (FSI)","co":"South Korea","t":["CERT","Researcher","Bug Bounty Provider"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerability assignment related to FSI’s vulnerability coordination role in the South Korea financial sector that are not in another CNA’s scope.","adv":"https://www.fsec.or.kr/bbs/1010","pol":"https://www.fsec.or.kr/bbs/detail?menuNo=1010&bbsNo=11403","arab":0},{"s":"flexera","n":"Flexera Software LLC","co":"USA","t":["Vendor","Open Source","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Flexera, Revenera, and Snow Software products, and vulnerabilities discovered by Secunia Research that are not in another CNA’s scope.","adv":"https://security-info.flexera.com/","pol":"https://www.flexera.com/products/operations/software-vulnerability-research/secunia-research/disclosure-policy.html?_ga=2.126100429.1927534686.1582843801-707336045.1578583910","arab":0},{"s":"flock","n":"Flock","co":"USA","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Flock branded hardware and software products only.","adv":"https://www.flocksafety.com/legal/security-advisories","pol":"https://www.flocksafety.com/legal/vulnerability-disclosure-policy","arab":0},{"s":"floragunn","n":"floragunn GmbH","co":"Germany","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All issues related to Search Guard only.","adv":"https://search-guard.com/cve-advisory","pol":"https://search-guard.com/disclosure-policy","arab":0},{"s":"Fluid_Attacks","n":"Fluid Attacks","co":"Colombia","t":["Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in third-party software discovered by or reported to Fluid Attacks that are not in another CNA’s scope.","adv":"https://fluidattacks.com/advisories/","pol":"https://fluidattacks.com/advisories/policy/","arab":0},{"s":"forcepoint","n":"Forcepoint","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Forcepoint products only.","adv":"https://support.forcepoint.com/s/knowledge-base#t=All&sort=relevancy&f:@sfrecordtypename=[Security%20Advisory]","pol":"https://www.forcepoint.com/company/innovation/product-security-report-issue","arab":0},{"s":"Forescout","n":"Forescout Technologies","co":"USA","t":["Vendor","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in Forescout products and vulnerabilities in other products discovered by Forescout that are not in another CNA's scope.","adv":"https://docs.forescout.com/bundle/vulnerabilities/","pol":"https://www.forescout.com/security-disclosure/","arab":0},{"s":"fortinet","n":"Fortinet, Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Fortinet issues only.","adv":"https://www.fortiguard.com/psirt","pol":"https://www.fortiguard.com/psirt_policy","arab":0},{"s":"Fortra","n":"Fortra, LLC","co":"USA","t":["Vendor","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Fortra products and vulnerabilities discovered by Fortra in other products not covered by the scope of another CNA.","adv":"https://www.fortra.com/security","pol":"https://www.fortra.com/security/policy","arab":0},{"s":"Foxit","n":"Foxit Software Incorporated","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Foxit issues only.","adv":"https://www.foxit.com/support/security.html","pol":"https://www.foxit.com/support/responsible-disclosure-policy.html","arab":0},{"s":"FSOFT","n":"FPT Software Co., Ltd.","co":"Vietnam","t":["Vendor","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All products and services developed and operated by FPT Software, as well as vulnerabilities in third-party software discovered by FPT Software that are not in another CNA’s scope.","adv":"https://fptsoftware.com/security-advisories","pol":"https://fptsoftware.com/vulnerability-disclosure/","arab":0},{"s":"freebsd","n":"FreeBSD","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Primarily FreeBSD issues only.","adv":"https://www.freebsd.org/","pol":"https://www.freebsd.org/security/","arab":0},{"s":"FTI","n":"Fsas Technologies","co":"Germany","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Fsas Technologies (a Fujitsu company) in the Europe/EMEA region only.","adv":"https://security.eu.fsastech.com","pol":"https://security.eu.fsastech.com","arab":0},{"s":"FB","n":"Fujifilm Business Innovation Corp.","co":"Japan","t":["Vendor"],"root":"JPCERT/CC","roles":["CNA"],"scope":"Fuji Xerox and FUJIFILM Business Innovation products such as multifunction devices, printers, production printers, software, and cloud services.","adv":"https://www.fujifilm.com/fbglobal/eng/company/quality/product_security/vulnerability","pol":"https://www.fujifilm.com/fbglobal/eng/company/quality/vdp","arab":0},{"s":"FULL","n":"FULL INTERNET","co":"Brazil","t":["Bug Bounty Provider","Hosted Service","Vendor","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All FULL products, as well as vulnerabilities in third-party software discovered by FULL that are not in another CNA’s scope.","adv":"https://security.full.services/vulnerabilidades-no-wordpress/","pol":"https://security.full.services/politica-de-divulgacao-de-vulnerabilidades/","arab":0},{"s":"Gallagher","n":"Gallagher Group Ltd.","co":"New Zealand","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"All Gallagher security products only.","adv":"https://security.gallagher.com/Security-Advisories","pol":"https://security.gallagher.com/responsible-disclosure-policy","arab":0},{"s":"GE_Healthcare","n":"GE Healthcare","co":"USA","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"GE Healthcare products.","adv":"https://www.gehealthcare.com/security","pol":"https://www.gehealthcare.com/security/cvd","arab":0},{"s":"GE_Vernova","n":"GE Vernova","co":"USA","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"All GE Vernova products.","adv":"https://www.gevernova.com/gas-power/products/digital-and-controls/cybersecurity/security-advisories","pol":"https://www.gevernova.com/gas-power/products/digital-and-controls/cybersecurity/vulnerability-response","arab":0},{"s":"GEN","n":"Gen Digital Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Gen Digital products and websites.","adv":"https://www.gendigital.com/us/en/contact-us/security-advisories/","pol":"https://www.gendigital.com/us/en/contact-us/report-a-potential-security-vulnerability/","arab":0},{"s":"Genetec","n":"Genetec Inc.","co":"Canada","t":["Hosted Service","Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Genetec products and solutions only.","adv":"https://resources.genetec.com/security-advisories","pol":"https://www.genetec.com/trust-cybersecurity/resources","arab":0},{"s":"GV","n":"GeoVision Inc.","co":"Taiwan","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in GeoVision products only.","adv":"https://www.geovision.com.tw/cyber_security.php","pol":"https://www.geovision.com.tw/cyber_security.php","arab":0},{"s":"Gitea","n":"Gitea Limited","co":"China","t":["Open Source","Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Gitea issues only.","adv":"https://about.gitea.com/security/","pol":"https://github.com/go-gitea/gitea/blob/main/SECURITY.md","arab":0},{"s":"GitHub_M","n":"GitHub, Inc.","co":"USA","t":["Vendor","Open Source","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"CVEs requested by code owners using the GitHub Security Advisories feature and vulnerabilities affecting open source projects discovered by security researchers at GitHub or Microsoft not covered by another CNA’s scope.","adv":"https://github.com/advisories","pol":"https://help.github.com/en/articles/about-maintainer-security-advisories","arab":0},{"s":"GitHub_P","n":"GitHub, Inc. (Products Only)","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"GitHub Enterprise Server issues only.","adv":"https://enterprise.github.com/releases","pol":"https://bounty.github.com/#rules","arab":0},{"s":"GitLab","n":"GitLab Inc.","co":"USA","t":["Vendor","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"The GitLab application, any project hosted on GitLab.com in a public repository, and any vulnerabilities discovered by GitLab that are not in another CNA’s scope.","adv":"https://gitlab.com/gitlab-org/cves","pol":"https://about.gitlab.com/security/disclosure/","arab":0},{"s":"GandC","n":"Glyph & Cog, LLC","co":"USA","t":["Open Source","Vendor"],"root":"Red Hat, Inc.","roles":["CNA"],"scope":"Xpdf open source project, including the xpdf viewer and associated command line tools.","adv":"https://www.xpdfreader.com/security-fixes.html","pol":"https://www.xpdfreader.com/disclosure.html","arab":0},{"s":"glibc","n":"GNU C Library","co":"USA","t":["Open Source"],"root":"Red Hat, Inc.","roles":["CNA"],"scope":"Security issues and vulnerabilities in the GNU C Library.","adv":"https://sourceware.org/git/?p=glibc.git;a=tree;f=advisories;hb=HEAD","pol":"https://sourceware.org/glibc/security.html","arab":0},{"s":"gnutls","n":"GnuTLS Project","co":"n/a","t":["Open Source"],"root":"Red Hat, Inc.","roles":["CNA"],"scope":"GnuTLS and associated software projects, including libtasn1 and p11-kit.","adv":"https://www.gnutls.org/security-new.html","pol":"https://gitlab.com/gnutls/gnutls/-/blob/master/SECURITY.md","arab":0},{"s":"Go","n":"Go Project","co":"USA","t":["Vendor","Open Source"],"root":"Google LLC","roles":["CNA"],"scope":"Vulnerabilities in software published by the Go Project (including the Go standard library, Go toolchain, and the golang.org modules) and publicly disclosed vulnerabilities in publicly importable packages in the Go ecosystem, unless covered by another CNA’s scope.","adv":"https://pkg.go.dev/vuln/list","pol":"https://go.dev/security","arab":0},{"s":"GoogleCloud","n":"Google Cloud","co":"USA","t":["Vendor"],"root":"Google LLC","roles":["CNA"],"scope":"Vulnerabilities in any Google Cloud developed product and not under the scope of another CNA.","adv":"https://cloud.google.com/support/bulletins","pol":"https://about.google/company-info/appsecurity/","arab":0},{"s":"Google_Devices","n":"Google Devices","co":"USA","t":["Vendor"],"root":"Google LLC","roles":["CNA"],"scope":"Google Devices - Pixel, Nest, and Chromecast.","adv":"https://support.google.com/product-documentation/topic/12974021?hl=en&amp;ref_topic=10123615&amp;sjid=5419128013624043298-NA","pol":"https://support.google.com/product-documentation/answer/13658251?hl=en&amp;ref_topic=12974021&amp;sjid=11464995960873540884-NA","arab":0},{"s":"Google","n":"Google LLC","co":"USA","t":["Vendor","Open Source","Researcher"],"root":"MITRE Corporation","roles":["Root","CNA"],"scope":"<strong>Root Scope:</strong> Alphabet organizations.<br/><strong>CNA Scope:</strong> Google products, including open source software published and maintained by Google, and vulnerabilities in third-party software discovered by Google that are not in another CNA’s scope.","adv":"https://cloud.google.com/support/bulletins","pol":"https://www.google.ch/about/appsecurity/","arab":0},{"s":"GRAFANA","n":"Grafana Labs","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Grafana Labs open source and commercial products.","adv":"https://grafana.com/security/security-advisories/","pol":"https://grafana.com/legal/report-a-security-issue/","arab":0},{"s":"graphql-java","n":"GraphQL Java","co":"Australia","t":["Vendor","Open Source"],"root":"Red Hat, Inc.","roles":["CNA"],"scope":"GraphQL Java, Java DataLoader, GraphQL Java Extended Scalars, and GraphQL Java Extended Validation.","adv":"https://www.graphql-java.com/security/#common-vulnerabilities-and-exposures-cves","pol":"https://www.graphql-java.com/security","arab":0},{"s":"Grayback","n":"Grayback Security","co":"Spain","t":["Bug Bounty Provider"],"root":"Spanish National Cybersecurity Institute, S.A. (INCIBE)","roles":["CNA"],"scope":"Vulnerabilities identified by Grayback or third parties in the programs listed at <a href='https://app.grayback.es/programs' target='_blank'>https://app.grayback.es/programs</a>.","adv":"https://www.grayback.es/en/advisories","pol":"https://www.grayback.es/disclosure-policy","arab":0},{"s":"GreenRocketSecurity","n":"Green Rocket Security Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Green Rocket Security products including EOL unless covered by another CNA’s scope.","adv":"https://www.greenrocketsecurity.com/resources/security-updates/","pol":"https://greenrocketsecurity.com/disclosure-policy/","arab":0},{"s":"Gridware","n":"Gridware Cybersecurity","co":"Australia","t":["Researcher"],"root":"Red Hat, Inc.","roles":["CNA"],"scope":"Gridware software, services, and infrastructure issues, as well as vulnerabilities discovered by or reported to Gridware researchers that are not in another CNA’s scope.","adv":"https://www.gridware.com.au/security-advisories/","pol":"https://www.gridware.com.au/vulnerability-disclosure-policy/","arab":0},{"s":"gvision-it","n":"GVision Italia S.r.l.","co":"Italy","t":["Vendor"],"root":"EU Agency for Cybersecurity (ENISA)","roles":["CNA"],"scope":"Vulnerabilities affecting EU-certified and EU-hardened firmware, software components, and related services distributed and maintained by GVision Italia. This includes firmware variants modified, certified, and maintained by GVision Italia for the European market; associated software components, configuration tools, and update mechanisms under GVision Italia responsibility; and, public-facing servi","adv":"https://gvision.it/security-advisories/","pol":"https://gvision.it/security-policy/","arab":0},{"s":"hackerone","n":"HackerOne","co":"USA","t":["Bug Bounty Provider"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Provides CVE IDs for its customers as part of its bug bounty and vulnerability coordination platform.","adv":"https://hackerone.com/hacktivity?querystring=&filter=type:hacker-published&order_direction=DESC&order_field=popular","pol":"https://www.hackerone.com/disclosure-guidelines","arab":0},{"s":"Hackrate","n":"Hackrate Kft.","co":"Hungary","t":["Bug Bounty Provider"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Vulnerabilities that are discovered, validated, and coordinated through the Hackrate Ethical Hacking Platform, including: software, web applications, APIs, and cloud services; vulnerabilities validated and triaged by our internal security team; and findings disclosed under our coordination that are not in another CNA’s scope.","adv":"https://www.hckrt.com/hacktivity","pol":"https://hckrt.com/vdp/disclosure-guidelines","arab":0},{"s":"HackRTU","n":"HackRTU","co":"Spain","t":["Researcher"],"root":"Spanish National Cybersecurity Institute, S.A. (INCIBE)","roles":["CNA"],"scope":"Vulnerability assignment related to its vulnerability coordination role for Industrial Control Systems (ICS) that are not covered by another CNA’s scope.","adv":"https://www.hackrtu.com/cna/cve-list/","pol":"https://www.hackrtu.com/cna/cve-disclosure-policy/","arab":0},{"s":"Halborn","n":"Halborn","co":"USA","t":["Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All blockchain and Web3 products that rely on smart contracts written in Rust, Go, and Solidity, as well as blockchain associated Web2 and Web3 infrastructure not covered by another CNA.","adv":"https://halborn.com/disclosures/","pol":"https://halborn.com/disclosures/","arab":0},{"s":"Hallo_Welt","n":"Hallo Welt! GmbH","co":"Germany","t":["Vendor"],"root":"EU Agency for Cybersecurity (ENISA)","roles":["CNA"],"scope":"BlueSpice vulnerabilities only.","adv":"https://en.wiki.bluespice.com/wiki/Security:Security_Advisories","pol":"https://bluespice.com/filebase/vulnerability-disclosure-policy/","arab":0},{"s":"hikvision","n":"Hangzhou Hikvision Digital Technology Co., Ltd.","co":"China","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All <a href='http://www.hikvision.com/en/' target='_blank'>Hikvision Internet of Things (IoT) products</a> including cameras and digital video recorders (DVRs).","adv":"https://us.hikvision.com/en/support-resources/cybersecurity-center/security-notices","pol":"https://www.hikvision.com/en/policies/vulnerability-disclosure-policy/","arab":0},{"s":"Hanwha_Vision","n":"Hanwha Vision Co., Ltd.","co":"South Korea","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Hanwha Vision (formerly Samsung Techwin and Hanwha Techwin) products and solutions only, including end-of-life (EOL).","adv":"https://www.hanwhavision.com/en/support/cybersecurity/","pol":"https://www.hanwhavision.com/en/support/cybersecurity/","arab":0},{"s":"harborist","n":"Harborist","co":"USA","t":["Open Source"],"root":"Red Hat, Inc.","roles":["CNA"],"scope":"All projects listed under <a href='https://www.npmjs.com/~ljharb' target='_blank'>https://www.npmjs.com/~ljharb</a>.","adv":"https://github.com/harborist/advisories","pol":"https://github.com/harborist/.github/blob/main/DISCLOSURE_POLICY.md","arab":0},{"s":"HashiCorp","n":"HashiCorp Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All HashiCorp products and projects unless covered by another CNA’s scope.","adv":"https://discuss.hashicorp.com/c/security/52","pol":"https://www.hashicorp.com/security","arab":0},{"s":"hsi","n":"Haverford Systems, Inc.","co":"USA","t":["Vendor","Researcher"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"All products for Haverford Systems brands, PTZOptics and HuddleCamHD (supported products and end-of-life/end-of-service products), as well as vulnerabilities in third-party software discovered by Haverford Systems that are not in another CNA’s scope.","adv":"https://ptzoptics.com/known-vulnerabilities-and-fixes/","pol":"https://psirt.havsys.com/disclosure-policy.pdf","arab":0},{"s":"HCL","n":"HCL Software","co":"India","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All HCL products only.","adv":"https://support.hcl-software.com/community?id=community_forum&amp;sys_id=038a2b921b7bb34c77761fc58d4bcb0d","pol":"https://www.hcl-software.com/resources/psirt","arab":0},{"s":"HDS","n":"HDS a.s.","co":"Slovak Republic","t":["Vendor"],"root":"EU Agency for Cybersecurity (ENISA)","roles":["CNA"],"scope":"Vulnerabilities in products developed, maintained, or distributed by HDS and vulnerabilities in third party components if they affect HDS products and HDS is responsible for their integration.","adv":"https://www.hds.sk/cybersecurity-policy","pol":"https://www.hds.sk/cybersecurity-policy","arab":0},{"s":"HemoCue","n":"HemoCue AB","co":"Sweden","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"HemoCue branded products and technologies only.","adv":"https://global.hemocue.com/product-security/","pol":"https://global.hemocue.com/product-security/","arab":0},{"s":"HeroDevs","n":"HeroDevs","co":"USA","t":["Vendor","Open Source","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"End of life open source projects supported by HeroDevs if hosted on <a href='https://HeroDevs.com' target='_blank'>HeroDevs.com</a>, or issues in open source projects discovered by or reported to HeroDevs, unless covered by the scope of another CNA.","adv":"https://docs.herodevs.com/advisories","pol":"https://docs.herodevs.com/policies/security-disclosure","arab":0},{"s":"hpe","n":"Hewlett Packard Enterprise (HPE)","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"HPE and acquisitions issues only.","adv":"https://support.hpe.com/portal/site/hpsc/public/kb/secBullArchive/","pol":"https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=a00100637en_us","arab":0},{"s":"HiddenLayer","n":"HiddenLayer, Inc.","co":"USA","t":["Vendor","Hosted Service","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All HiddenLayer systems, services, and products, as well as vulnerabilities in third-party software discovered by HiddenLayer that are not in another CNA’s scope.","adv":"https://hiddenlayer.com/research/","pol":"https://hiddenlayer.com/vulnerability-disclosure-policy/","arab":0},{"s":"Hillstone","n":"Hillstone Networks Inc.","co":"China","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in our products listed at <a href='https://www.hillstonenet.com/hillstone-networks-product-portfolio' target='_blank'>https://www.hillstonenet.com/hillstone-networks-product-portfolio</a> and the products we sell only in China listed at <a href='https://www.hillstonenet.com.cn/product_service/' target='_blank'>https://www.hillstonenet.com.cn/product_service/</a>, not including our ","adv":"https://www.hillstonenet.com.cn/support-and-training/psirt/","pol":"https://www.hillstonenet.com.cn/support-and-training/psirt","arab":0},{"s":"Hitachi_Energy","n":"Hitachi Energy","co":"Switzerland","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Hitachi Energy products only.","adv":"https://www.hitachienergy.com/cybersecurity/alerts-and-notifications","pol":"https://publisher.hitachienergy.com/preview?DocumentID=9AKK107991A7713&LanguageCode=en&DocumentPartId=&Action=Launch","arab":0},{"s":"Hitachi_Vantara","n":"Hitachi Vantara","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Hitachi Vantara products and technologies.","adv":"https://knowledge.hitachivantara.com/portal/app/portlets/results/viewsolution.jsp?solutionid=241403050017684","pol":"https://www.hitachivantara.com/en-us/security#section-vulnerability-disclosure-policy","arab":0},{"s":"Hitachi","n":"Hitachi, Ltd.","co":"Japan","t":["Vendor"],"root":"JPCERT/CC","roles":["CNA"],"scope":"Hitachi products excluding Hitachi Energy and Hitachi Vantara products.","adv":"https://www.hitachi.com/hirt/security/security.html","pol":"https://www.hitachi.com/hirt/publications/hirt-pub10008","arab":0},{"s":"Hologic","n":"Hologic, Inc.","co":"USA","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Hologic products.","adv":"https://www.hologic.com/support/usa/breast-skeletal-products-cybersecurity","pol":"https://www.hologic.com/security/coordinated-vulnerability-disclosure-policy","arab":0},{"s":"HONA","n":"Honeywell Aerospace","co":"USA","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"All Honeywell Aerospace products.","adv":"https://www.honeywellaerospace.com/us/en/product-security","pol":"https://www.honeywellaerospace.com/us/en/product-security","arab":0},{"s":"Honeywell","n":"Honeywell International Inc.","co":"USA","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"All Honeywell products.","adv":"https://sps.honeywell.com/us/en/support/productivity/cyber-security-notifications","pol":"https://www.honeywell.com/us/en/product-security","arab":0},{"s":"Honor","n":"Honor Device Co., Ltd.","co":"China","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in Honor products and services unless covered by the scope of another CNA.","adv":"https://www.hihonor.com/global/security/","pol":"https://www.hihonor.com/global/security/","arab":0},{"s":"hp","n":"HP Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Issues with any HP-branded product, including computing software and hardware, imaging and printing, as well as HyperX, Teradici, Poly, and Plantronics branded devices.","adv":"https://support.hp.com/us-en/security-bulletins","pol":"https://support.hp.com/us-en/document/ish_12775610-12775642-16","arab":0},{"s":"huawei","n":"Huawei Technologies","co":"China","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Huawei issues only.","adv":"https://www.huawei.com/en/psirt/all-bulletins","pol":"https://www.huawei.com/en/psirt/vul-response-process","arab":0},{"s":"Huntress","n":"Huntress Labs Inc.","co":"USA","t":["Vendor","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Huntress products, as well as vulnerabilities in third-party software discovered by Huntress that are not in another CNA’s scope.","adv":"https://support.huntress.io/hc/en-us/categories/10962594482579-Vulnerability-Disclosures","pol":"https://support.huntress.io/hc/en-us/categories/10962594482579-Vulnerability-Disclosures","arab":0},{"s":"HYPR","n":"HYPR Corp","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All HYPR products only.","adv":"https://www.hypr.com/security-advisories/","pol":"https://www.hypr.com/security","arab":0},{"s":"ibm","n":"IBM Corporation","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All IBM branded products (IBM will confirm support status and notify researcher).","adv":"https://www.ibm.com/support/pages/bulletin/","pol":"https://www.ibm.com/security/secure-engineering/report.html","arab":0},{"s":"IDBS","n":"ID Business Solutions","co":"UK","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"IDBS products as listed on <a href='https://www.idbs.com/products/' target='_blank'>https://www.idbs.com/products/</a>.","adv":"https://help.idbs.com/advisories/en/index-en.html","pol":"https://www.idbs.com/about/coordinated-vulnerability-disclosure/","arab":0},{"s":"IDEMIA","n":"IDEMIA","co":"France","t":["Researcher","Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All IDEMIA products (supported products and end-of-life/end-of-service products), as well as vulnerabilities in third-party software discovered by IDEMIA that are not in another CNA’s scope.","adv":"https://www.idemia.com/vulnerability-information","pol":"https://www.idemia.com/idemia-product-security-incident-response-team-psirt","arab":0},{"s":"Illumio","n":"Illumio","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Illumio issues only.","adv":"https://docs.illumio.com/LandingPages/Categories/security-advisories.htm","pol":"https://www.illumio.com/legal/responsible-disclosure-policy","arab":0},{"s":"imaginationtech","n":"Imagination Technologies","co":"UK","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Imagination Technologies branded products and technologies and Imagination Technologies (IMG) managed open source projects.","adv":"https://www.imaginationtech.com/gpu-driver-vulnerabilities/","pol":"https://www.imaginationtech.com/product-security-policy/","arab":0},{"s":"iManage","n":"iManage LLC","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"iManage issues only.","adv":"https://docs.imanage.com/security/Security_Vulnerabilities.html","pol":"https://imanage.com/about/vulnerability-report/","arab":0},{"s":"CERT-In","n":"Indian Computer Emergency Response Team (CERT-In)","co":"India","t":["CERT"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerability coordination for vulnerabilities in all products reported to CERT-In in accordance with our vulnerability coordination role as a CERT. Vulnerability assignments for vulnerabilities impacting all products designed, developed, and manufactured in India.","adv":"https://www.cert-in.org.in/","pol":"https://www.cert-in.org.in/RVDCP.jsp","arab":0},{"s":"Infoblox","n":"Infoblox Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Infoblox products found at <a href='https://www.infoblox.com/products/' target='_blank'>https://www.infoblox.com/products/</a>.","adv":"https://support.infoblox.com/s/article/2899","pol":"https://www.infoblox.com/company/legal/vulnerability-responsible-disclosure-policy/","arab":0},{"s":"Insyde","n":"Insyde Software","co":"USA","t":["Vendor","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in all of Insyde Software’s firmware and software products, as well as vulnerabilities discovered by Insyde Software that are not covered by another CNA’s scope.","adv":"https://www.insyde.com/security-pledge/","pol":"https://www.insyde.com/security-pledge/","arab":0},{"s":"ICT","n":"Integrated Control Technology LTD","co":"New Zealand","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All ICT security products.","adv":"https://ict.co/help-support/security-advisories/","pol":"https://ict.co/help-support/responsible-disclosure-policy/","arab":0},{"s":"IDT-DNA","n":"Integrated DNA Technologies, Inc.","co":"USA","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Vulnerabilities within IDT-manufactured products, software, and services that are in-service.","adv":"https://www.idtdna.com/pages/support/vulnerability-disclosure-process/known-vulnerabilities","pol":"https://www.idtdna.com/pages/support/vulnerability-disclosure-process/","arab":0},{"s":"intel","n":"Intel Corporation","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Intel branded products and technologies and Intel managed open source projects.","adv":"https://www.intel.com/content/www/us/en/security-center/default.html","pol":"https://www.intel.com/content/www/us/en/security-center/vulnerability-handling-guidelines.html","arab":0},{"s":"isc","n":"Internet Systems Consortium (ISC)","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All <a href='https://www.isc.org/' target='_blank'>ISC.org</a> projects.","adv":"https://kb.isc.org/docs/aa-01020","pol":"https://kb.isc.org/docs/aa-00861","arab":0},{"s":"Intigriti","n":"Intigriti","co":"Belgium","t":["Bug Bounty Provider","Hosted Service","Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in Intigriti products and vulnerabilities discovered by, or reported to, Intigriti that are not in another CNA’s scope.","adv":"https://trust.intigriti.com/resources","pol":"https://app.intigriti.com/programs/intigriti/intigriti/detail","arab":0},{"s":"IoT83","n":"IoT83 Ltd","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in IoT83 product(s), services, and components only. Third-party, open source components used in IoT83 product(s), services, and components are not in scope.","adv":"https://www.iot83.com/security/","pol":"https://www.iot83.com/security/","arab":0},{"s":"IQSIGHT","n":"IQSIGHT B.V.","co":"Netherlands","t":["Vendor"],"root":"EU Agency for Cybersecurity (ENISA)","roles":["CNA"],"scope":"All IQSIGHT (formerly Bosch Building Technology - Video Systems) products including end-of-life products.","adv":"https://www.iqsight.com/en/support/product-security/vulnerability-report/","pol":"https://www.iqsight.com/en/support/product-security/","arab":0},{"s":"INCD","n":"Israel National Cyber Directorate (INCD)","co":"Israel","t":["CERT"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerability assignment related to its vulnerability coordination role.","adv":"https://www.gov.il/en/departments/faq/cve_advisories","pol":"https://www.gov.il/en/departments/general/cve_policy","arab":0},{"s":"ivanti","n":"Ivanti","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in supported Ivanti products and infrastructure, excluding third-party components, and meeting severity thresholds defined in Ivanti’s Disclosure Policy found <a href='https://www.ivanti.com/support/contact-security' target='_blank'>here</a>.","adv":"https://www.ivanti.com/blog/topics/security-advisory","pol":"https://www.ivanti.com/support/contact-security","arab":0},{"s":"JAMF","n":"Jamf","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Jamf issues and Jamf Open Source.","adv":"https://learn.jamf.com/en-US/bundle/jamf-pro-release-notes-current/page/Resolved_Issues.html","pol":"https://www.jamf.com/security/vulnerability-disclosure/","arab":0},{"s":"Jaspersoft","n":"Jaspersoft","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Jaspersoft products and services only.","adv":"https://community.jaspersoft.com/advisories/","pol":"https://community.jaspersoft.com/security/","arab":0},{"s":"jenkins","n":"Jenkins Project","co":"USA","t":["Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Jenkins and Jenkins plugins distributed by the Jenkins Project (listed on <a href='https://plugins.jenkins.io/' target='_blank'>plugins.jenkins.io</a>) only.","adv":"https://jenkins.io/security/advisories/","pol":"https://jenkins.io/security/","arab":0},{"s":"JetBrains","n":"JetBrains s.r.o.","co":"Czech Republic","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"JetBrains products only.","adv":"https://www.jetbrains.com/privacy-security/issues-fixed/","pol":"https://www.jetbrains.com/legal/docs/terms/coordinated-disclosure/","arab":0},{"s":"JFrog","n":"JFrog","co":"Israel","t":["Vendor","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All JFrog products (supported products and end-of-life/end-of-service products); vulnerabilities in third-party software discovered by JFrog that are not in another CNA’s scope; and vulnerabilities in third-party software discovered by external researchers and disclosed to JFrog (includes any embedded devices and their associated mobile applications) that are not in another CNA’s scope.","adv":"https://www.jfrog.com/confluence/display/RTF/Fixed+Security+Vulnerabilities","pol":"https://jfrog.com/trust/report-vulnerability/","arab":0},{"s":"jci","n":"Johnson Controls","co":"USA","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Johnson Controls products only.","adv":"https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories","pol":"https://www.johnsoncontrols.com/trust-center/cybersecurity/response#CoordinatedDisclosure","arab":0},{"s":"Joomla","n":"Joomla! Project","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Core Joomla! CMS, the Joomla Framework, and Joomla! Extensions issues only.","adv":"https://developer.joomla.org/security-centre.html","pol":"https://developer.joomla.org/security.html","arab":0},{"s":"jpcert","n":"JPCERT/CC","co":"Japan","t":["CERT"],"root":"MITRE Corporation","roles":["Root","CNA"],"scope":"<strong>Root Scope:</strong> Japan organizations.<br/><strong>CNA Scope:</strong> Vulnerability assignment related to its vulnerability coordination role.","adv":"https://jvn.jp/","pol":"https://www.jpcert.or.jp/english/vh/2018/20180330-vulpolicy.pdf#search='disclosure","arab":0},{"s":"juniper","n":"Juniper Networks, Inc.","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Juniper issues only.","adv":"https://kb.juniper.net/InfoCenter/index?page=content&channel=SECURITY_ADVISORIES","pol":"https://www.juniper.net/us/en/security/report-vulnerability/","arab":0},{"s":"JupiterOne","n":"JupiterOne, Inc.","co":"USA","t":["Vendor","Hosted Service","Researcher"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"All JupiterOne open source and commercial products.","adv":"https://docs.jupiterone.io/release-notes/","pol":"https://www.jupiterone.com/legal-and-security-hub","arab":0},{"s":"Kaspersky","n":"Kaspersky","co":"Russia","t":["Vendor","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Kaspersky B2C and B2B products, as well as vulnerabilities discovered in third-party software not in another CNA’s scope.","adv":"https://support.kaspersky.com/general/vulnerability.aspx?el=12430","pol":"https://support.kaspersky.com/general/vulnerability.aspx?el=12429#block0","arab":0},{"s":"KCFTech","n":"KCF Technologies, Inc.","co":"USA","t":["Vendor","Hosted Service"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All KCF Technologies products including base stations, repeaters, numerous sensor types, and the SMARTdiagnostics cloud software.","adv":"https://status.kcftech.com/","pol":"https://kcftech.com/vulnerability-disclosure-policy/","arab":0},{"s":"KeeperSecurity","n":"Keeper Security, Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Keeper Security products and services only.","adv":"https://docs.keeper.io/release-notes/keeper-security/security-advisories","pol":"https://www.keepersecurity.com/security.html?s=reporting","arab":0},{"s":"Linux","n":"kernel.org","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Any vulnerabilities in the Linux kernel as listed on kernel.org, excluding end-of-life (EOL) versions.","adv":"https://lore.kernel.org/linux-cve-announce/","pol":"https://www.kernel.org/doc/html/latest/process/security-bugs.html","arab":0},{"s":"KNIME","n":"KNIME AG","co":"Switzerland","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All vulnerabilities on software products that our company provides, including KNIME Analytics Platform, KNIME Server, and KNIME Hub.","adv":"https://www.knime.com/security/advisories","pol":"https://www.knime.com/security/policy","arab":0},{"s":"Kong","n":"Kong Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Kong products; Kong Konnect, Kong Enterprise, Kong Mesh, and Kong Insomnia, including Kong Opensource; Kong Gateway, Kuma, Insomnia.","adv":"https://konghq.com/compliance/psa","pol":"https://konghq.com/compliance/bug-bounty","arab":0},{"s":"KoreLogic","n":"KoreLogic Security","co":"USA","t":["Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in the KoreLogic website and other KoreLogic controlled assets, as well as vulnerabilities discovered by or reported to KoreLogic, unless covered by the scope of another CNA.","adv":"https://korelogic.com/advisories.html","pol":"https://korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Policy","arab":0},{"s":"KrakenD","n":"KrakenD, S.L.","co":"Spain","t":["Vendor","Open Source"],"root":"Spanish National Cybersecurity Institute, S.A. (INCIBE)","roles":["CNA"],"scope":"KrakenD EE, KrakenD CE, and Lura issues only.","adv":"https://www.krakend.io/tags/security/","pol":"https://www.krakend.io/security-policy/","arab":0},{"s":"krcert","n":"KrCERT/CC","co":"South Korea","t":["CERT"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerability assignment related to its vulnerability coordination role.","adv":"https://www.krcert.or.kr/kr/bbs/list.do?menuNo=205023&bbsId=B0000302","pol":"https://knvd.krcert.or.kr/processingProcedures.do","arab":0},{"s":"kubernetes","n":"Kubernetes","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Kubernetes issues only.","adv":"https://kubernetes.io/cve","pol":"https://kubernetes.io/security","arab":0},{"s":"larry_cashdollar","n":"Larry Cashdollar","co":"USA","t":["Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Third-party products he researches that are not in another CNA’s scope.","adv":"http://www.vapidlabs.com/","pol":"http://www.vapidlabs.com/misc/policy.html","arab":0},{"s":"bcorg","n":"Legion of the Bouncy Castle Inc.","co":"Australia","t":["Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Legion of the Bouncy Castle issues only.","adv":"https://www.bouncycastle.org/vulnerability-advisory.html","pol":"https://www.bouncycastle.org/disclosure.html","arab":0},{"s":"LeicaBiosystems","n":"Leica Biosystems","co":"USA","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"All Leica Biosystems products.","adv":"https://www.leicabiosystems.com/us/about/product-security-advisories/","pol":"https://www.leicabiosystems.com/us/about/coordinated-vulnerability-disclosure-cvd-process/","arab":0},{"s":"LMS","n":"Leica Microsystems","co":"Germany","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Leica Microsystems products as listed on <a href='https://www.leica-microsystems.com/products' target='_blank'>https://www.leica-microsystems.com/products</a>.","adv":"https://www.leica-microsystems.com/company/product-security/product-security-updates/","pol":"https://www.leica-microsystems.com/company/product-security","arab":0},{"s":"lenovo","n":"Lenovo Group Ltd.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Lenovo general-purpose computers, software for general-purpose operating systems, mobile devices, enterprise storage, and networking products only.","adv":"https://support.lenovo.com/us/en/product_security/home","pol":"https://www.lenovo.com/us/en/product-security/vulnerability-disclosure-policy","arab":0},{"s":"Leonardo","n":"Leonardo S.p.A.","co":"Italy","t":["Vendor","CERT"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Vulnerabilities found in the following product: Leonardo SC2.","adv":"https://cybersecurity.leonardo.com/documents/16277703/0/VULNERABILITIES+REPORT+%28LDO_IT25_01520%29.pdf?t=1757318888035","pol":"https://cybersecurity.leonardo.com/documents/16277703/0/VULNERABILITIES+REPORT+%28LDO_IT25_01520%29.pdf?t=1757318888035","arab":0},{"s":"Lexmark","n":"Lexmark International Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Lexmark products only.","adv":"https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisories.html","pol":"https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisories.html","arab":0},{"s":"LGE","n":"LG Electronics","co":"South Korea","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"LG Electronics products only.","adv":"https://lgsecurity.lge.com/bulletins","pol":"https://lgsecurity.lge.com/reporting","arab":0},{"s":"libreswan","n":"Libreswan Project","co":"n/a","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Libreswan software.","adv":"https://libreswan.org/security/","pol":"https://libreswan.org/security/","arab":0},{"s":"Liferay","n":"Liferay, Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Liferay supported products and end-of-life/end-of-service products.","adv":"https://liferay.dev/portal/security/known-vulnerabilities","pol":"https://liferay.dev/portal/security/reporting","arab":0},{"s":"Linaro","n":"Linaro","co":"UK","t":["Open Source"],"root":"Red Hat, Inc.","roles":["CNA"],"scope":"Software projects managed by <a href='https://www.trustedfirmware.org' target='_blank'>trustedfirmware.org</a>.","adv":"https://www.trustedfirmware.org/","pol":"https://general.docs.trustedfirmware.org/en/latest/security_center/incident_handling_process.html","arab":0},{"s":"linqi","n":"linqi GmbH","co":"Germany","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in linqi products only.","adv":"https://linqi.help/en/reference/security/security-advisories","pol":"https://linqi.help/en/reference/security/vulnerability-disclosure-policy","arab":0},{"s":"Logitech","n":"Logitech","co":"Switzerland","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All current products/software/apps made by <a href='https://www.logitech.com/' target='_blank'>Logitech</a>, <a href='https://www.ultimateears.com/' target='_blank'>Ultimate Ears</a>, <a href='https://www.jaybirdsport.com/' target='_blank'>Jaybird</a>, <a href='https://www.streamlabs.com/' target='_blank'>Streamlabs</a>, <a href='https://www.logitechg.com/' target='_blank'>Logitech G</a>, <a href=","adv":"https://hackerone.com/logitech/hacktivity","pol":"https://hackerone.com/logitech","arab":0},{"s":"LY-Corporation","n":"LY Corporation","co":"Japan","t":["Open Source"],"root":"JPCERT/CC","roles":["CNA"],"scope":"Current versions of LINE Messenger Application for iOS, Android, Mac, and Windows, plus LINE Open Source projects hosted on <a href='https://github.com/line' target='_blank'>https://github.com/line</a>.","adv":"https://line.github.io/security-advisory-blog/advisory","pol":"https://line.github.io/security-advisory-blog/","arab":0},{"s":"M-Files","n":"M-Files Corporation","co":"Finland","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"M-Files and Hubshare products.","adv":"https://empower.m-files.com/security-advisories","pol":"https://www.m-files.com/company/trust-center/vulnerability-disclosure/","arab":0},{"s":"MyMMT","n":"Mammotome","co":"USA","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"All Mammotome products.","adv":"https://www.mammotome.com/us/en/legal/product-security/product-security-updates","pol":"https://www.mammotome.com/us/en/legal/product-security/product-security-overview","arab":0},{"s":"Mandiant","n":"Mandiant Inc.","co":"USA","t":["Researcher","Vendor"],"root":"Google LLC","roles":["CNA"],"scope":"Vulnerabilities in Mandiant products or discovered by Mandiant while performing vulnerability research or security assessments, unless covered by another CNA’s scope.","adv":"https://github.com/mandiant/Vulnerability-Disclosures","pol":"https://about.google/intl/ALL_us/appsecurity/","arab":0},{"s":"MHV","n":"Maritime Hacking Village","co":"USA","t":["Researcher"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Vulnerabilities discovered by researchers in collaboration with Maritime Hacking Village that are not in another CNA’s scope.","adv":"https://maritimehackingvillage.com/security-advisory","pol":"https://www.maritimehackingvillage.com/cvd","arab":0},{"s":"Mattermost","n":"Mattermost, Inc.","co":"USA","t":["Vendor","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Mattermost issues, and vulnerabilities discovered by Mattermost that are not in another CNA’s scope.","adv":"https://mattermost.com/security-updates/","pol":"https://mattermost.com/security-vulnerability-report/","arab":0},{"s":"Mautic","n":"Mautic","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Mautic core and officially supported plugins.","adv":"https://github.com/mautic/mautic/security/advisories","pol":"https://www.mautic.org/mautic-security-team/mautic-security-advisory-policy","arab":0},{"s":"MediaTek","n":"MediaTek, Inc.","co":"Taiwan","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"MediaTek product issues only.","adv":"https://corp.mediatek.com/product-security-bulletin","pol":"https://corp.mediatek.com/vulnerability-disclosure-policy","arab":0},{"s":"Medtronic","n":"Medtronic","co":"USA","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"All products of Medtronic or a Medtronic company including supported products and end-of-life/end-of-service products, as well as vulnerabilities in third-party software discovered in Medtronic products that are not in another CNA’s scope.","adv":"https://global.medtronic.com/xg-en/product-security/security-bulletins.html","pol":"https://global.medtronic.com/xg-en/product-security/coordinated-disclosure-process.html","arab":0},{"s":"Meta","n":"Meta Platforms, Inc.","co":"USA","t":["Vendor","Open Source","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Meta-supported open source projects, mobile apps, and other software, as well as vulnerabilities in third-party software discovered by Meta that are not in another CNA’s scope; see: <a href='https://www.facebook.com/whitehat' target='_blank'>https://www.facebook.com/whitehat</a> and <a href='https://github.com/facebook/' target='_blank'>https://github.com/facebook/</a>.","adv":"https://www.facebook.com/security","pol":"https://www.facebook.com/security/advisories/Vulnerability-Disclosure-Policy","arab":0},{"s":"Microchip","n":"Microchip Technology","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Microchip Technology products only.","adv":"https://microchip.com/psirt","pol":"https://microchip.com/psirt","arab":0},{"s":"microsoft","n":"Microsoft Corporation","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Microsoft issues only, excluding end-of-life (EOL) as listed in the <a href='https://learn.microsoft.com/en-US/lifecycle/' target='_blank'>Microsoft Lifecycle Policy</a>.","adv":"https://www.microsoft.com/en-us/msrc/technical-security-notifications","pol":"https://www.microsoft.com/en-us/msrc/cvd?rtc=1","arab":0},{"s":"milestonesys","n":"Milestone Systems A/S","co":"Denmark","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Supported Milestone XProtect products.","adv":"https://supportcommunity.milestonesys.com/s/knowledgebase?language=en_US","pol":"https://doc.milestonesys.com/latest/en-US/portal/htm/chapter-page-cve-vulnerabilitymanagementpolicy.htm","arab":0},{"s":"MIM","n":"MIM Software Inc.","co":"USA","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"MIM software products, platforms, and services as well as vulnerabilities reported to MIM Software in third-party components or libraries used by MIM Software products, platforms, and services not covered by another CNA.","adv":"https://www.mimsoftware.com/security-advisories","pol":"https://www.mimsoftware.com/security","arab":0},{"s":"Mirantis","n":"Mirantis","co":"USA","t":["Vendor","Open Source","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Mirantis products (supported products and end-of-life/end-of-service products) and open source offerings, as well as vulnerabilities in third-party software discovered by Mirantis that are not in another CNA’s scope.","adv":"https://github.com/Mirantis/security/blob/main/advisories/advisories.md","pol":"https://github.com/Mirantis/security/blob/main/vulnerability-disclosure-policy.md","arab":0},{"s":"mitre","n":"MITRE Corporation","co":"USA","t":["N/A"],"root":"n/a","roles":["Top-Level Root","CNA-LR","Secretariat"],"scope":"All vulnerabilities, and Open Source software product vulnerabilities, not already covered by a CNA listed on this website.","adv":"","pol":"","arab":0},{"s":"Mitsubishi","n":"Mitsubishi Electric Corporation","co":"Japan","t":["Vendor"],"root":"JPCERT/CC","roles":["CNA"],"scope":"Vulnerabilities related to products of Mitsubishi Electric Group.","adv":"https://www.mitsubishielectric.com/psirt/vulnerability/index.html","pol":"https://www.mitsubishielectric.com/psirt/disclosurepolicy/index.html","arab":0},{"s":"MolDev","n":"Molecular Devices","co":"USA","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Molecular Devices products only as listed on <a href='https://www.moleculardevices.com/products' target='_blank'>moleculardevices.com/products</a>.","adv":"https://support.moleculardevices.com/s/article/Molecular-Devices-Security-Advisory","pol":"https://www.moleculardevices.com/coordinated-vulnerability-disclosure-policy","arab":0},{"s":"MON-CSIRT","n":"Monash University - Cyber Security Incident Response Team","co":"Australia","t":["CERT","Open Source","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in any Monash University developed products, or vulnerabilities identified in third-party vendor products used by Monash University, unless covered by the scope of another CNA.","adv":"https://www.monash.edu/cybersecurity/about/mon-csirt","pol":"https://www.monash.edu/cybersecurity/about/mon-csirt","arab":0},{"s":"mongodb","n":"MongoDB, Inc.","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"MongoDB products only, not including end-of-life components or products.","adv":"https://www.mongodb.com/resources/products/mongodb-security-bulletins","pol":"https://www.mongodb.com/security","arab":0},{"s":"Moxa","n":"Moxa Inc.","co":"Taiwan","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Moxa products only.","adv":"https://www.moxa.com/en/support/product-support/security-advisory","pol":"https://www.moxa.com/en/support/product-support/security-advisory/cybersecurity-vulnerability-management-policy","arab":0},{"s":"mozilla","n":"Mozilla Corporation","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Mozilla issues only.","adv":"https://www.mozilla.org/en-US/security/advisories/","pol":"https://www.mozilla.org/en-US/about/governance/policies/security-group/bugs/","arab":0},{"s":"N-able","n":"N-able","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"N-able branded products and technologies only.","adv":"https://me.n-able.com/s/global-search/%40uri#t=All&amp;sort=relevancy&amp;f:@repositorytype=[Security_Advisory]","pol":"https://www.n-able.com/security-and-privacy/vulnerability-disclosure-policy","arab":0},{"s":"NCSC-FI","n":"National Cyber Security Centre Finland (NCSC-FI)","co":"Finland","t":["CERT"],"root":"EU Agency for Cybersecurity (ENISA)","roles":["CNA"],"scope":"Vulnerabilities in software discovered by NCSC-FI, and vulnerabilities reported to NCSC-FI for coordinated disclosure, which are not in another CNA’s scope.","adv":"https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet","pol":"https://www.kyberturvallisuuskeskus.fi/fi/ajankohtaista/haavoittuvuudet-miten-niista-ilmoitetaan-oikein","arab":0},{"s":"NCSC-NL","n":"National Cyber Security Centre Netherlands (NCSC-NL)","co":"Netherlands","t":["Vendor"],"root":"EU Agency for Cybersecurity (ENISA)","roles":["CNA"],"scope":"Vulnerabilities in software discovered by NCSC-NL, and vulnerabilities reported to NCSC-NL for coordinated disclosure, which are not in another CNA's scope.","adv":"https://www.ncsc.nl/actueel/beveiligingsadviezen","pol":"https://www.ncsc.nl/contact/kwetsbaarheid-melden","arab":0},{"s":"SK-CERT","n":"National Cyber Security Centre SK-CERT","co":"Slovak Republic","t":["CERT"],"root":"EU Agency for Cybersecurity (ENISA)","roles":["CNA"],"scope":"Vulnerabilities in software discovered by National Cyber Security Centre SK-CERT, and vulnerabilities reported to National Cyber Security Centre SK-CERT for coordinated disclosure, which are not in another CNA’s scope.","adv":"https://www.sk-cert.sk/threat/","pol":"https://www.sk-cert.sk/wp-content/uploads/2019/10/Vulnerability_reporting.pdf","arab":0},{"s":"NI","n":"National Instruments","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"NI products only (including National Instruments).","adv":"https://www.ni.com/en-us/support/documentation/supplemental/11/available-critical-and-security-updates-for-ni-software.html","pol":"https://ni.com/security","arab":0},{"s":"NCSC","n":"NATO Cyber Security Centre","co":"Belgium","t":["Researcher"],"root":"EU Agency for Cybersecurity (ENISA)","roles":["CNA"],"scope":"Vulnerabilities in commercial off-the-shelf software (COTS) selected for inclusion in the NATO Approved Software List (A2SL) that are not in the scope of another CNA.","adv":"https://github.com/NCSC-Assess/Advisories","pol":"https://github.com/NCSC-Assess/Disclosure-Policy/blob/main/policy.md","arab":0},{"s":"naver","n":"Naver Corporation","co":"South Korea","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Naver products only, except Line products.","adv":"https://cve.naver.com/","pol":"https://cve.naver.com/","arab":0},{"s":"NEC","n":"NEC Corporation","co":"Japan","t":["Vendor"],"root":"JPCERT/CC","roles":["CNA"],"scope":"NEC issues only.","adv":"https://jpn.nec.com/security-info/index.html","pol":"https://jpn.nec.com/security-info/policy_en.html","arab":0},{"s":"Neo4j","n":"Neo4j","co":"Sweden","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Neo4j products and Neo4j-maintained projects only, not including end-of-life components or products.","adv":"https://neo4j.com/security/advisories/","pol":"https://neo4j.com/trust-center/responsible-disclosure/","arab":0},{"s":"netapp","n":"NetApp, Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All NetApp products as well as projects hosted on <a href='https://github.com/netapp' target='_blank'>https://github.com/netapp</a>.","adv":"https://security.netapp.com/advisory/","pol":"https://security.netapp.com/policy/","arab":0},{"s":"netflix","n":"Netflix, Inc.","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Current versions of Netflix Mobile Streaming Application for iOS, Android, and Windows Mobile, plus all Netflix Open Source projects hosted on <a href='https://github.com/Netflix/' target='_blank'>https://github.com/Netflix/</a> and <a href='https://github.com/spinnaker/' target='_blank'>https://github.com/spinnaker/</a>.","adv":"https://github.com/Netflix/security-bulletins","pol":"https://help.netflix.com/en/node/6657","arab":0},{"s":"NETGEAR","n":"NETGEAR","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in all products from NETGEAR, its subsidiaries, and third-party components used in NETGEAR products that are not in another CNA’s scope.","adv":"https://www.netgear.com/about/security/","pol":"https://www.netgear.com/about/security/","arab":0},{"s":"NetRise","n":"NetRise","co":"USA","t":["Researcher"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Vulnerabilities in third-party Extended Internet of Things (XIoT) devices and firmware NetRise researches that are not covered by another CNA.","adv":"https://www.netrise.io/security/advisories","pol":"https://www.netrise.io/hubfs/resources/Vuln%20Disclosure%20Policy%20v1.pdf?hsLang=en","arab":0},{"s":"NetScaler","n":"NetScaler","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"NetScaler issues only.","adv":"https://support.citrix.com/support-home/topic-article-list?trendingCategory=20&trendingTopicName=Security%20Bulletin","pol":"https://www.cloud.com/trust-center/product-security/vulnerability-response","arab":0},{"s":"Netskope","n":"Netskope","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Netskope products and services.","adv":"https://www.netskope.com/company/security-compliance-and-assurance/security-advisories-and-disclosures","pol":"https://www.netskope.com/vulnerability-disclosure-policy","arab":0},{"s":"NX","n":"Network Optix","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Network Optix products, including <a href='https://www.networkoptix.com/nx-witness' target='_blank'>https://www.networkoptix.com/nx-witness</a> and <a href='https://www.networkoptix.com/powered-by-nx' target='_blank'>https://www.networkoptix.com/powered-by-nx</a>.","adv":"https://www.networkoptix.com/blog","pol":"https://www.networkoptix.com/vulnerability-disclosure-program","arab":0},{"s":"NIBEGroup","n":"NIBE Group","co":"Sweden","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Products, services, and solutions developed or sold by NIBE Industrier AB or any of its subsidiaries; open-source projects owned by NIBE Industrier AB or any of its subsidiaries; vulnerabilities in third-party products used by NIBE Industrier AB or any of its subsidiaries which are outside the scope of another CNA; and subsidiaries of NIBE Industrier AB are listed on <a href='https://www.nibe.com'","adv":"https://vdp.nibegroup.com","pol":"https://vdp.nibegroup.com","arab":0},{"s":"Nintendo","n":"Nintendo Co., Ltd.","co":"Japan","t":["Vendor"],"root":"JPCERT/CC","roles":["CNA"],"scope":"System vulnerabilities regarding the Nintendo Switch 2, Nintendo Switch, Nintendo Switch Lite, and vulnerabilities regarding Nintendo Switch 2 and Nintendo Switch applications for which Nintendo is the publisher worldwide.","adv":"https://www.nintendo.com/jp/security-advisories/en/","pol":"https://www.nintendo.com/jp/security-advisories/en/","arab":0},{"s":"Nitro","n":"Nitro Software, Inc.","co":"USA","t":["Vendor"],"root":"EU Agency for Cybersecurity (ENISA)","roles":["CNA"],"scope":"Nitro software issues only.","adv":"https://www.gonitro.com/documentation/release-notes","pol":"https://www.gonitro.com/security-compliance/security/responsible-disclosure","arab":0},{"s":"NLnet_Labs","n":"NLnet Labs","co":"Netherlands","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All NLnet Labs projects.","adv":"https://nlnetlabs.nl/projects/rpki/security-advisories/","pol":"https://nlnetlabs.nl/security-report/","arab":0},{"s":"nodejs","n":"Node.js","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All actively developed versions of software developed under the Node.js project on <a href='https://github.com/nodejs/' target='_blank'>https://github.com/nodejs/</a>.","adv":"https://github.com/nodejs/security-advisories","pol":"https://nodejs.org/en/security/","arab":0},{"s":"Nokia","n":"Nokia","co":"Finland","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All vulnerabilities in Nokia products.","adv":"https://www.nokia.com/about-us/security-and-privacy/product-security-advisory/","pol":"https://www.nokia.com/notices/responsible-disclosure/","arab":0},{"s":"Nozomi","n":"Nozomi Networks Inc.","co":"USA","t":["Vendor","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Nozomi Networks products, as well as vulnerabilities in third-party software discovered by Nozomi Networks that are not in another CNA’s scope.","adv":"https://security.nozominetworks.com/","pol":"https://security.nozominetworks.com/psirt","arab":0},{"s":"Nutanix","n":"Nutanix","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Nutanix issues only.","adv":"https://portal.nutanix.com/page/security/security-advisories","pol":"https://portal.nutanix.com/page/security/security-contact","arab":0},{"s":"nvidia","n":"NVIDIA Corporation","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"NVIDIA issues only.","adv":"https://www.nvidia.com/en-us/security/","pol":"https://www.nvidia.com/en-us/security/psirt-policies/","arab":0},{"s":"obdev","n":"Objective Development Software GmbH","co":"Austria","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Objective Development issues only.","adv":"https://obdev.at/cve/published-vulnerabilities.html","pol":"https://obdev.at/cve/vulnerability-disclosure-policy.html","arab":0},{"s":"OB","n":"OceanBase","co":"China","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"OceanBase products only, not including end-of-life components or products.","adv":"https://github.com/oceanbase/oceanbase/issues","pol":"https://en.oceanbase.com/security","arab":0},{"s":"Octopus","n":"Octopus Deploy","co":"Australia","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Octopus Deploy products, as well as Octopus Deploy maintained projects hosted on <a href='https://github.com/OctopusDeploy' target='_blank'>https://github.com/OctopusDeploy</a>.","adv":"https://advisories.octopus.com/","pol":"https://octopus.com/security/disclosure","arab":0},{"s":"odoo","n":"Odoo","co":"Belgium","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Odoo issues only.","adv":"https://www.odoo.com/r/security-issues","pol":"https://www.odoo.com/security-report","arab":0},{"s":"Okta","n":"Okta","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Okta issues only.","adv":"https://trust.okta.com/security-advisories","pol":"https://www.okta.com/vulnerability-reporting-policy/","arab":0},{"s":"OMICRON","n":"OMICRON electronics","co":"Austria","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"OMICRON electronics issues only.","adv":"https://www.omicronenergy.com/security/","pol":"https://www.omicronenergy.com/security/","arab":0},{"s":"Omnissa","n":"Omnissa, LLC","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Omnissa products and services, including Workspace ONE and Horizon.","adv":"https://www.omnissa.com/omnissa-security-response/","pol":"https://www.omnissa.com/omnissa-external-vulnerability-response-and-remediation-policy/","arab":0},{"s":"OMRON","n":"OMRON Corporation","co":"Japan","t":["Vendor"],"root":"JPCERT/CC","roles":["CNA"],"scope":"Omron Group companies’ Industrial Automation, Healthcare, Social Systems, Device &amp; Module Solutions issues only.","adv":"https://www.omron.com/global/en/inquiry/vulnerability_information/","pol":"https://www.omron.com/contact/ContactForm.do?FID=00282","arab":0},{"s":"ONEKEY","n":"ONEKEY GmbH","co":"Germany","t":["Vendor","Researcher"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"All ONEKEY products and vulnerabilities in third-party software discovered by ONEKEY that are not in another CNA’s scope.","adv":"https://onekey.com/research/","pol":"https://www.onekey.com/responsible-disclosure-policy","arab":0},{"s":"OnLogic","n":"OnLogic","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"OnLogic issues only.","adv":"https://support.onlogic.com/security-advisory/","pol":"https://storage.googleapis.com/ls-public-web-content/Security/STORM-Cybersecurity%20Policy-Vulnerability%20Disclosure.pdf","arab":0},{"s":"ODA","n":"Open Design Alliance","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Open Design Alliance products only.","adv":"https://www.opendesign.com/security-advisories","pol":"https://www.opendesign.com/security","arab":0},{"s":"OX","n":"Open-Xchange","co":"Germany","t":["Open Source","Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Products and services provided by Open-Xchange, PowerDNS, and Dovecot.","adv":"https://documentation.open-xchange.com/appsuite/security/advisories/","pol":"https://vdp.open-xchange.com/","arab":0},{"s":"OAI","n":"OpenAI","co":"USA","t":["Vendor","AI Researcher (Frontier AI Researcher CVE Numbering Authorities (CNAs) Pilot)"],"root":"MITRE Corporation","roles":["CNA"],"scope":"<strong>CNA Scope:</strong> Vulnerabilities in OpenAI installed software including desktop apps, mobile apps, and SDKs only.<br/><br/><strong><a href='/Resources/Roles/Cnas/FrontierAiResearcherCNAsPilot.pdf' target='_blank'>Frontier AI Researcher CVE Numbering Authorities (CNAs) Pilot</a> Scope:</strong> Vulnerabilities discovered by OpenAI that are not within another CNA’s scope.","adv":"https://trust.openai.com/","pol":"https://openai.com/policies/openai-cve-assignment-policy/","arab":0},{"s":"openam-jp","n":"OpenAM Consortium","co":"Japan","t":["Open Source","Consortium"],"root":"JPCERT/CC","roles":["CNA"],"scope":"Open source projects hosted on <a href='https://github.com/openam-jp' target='_blank'>https://github.com/openam-jp</a>.","adv":"https://openam-jp.github.io/Advisories/","pol":"https://openam-jp.github.io/Disclosure-Policy/","arab":0},{"s":"Anolis","n":"OpenAnolis","co":"China","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"OpenAnolis issues only.","adv":"https://anas.openanolis.cn/errata","pol":"https://openanolis.cn/sig/security-committee/doc/479850544775086233","arab":0},{"s":"openEuler","n":"openEuler","co":"China","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"openEuler issues only.","adv":"https://www.openeuler.org/zh/security/security-bulletins/","pol":"https://openeuler.org/en/security/vulnerability-reporting/","arab":0},{"s":"openGauss","n":"openGauss Community","co":"China","t":["Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"openGauss issues only.","adv":"https://opengauss.org/en/security-advisories/","pol":"https://opengauss.org/zh/security.html","arab":0},{"s":"OpenHarmony","n":"OpenHarmony","co":"China","t":["Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"openHarmony issues only.","adv":"https://gitee.com/openharmony/security/tree/master/en/security-disclosure","pol":"https://gitee.com/openharmony/security/tree/master/en/security-process","arab":0},{"s":"openjs","n":"OpenJS Foundation","co":"USA","t":["Open Source"],"root":"Red Hat, Inc.","roles":["CNA"],"scope":"All projects listed at <a href='https://openjsf.org/projects' target='_blank'>https://openjsf.org/projects</a>.","adv":"https://cna.openjsf.org/security-advisories.html","pol":"https://cna.openjsf.org/","arab":0},{"s":"OS-S","n":"OpenSource Security GmbH","co":"Germany","t":["Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities discovered by or reported to OpenSource Security, unless covered by another CNA’s scope.","adv":"https://os-s.net/en/publications/","pol":"https://os-s.net/en/research/responsible-disclosure/","arab":0},{"s":"openssl","n":"OpenSSL Software Foundation","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"OpenSSL software projects only.","adv":"https://www.openssl.org/news/vulnerabilities.html","pol":"https://www.openssl.org/policies/secpolicy.html","arab":0},{"s":"OpenText","n":"OpenText (formerly Micro Focus)","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All OpenText products (including Carbonite, Zix, Micro Focus, others).","adv":"https://knowledge.opentext.com/knowledge/llisapi.dll/open/alerts","pol":"https://www.opentext.com/about/security-acknowledgements","arab":0},{"s":"OpenVPN","n":"OpenVPN Inc.","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All products and projects in which OpenVPN is directly involved commercially and for OpenVPN community projects, including Private Tunnel.","adv":"https://openvpn.net/security-advisories/","pol":"https://openvpn.net/vulnerability-disclosure-policy/","arab":0},{"s":"Opera","n":"Opera Norway AS","co":"Norway","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Opera group products.","adv":"https://security.opera.com/en/advisories/","pol":"https://security.opera.com/en/policy/","arab":0},{"s":"OPPO","n":"OPPO Mobile Telecommunication Corp., Ltd.","co":"China","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"OPPO devices only.","adv":"https://security.oppo.com/en/notice","pol":"https://security.oppo.com/en/responsibleDisclosure","arab":0},{"s":"oracle","n":"Oracle","co":"USA","t":["Hosted Service","Open Source","Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Oracle supported version product issues only; CVE IDs will not be assigned for unsupported products or versions (Oracle will confirm support status and notify researcher).","adv":"https://www.oracle.com/security-alerts/","pol":"https://www.oracle.com/corporate/security-practices/assurance/vulnerability/disclosure.html","arab":0},{"s":"OCD","n":"Orange Cyberdefense","co":"France","t":["CERT","Vendor","Researcher"],"root":"EU Agency for Cybersecurity (ENISA)","roles":["CNA"],"scope":"Orange Cyberdefense branded products and technologies, unless embedded component or software covered by the scope of another CNA; as well as vulnerabilities in third-party software discovered by Orange Cyberdefense that are not in another CNA’s scope.","adv":"https://advisories.orangecyberdefense.com/advisories","pol":"https://www.orangecyberdefense.com/global/vulnerability-disclosure-policy","arab":0},{"s":"Palantir","n":"Palantir Technologies","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Palantir products and technologies only.","adv":"https://www.palantir.com/security-advisories/","pol":"https://palantir.com/responsible-disclosure","arab":0},{"s":"Pall","n":"Pall Corporation","co":"USA","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Pall branded products only.","adv":"https://www.pall.com/en/about-pall/product-security-cvd/known-vulnerabilities.html","pol":"https://www.pall.com/en/about-pall/product-security-cvd.html","arab":0},{"s":"palo_alto","n":"Palo Alto Networks, Inc.","co":"USA","t":["Vendor","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Palo Alto Networks products, and vulnerabilities discovered by Palo Alto Networks that are not in another CNA’s scope.","adv":"https://securityadvisories.paloaltonetworks.com/","pol":"https://www.paloaltonetworks.com/security-disclosure","arab":0},{"s":"Panasonic_Holdings_Corporation","n":"Panasonic Holdings Corporation","co":"Japan","t":["Vendor"],"root":"JPCERT/CC","roles":["CNA"],"scope":"All products and services developed and/or sold by Panasonic Group companies.","adv":"https://www.panasonic.com/global/corporate/product-security/sec/psirt/advisories.html","pol":"https://www.panasonic.com/global/corporate/product-security/sec/psirt/policy.html","arab":0},{"s":"PandoraFMS","n":"Pandora FMS","co":"Spain","t":["Vendor"],"root":"Spanish National Cybersecurity Institute, S.A. (INCIBE)","roles":["CNA"],"scope":"Pandora FMS, Pandora ITSM, and Pandora RC issues only.","adv":"https://pandorafms.com/common-vulnerabilities-and-exposures/","pol":"https://pandorafms.com/en/security/vulnerability-disclosure-policy/","arab":0},{"s":"PangeaCyber","n":"Pangea Cyber Corporation","co":"USA","t":["Vendor","Hosted Service","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Pangea Cyber products and services, as well as vulnerabilities in third-party software that are not in another CNA’s scope.","adv":"https://pangea.cloud/security/advisories","pol":"https://pangea.cloud/security/vdp","arab":0},{"s":"PaperCut","n":"PaperCut Software Pty Ltd","co":"Australia","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"PaperCut MF, PaperCut NG, PaperCut Hive, PaperCut Pocket, PaperCut Mobility Print, QRdoc, PaperCut Views, PaperCut Multiverse, <a href='https://www.papercut.com' target='_blank'>https://www.papercut.com</a>, and all other PaperCut products and services.","adv":"https://www.papercut.com/kb/Main/CommonSecurityQuestions","pol":"https://www.papercut.com/contact/security/vulnerability-disclosure-policy/","arab":0},{"s":"Patchstack","n":"Patchstack","co":"Estonia","t":["Bug Bounty Provider","Hosted Service","Open Source","Researcher","Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in third-party PHP and JavaScript software discovered by Patchstack and researchers participating in the Patchstack Bug Bounty Program.","adv":"https://patchstack.com/database/","pol":"https://patchstack.com/patchstack-vulnerability-disclosure-policy/","arab":0},{"s":"Payara","n":"Payara","co":"UK","t":["Open Source","Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Payara Platform product distributions (Payara Server, Micro, Embedded) for both Enterprise (commercial) and Community (OSS) distributions.","adv":"https://docs.payara.fish/community/docs/Security/Security%20Fix%20List.html","pol":"https://docs.payara.fish/community/docs/Security/Overview.html","arab":0},{"s":"Pega","n":"Pegasystems Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Pegasystems products only.","adv":"https://www.pega.com/trust/security-advisories","pol":"https://www.pega.com/responsible-disclosure-policy","arab":0},{"s":"Pentraze","n":"Pentraze Cybersecurity","co":"Dominican Republic","t":["Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in third-party software discovered by Pentraze Cybersecurity that are not in another CNA’s scope.","adv":"https://pentraze.com/vulnerability-reports/","pol":"https://pentraze.com/vulnerability-disclosure-policy/","arab":0},{"s":"Perforce","n":"Perforce","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Perforce products.","adv":"https://portal.perforce.com/s/cve-dashboard","pol":"https://www.perforce.com/company/security-compliance-policies","arab":0},{"s":"Philips","n":"Philips","co":"Netherlands","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Philips issues only.","adv":"https://www.philips.com/a-w/security/security-advisories","pol":"https://www.philips.com/a-w/security/coordinated-vulnerability-disclosure.html","arab":0},{"s":"Phoenix","n":"Phoenix Technologies, Inc.","co":"USA","t":["Vendor","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Phoenix Technologies products (supported products and end-of-life/end-of-service products), as well as vulnerabilities in third-party software discovered by Phoenix Technologies that are not in another CNA’s scope.","adv":"https://phoenixtech.com/security-notifications/","pol":"https://phoenixtech.com/vulnerability-disclosure-policy/","arab":0},{"s":"php","n":"PHP Group","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in PHP code (code in <a href='https://github.com/php/php-src' target='_blank'>https://github.com/php/php-src</a>) only.","adv":"https://www.php.net/ChangeLog-8.php","pol":"https://wiki.php.net/security","arab":0},{"s":"PingIdentity","n":"Ping Identity Corporation","co":"USA","t":["Hosted Service","Researcher","Bug Bounty Provider"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Ping Identity and ForgeRock products (supported products and end-of-life/end-of-service products), as well as vulnerabilities in third-party software discovered by Ping Identity or ForgeRock that are not in another CNA’s scope.","adv":"https://docs.pingidentity.com/pingam/latest/release-notes/security-advisories.html","pol":"https://www.pingidentity.com/en/company/security-at-ping-identity.html","arab":0},{"s":"PingCAP","n":"PingCAP (US), Inc.","co":"USA","t":["Vendor","Open Source","Hosted Service"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in the following PingCAP maintained products and components: TiDB (code available at <a href='https://github.com/pingcap/tidb' target='_blank'>https://github.com/pingcap/tidb</a>); TiKV (code available at <a href='https://github.com/tikv/tikv' target='_blank'>https://github.com/tikv/tikv</a>); PD (Placement Driver, code available at <a href='https://github.com/tikv/pd' target='_bla","adv":"https://www.pingcap.com/security/","pol":"https://www.pingcap.com/security/","arab":0},{"s":"PlexTrac","n":"PlexTrac, Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities within PlexTrac’s products.","adv":"https://docs.plextrac.com/plextrac-documentation/master/security-advisories","pol":"https://plextrac.com/vulnerability-disclosure/","arab":0},{"s":"Pointsharp","n":"Pointsharp International AB","co":"Sweden","t":["Vendor"],"root":"EU Agency for Cybersecurity (ENISA)","roles":["CNA"],"scope":"All products, software components, and cloud services developed, owned, maintained, and supported by Pointsharp International AB and its subsidiaries.","adv":"https://docs.pointsharp.com/psa/index.html","pol":"https://www.pointsharp.com/en/security-pointsharp-vulnerability-disclosure-policy","arab":0},{"s":"PostgreSQL","n":"PostgreSQL","co":"Canada","t":["Open Source"],"root":"Red Hat, Inc.","roles":["CNA"],"scope":"<a href='https://www.postgresql.org/download/' target='_blank'>postgresql.org/download</a> software and related projects listed at <a href='https://www.postgresql.org/support/security/' target='_blank'>postgresql.org/support/security</a>.","adv":"https://www.postgresql.org/support/security/","pol":"https://www.postgresql.org/support/security/","arab":0},{"s":"postiz","n":"Postiz","co":"USA","t":["Vendor","Open Source","Hosted Service"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Postiz products and projects only including: the core repository for postiz-app (github.com/gitroomhq/postiz-app); all gitroomhq repositories that are official components, tooling, or integrations of Postiz; official Postiz container images published under gitroomhq on GHCR; official Postiz CLI tools and NPM packages (NPM org: @postiz); Postiz-Cloud related infrastructure and services. (API, Front","adv":"https://postiz.gadvisory.org/advisories","pol":"https://github.com/gitroomhq/postiz-app/blob/main/SECURITY.md","arab":0},{"s":"Profelis","n":"Profelis IT Consultancy","co":"Türkiye","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Products and services developed by Profelis IT Consultancy including enterprise directory solution SambaBox and password reset product PassBox.","adv":"https://www.profelis.com.tr/politikalar/bilgi-guvenligi-politikamiz/","pol":"https://www.profelis.com.tr/politikalar/gizlilik-politikamiz/","arab":0},{"s":"Profisee","n":"Profisee Group, Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities found in software developed by Profisee only.","adv":"https://profisee.com/security/vulnerabilities/detail/","pol":"https://profisee.com/security/vulnerabilities/","arab":0},{"s":"ProgressSoftware","n":"Progress Software Corporation","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in software published and maintained by Progress Software Corporation.","adv":"https://community.progress.com/s/","pol":"https://www.progress.com/security/vulnerability-reporting-policy","arab":0},{"s":"PRJBLK","n":"Project Black","co":"Australia","t":["Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities discovered by Project Black that are not within another CNA’s scope.","adv":"https://projectblack.io/blog/tag/advisory/","pol":"https://projectblack.io/blog/vulnerability-disclosure-policy/","arab":0},{"s":"Proofpoint","n":"Proofpoint Inc.","co":"USA","t":["Hosted Service","Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Proofpoint products.","adv":"https://proofpoint.com/security/security-advisories","pol":"https://www.proofpoint.com/us/security/vulnerability-disclosure-policy","arab":0},{"s":"@huntr_ai","n":"Protect AI (formerly huntr.dev)","co":"USA","t":["Bug Bounty Provider","Open Source","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in Protect AI products, third-party code vulnerabilities reported by researchers collaborating with huntr and vulnerabilities discovered by, or reported to, Protect AI that are not in another CNA’s scope.","adv":"https://huntr.com/bounties/hacktivity","pol":"https://huntr.com/guidelines/","arab":0},{"s":"Proton","n":"Proton AG","co":"Switzerland","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Proton AG issues only.","adv":"https://proton.me/security/security-advisories","pol":"https://proton.me/security/vulnerability-disclosure","arab":0},{"s":"PTC","n":"PTC Inc.","co":"USA","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"All currently supported PTC software products and cloud/SaaS services.","adv":"https://www.ptc.com/en/about/trust-center/advisory-center","pol":"https://www.ptc.com/documents/security/coordinated-vulnerability-disclosure","arab":0},{"s":"PSF","n":"Python Software Foundation","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Only supported and end-of-life Python versions available at <a href='https://python.org/downloads' target='_blank'>https://python.org/downloads</a> and pip versions available at <a href='https://pypi.org/project/pip' target='_blank'>https://pypi.org/project/pip</a>, Pallets projects available at <a href='https://github.com/pallets' target='_blank'>https://github.com/pallets</a> (such as Flask, Jin","adv":"https://mail.python.org/archives/list/security-announce@python.org/latest","pol":"https://www.python.org/cve-numbering-authority/","arab":0},{"s":"qnap","n":"QNAP Systems, Inc.","co":"Taiwan","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"QNAP issues only.","adv":"https://www.qnap.com/en/security-advisories","pol":"https://www.qnap.com/en-us/security-advisory/report","arab":0},{"s":"Qt","n":"Qt Group","co":"Finland","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All supported Qt Group products. Excludes third-party redistributions and downstream packaging of Qt open source releases not published by Qt Group.","adv":"https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products","pol":"https://www.qt.io/terms-conditions/responsible-vulnerability-disclosure-process","arab":0},{"s":"qualcomm","n":"Qualcomm, Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Qualcomm and Snapdragon issues only.","adv":"https://www.qualcomm.com/company/product-security/bulletins","pol":"https://www.qualcomm.com/news/onq/2019/01/16/inside-qualcomm-technologies-vulnerability-rewards-program","arab":0},{"s":"Qualys","n":"Qualys, Inc.","co":"USA","t":["Vendor","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Qualys products and vulnerabilities discovered by Qualys that are not covered by another CNA’s scope.","adv":"https://www.qualys.com/security-advisories/","pol":"https://www.qualys.com/docs/responsible-disclosure-policy.pdf","arab":0},{"s":"QCI","n":"Quanta Computer, Inc.","co":"Taiwan","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Quanta Computer PSIRT products and services only.","adv":"https://www.quantatw.com/Quanta/english/product/qci_sec.aspx","pol":"https://www.quantatw.com/Quanta/english/product/sec_process.aspx","arab":0},{"s":"Radiometer","n":"Radiometer Medical ApS","co":"Denmark","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Radiometer products only.","adv":"https://www.radiometer.com/en/myradiometer","pol":"https://www.radiometer.com/en/about-radiometer/legal/coordinated-vulnerability-disclosure","arab":0},{"s":"rami.io","n":"rami.io GmbH","co":"Germany","t":["Vendor","Hosted Service","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All rami.io GmbH products and open source projects, including pretix, official pretix plugins and apps, and Venueless.","adv":"https://rami.io/security/advisories/","pol":"https://rami.io/security/disclosure/","arab":0},{"s":"rapid7","n":"Rapid7, Inc.","co":"USA","t":["Vendor","Open Source","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Rapid7 products, and vulnerabilities discovered by Rapid7 that are not in another CNA’s scope.","adv":"https://www.rapid7.com/db/","pol":"https://www.rapid7.com/security/disclosure/","arab":0},{"s":"RTI","n":"Real-Time Innovations, Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All RTI Connext products, including EOL products. See <a href='https://www.rti.com/products' target='_blank'>https://www.rti.com/products</a> for more information.","adv":"https://community.rti.com/static/documentation/connext-dds/current/doc/vulnerabilities/#","pol":"https://community.rti.com/static/documentation/connext-dds/current/doc/vulnerabilities/#rti-s-approach-to-vulnerability-detection-and-management","arab":0},{"s":"RealPage","n":"RealPage","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in RealPage products and services including but not limited to: Keyready, Knock CRM, HomeWiseDocs, REDS (Real Estate Data Solutions), G5, WhiteSky Communications, Chirp Systems, STRATIS IoT, Modern Message (Community Rewards), Hipercept, Investor Management Services, AIM, FUEL, Buildium, All Property Management, SimpleBills, DepositIQ, Rentlytics, ClickPay, LeaseLabs, PEX, On-Site,","adv":"https://www.realpage.com/support/security/responsible-disclosure/security-advisories/","pol":"https://www.realpage.com/support/security/responsible-disclosure/","arab":0},{"s":"redhat","n":"Red Hat, Inc.","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["Root","CNA-LR","CNA"],"scope":"<strong>Root Scope:</strong> The Red Hat Root’s scope includes the open source community. Any open source organizations that prefer Red Hat as their Root; organizations are free to choose another Root if it suits them better.<br/><strong>CNA-LR Scope:</strong> Vulnerabilities in software developed by a CNA within the Red Hat Root hierarchy.<br/><strong>CNA Scope:</strong> Vulnerabilities in open s","adv":"https://access.redhat.com/security/security-updates/#/security-advisories","pol":"https://access.redhat.com/articles/red_hat_cna_vulnerability_disclosure_policy","arab":0},{"s":"RES","n":"RedEye Security","co":"USA","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Vulnerabilities in RedEye Security’s own products: software that RedEye develops and distributes for customers to deploy and operate in their own environments. Caver, RedEye’s self-hosted, Splunk-compatible SIEM and OCSF data-lake platform, including its server components, collectors and agents, command-line tooling, and officially distributed installers and container images. Out of scope: vulnera","adv":"https://redeyesecurity.com/security/advisories","pol":"https://redeyesecurity.com/security","arab":0},{"s":"Replicated","n":"Replicated, Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Replicated products and services only.","adv":"https://www.replicated.com/security/advisories/","pol":"https://www.replicated.com/security/","arab":0},{"s":"Ribose","n":"Ribose Limited","co":"UK","t":["Hosted Service","Open Source","Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Ribose products and services, including open source projects, supported products, and end-of-life/end-of-service products.","adv":"https://open.ribose.com/advisories/","pol":"https://open.ribose.com/cve-policy/","arab":0},{"s":"bosch","n":"Robert Bosch GmbH","co":"Germany","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Bosch products only.","adv":"https://psirt.bosch.com/security-advisories/","pol":"https://psirt.bosch.com/bosch-responsible-disclosure-policy/","arab":0},{"s":"Roche","n":"Roche Diagnostics","co":"Switzerland","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Roche’s medical technology products.","adv":"https://diagnostics.roche.com/global/en/legal/product-security-advisory.html","pol":"https://diagnostics.roche.com/global/en/legal/vulnerability-and-incident-handling-policy.html","arab":0},{"s":"Rockwell","n":"Rockwell Automation","co":"USA","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"All Rockwell Automation products.","adv":"https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html","pol":"https://www.rockwellautomation.com/en-us/company/about-us/legal-notices/vulnerability-policy.html..html","arab":0},{"s":"rt-labs","n":"RT-Labs AB","co":"Sweden","t":["Vendor","Open Source"],"root":"EU Agency for Cybersecurity (ENISA)","roles":["CNA"],"scope":"All products of RT-Labs AB, excluding end-of-life-products; as well as vulnerabilities in third-party products used by RT-Labs AB that are not in the scope of another CNA.","adv":"https://rt-labs.com/cyber-security/","pol":"https://rt-labs.com/about-rt-labs/our-policies/#vulnerability_disclosure_policy","arab":0},{"s":"runZero","n":"runZero, Inc.","co":"USA","t":["Vendor","Researcher","Hosted Service","Open Source"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Vulnerabilities in runZero products, as well as vulnerabilities discovered by, or reported to, runZero that are not in another CNA’s scope.","adv":"https://www.runzero.com/advisories","pol":"https://www.runzero.com/legal/disclosure/","arab":0},{"s":"S21sec","n":"S21sec Cyber Solutions by Thales","co":"Spain","t":["Researcher"],"root":"Thales Group","roles":["CNA"],"scope":"Vulnerabilities discovered by S21sec that are not within another CNA’s scope.","adv":"https://www.s21sec.com/CVElist/","pol":"https://www.s21sec.com/CVEdisclosurepolicy/","arab":0},{"s":"SafeSource","n":"SafeSource Lab","co":"Italy","t":["Vendor"],"root":"EU Agency for Cybersecurity (ENISA)","roles":["CNA"],"scope":"All SafeSource Lab products only. This includes the SafeSource vulnerability management platform, the SafeSource digital security compliance platform, and any other software products developed and maintained by SafeSource Lab. The scope covers vulnerabilities in SafeSource Lab products discovered internally or reported to SafeSource Lab by third parties. Vulnerabilities in third-party products, or","adv":"https://www.safesourcelab.com/advisories","pol":"https://www.safesourcelab.com/psirt","arab":0},{"s":"SailPoint","n":"SailPoint Technologies","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"SailPoint issues only.","adv":"https://www.sailpoint.com/security-advisories/","pol":"https://www.sailpoint.com/legal/security/","arab":0},{"s":"Salesforce","n":"Salesforce, Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"<a href='https://trust.salesforce.com/en/trust-and-compliance-documentation/' target='_blank'>Salesforce products</a> only.","adv":"https://trust.salesforce.com/en/security/security-advisories/","pol":"https://trust.salesforce.com/en/security/responsible-disclosure-policy","arab":0},{"s":"Samsung_Mobile","n":"Samsung Mobile","co":"South Korea","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Samsung Mobile Galaxy products, personal computers, and related services only.","adv":"https://security.samsungmobile.com/workScope.smsb","pol":"https://security.samsungmobile.com/securityReporting.smsb","arab":0},{"s":"samsung.tv_appliance","n":"Samsung TV & Appliance","co":"South Korea","t":["Open Source","Researcher","Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Samsung TV &amp; Appliance products, Samsung-owned open source projects listed on <a href='https://github.com/Samsung/' target='_blank'>https://github.com/Samsung/</a>, as well as vulnerabilities in third-party software discovered by Samsung that are not in another CNA’s scope. Vulnerabilities affecting end-of-life/end-of-service products are in scope. The following categories of Samsung Products ","adv":"https://Security.SamsungTV.com/securityUpdates","pol":"https://SecurityReport.samsung.com/#DisclosurePolicy","arab":0},{"s":"SDC","n":"Sandisk","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Sandisk products listed at <a href='https://shop.sandisk.com/product-portfolio' target='_blank'>https://shop.sandisk.com/product-portfolio</a> only.","adv":"https://shop.sandisk.com/support/product-security","pol":"https://shop.sandisk.com/support/product-security/vulnerability-disclosure-policy","arab":0},{"s":"sap","n":"SAP SE","co":"Germany","t":["Vendor","Hosted Service","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All SAP products.","adv":"https://url.sap/sapsecuritypatchday","pol":"https://www.sap.com/about/trust-center/security/incident-management.html","arab":0},{"s":"Saviynt","n":"Saviynt Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities discovered in Saviynt products.","adv":"https://saviynt.com/trust-compliance-security","pol":"https://saviynt.com/saviynt-responsible-disclosure-policy/","arab":0},{"s":"sba-research","n":"SBA Research gGmbH","co":"Austria","t":["Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities discovered by SBA Research or reported to SBA Research by partner organizations that are not in another CNA’s scope.","adv":"https://github.com/sbaresearch/advisories","pol":"https://www.sba-research.org/about/vulnerability-disclosure-policy/","arab":0},{"s":"Scality","n":"Scality SA","co":"France","t":["Vendor"],"root":"EU Agency for Cybersecurity (ENISA)","roles":["CNA"],"scope":"All Scality-branded software products developed, maintained, and distributed by Scality, including but not limited to Scality RING, Scality ARTESCA, and Autonomous Data Infrastructure (ADI) products. The scope includes all versions of these products currently under active support, as well as legacy versions unless otherwise specified in the Scality Vulnerability Disclosure Policy.","adv":"https://www.scality.com/security-advisories","pol":"https://www.scality.com/legal/scality-vulnerability-disclosure-policy","arab":0},{"s":"schneider","n":"Schneider Electric","co":"France","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Products supported by Schneider Electric and its affiliates, including products branded Schneider Electric or any other brands owned or controlled by Schneider Electric (such as but not limited to APC, Eliwell, Proface, ProLeit, Lauritz Knudsen Electrical & Automation, etc.), excluding Aveva and RIB products.","adv":"https://www.se.com/ww/en/work/support/cybersecurity/security-notifications.jsp","pol":"https://www.se.com/ww/en/work/support/cybersecurity/vulnerability-policy.jsp","arab":0},{"s":"SCHUTZWERK","n":"SCHUTZWERK GmbH","co":"Germany","t":["Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities discovered by, reported to, or coordinated by, SCHUTZWERK unless covered by another CNA.","adv":"https://www.schutzwerk.com/blog/tags/advisories/","pol":"https://www.schutzwerk.com/en/advisories/","arab":0},{"s":"SEL","n":"Schweitzer Engineering Laboratories, Inc.","co":"USA","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"All Schweitzer Engineering Laboratories products.","adv":"https://selinc.com/support/security-notifications/external-reports/","pol":"https://selinc.com/support/security-notifications/","arab":0},{"s":"SCIEX","n":"SCIEX","co":"USA","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"SCIEX branded products only.","adv":"https://sciex.com/support/product-security/known-vulnerabilities","pol":"https://sciex.com/support/product-security/coordinated-vulnerabilities-disclosure-policy","arab":0},{"s":"Seagate","n":"Seagate Technology","co":"USA","t":["Vendor","Open Source","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Any Seagate or LaCie software or hardware, open or closed source, supported and end of life, as well as any vulnerabilities in third-party software discovered by Seagate that are not in another CNA’s scope.","adv":"https://www.seagate.com/support/security/","pol":"https://www.seagate.com/legal-privacy/responsible-vulnerability-disclosure-policy/","arab":0},{"s":"seal","n":"Seal Security","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in Seal products or services and vulnerabilities discovered in open source libraries unless covered by the scope of another CNA.","adv":"https://app.sealsecurity.io/repository","pol":"https://docs.sealsecurity.io/vulnerability-disclosure","arab":0},{"s":"SEC-VLab","n":"SEC Consult Vulnerability Lab","co":"Austria","t":["Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All vulnerabilities discovered in third-party hardware/software by SEC Consult Vulnerability Lab (part of SEC Consult, an Eviden business), which are not in another CNA’s scope.","adv":"https://sec-consult.com/vulnerability-lab/","pol":"https://sec-consult.com/vulnerability-lab/responsible-disclosure-policy/","arab":0},{"s":"sec1","n":"Sec1","co":"India","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities found in cybersecurity software solutions developed and maintained by Sec1 as listed on <a href='https://sec1.io/' target='_blank'>https://sec1.io/</a>, and vulnerabilities identified in software projects or products where Sec1 has a direct and substantial contribution or partnership, unless covered by the scope of another CNA.","adv":"https://sec1.io/sec1-security-advisories/","pol":"https://sec1.io/sec1-public-disclosure-policy-for-cve-reporting/","arab":0},{"s":"Secomea","n":"Secomea A/S","co":"Denmark","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Supported Secomea products only.","adv":"https://www.secomea.com/cybersecurity-advisory/","pol":"https://www.secomea.com/cybersecurity-advisory/","arab":0},{"s":"Secur0","n":"Secur0","co":"Spain","t":["Bug Bounty Provider"],"root":"Spanish National Cybersecurity Institute, S.A. (INCIBE)","roles":["CNA"],"scope":"Vulnerabilities identified by Secur0 or third parties in the programs listed at <a href='https://app.secur0.com/programs' target='_blank'>https://app.secur0.com/programs</a>.","adv":"https://secur0.com/en/cna/cve-list","pol":"https://secur0.com/en/vulnerability-disclosure","arab":0},{"s":"securepoint","n":"Securepoint GmbH","co":"Germany","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Securepoint GmbH issues only.","adv":"https://wiki.securepoint.de/Advisory","pol":"https://www.securepoint.de/disclosure-policy","arab":0},{"s":"Securifera","n":"Securifera, Inc.","co":"USA","t":["Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in vendor products discovered by Securifera, or related parties, while performing vulnerability research or security assessments.","adv":"https://www.securifera.com/advisories/","pol":"https://www.securifera.com/advisories/","arab":0},{"s":"securin","n":"Securin","co":"USA","t":["Vendor","Open Source","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities found in Securin products and services (including end-of-life/end-of-service products), as well as vulnerabilities in third-party software discovered by Securin that are not in another CNA’s scope.","adv":"https://www.securin.io/discover-zero-days","pol":"https://www.securin.io/disclosure-policy","arab":0},{"s":"SRA","n":"Security Risk Advisors (SRA)","co":"USA","t":["Researcher"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Vulnerabilities discovered by SRA that are not within the scope of another CNA.","adv":"https://sra.io/advisories/","pol":"https://sra.io/disclosure-policy/","arab":0},{"s":"S4M","n":"Security4Media","co":"Switzerland","t":["Researcher"],"root":"EU Agency for Cybersecurity (ENISA)","roles":["CNA"],"scope":"Vulnerabilities in specialized software or hardware used in media and broadcasting, discovered by or reported to Security4Media, that are not in the scope of another CNA.","adv":"https://security4media.org/cve-infos/","pol":"https://security4media.org/disclosurepolicy/","arab":0},{"s":"Semtech","n":"Semtech Corporation","co":"Canada","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Semtech products (including Sierra Wireless products) only.","adv":"https://www.semtech.com/company/security/security-bulletins","pol":"https://www.semtech.com/company/security/report-vulnerability","arab":0},{"s":"senhasegura","n":"senhasegura","co":"Brazil","t":["Vendor","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in senhasegura products, and other vulnerabilities discovered by senhasegura that are not in another CNA’s scope.","adv":"https://docs.senhasegura.io/security-center-advisories/","pol":"https://docs.senhasegura.io/security-guidance/","arab":0},{"s":"SN","n":"ServiceNow","co":"USA","t":["Hosted Service","Researcher","Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All ServiceNow products (supported products and end-of-life/end-of-service products), as well as vulnerabilities in third-party software discovered by ServiceNow that are not in another CNA’s scope.","adv":"https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1226057","pol":"https://www.servicenow.com/company/trust/privacy/responsible-disclosure.html","arab":0},{"s":"CoolKit","n":"SHENZHEN CoolKit Technology CO., LTD.","co":"China","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Products of eWeLink Solutions only, details are available at <a href='https://ewelink.cc/our-projects-scope/' target='_blank'>https://ewelink.cc/our-projects-scope/</a>.","adv":"https://ewelink.cc/security-advisories-and-notices/","pol":"https://ewelink.cc/wp-content/uploads/2022/04/eWeLinks-Vulnerability-Disclosure-Policy.pdf","arab":0},{"s":"ShopBeat","n":"Shop Beat Solutions (Pty) LTD","co":"South Africa","t":["Hosted Service","Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in Shop Beat products and services and vulnerabilities discovered by Shop Beat unless covered by the scope of another CNA.","adv":"https://www.shopbeat.co.za/security_advisory_location.html","pol":"https://www.shopbeat.co.za/disclosure_policy.html","arab":0},{"s":"SICK_AG","n":"SICK AG","co":"Germany","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"SICK AG issues and issues in EHS products (when related to the Endress+Hauser SICK (EHS) joint venture).","adv":"https://sick.com/psirt#advisories","pol":"https://sick.com/psirt","arab":0},{"s":"siemens","n":"Siemens","co":"Germany","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Siemens issues only.","adv":"https://www.siemens.com/global/en/products/services/cert.html#SiemensSecurityAdvisories","pol":"https://www.siemens.com/global/en/products/services/cert/vulnerability-process.html","arab":0},{"s":"Silabs","n":"Silicon Labs","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Silicon Labs issues only.","adv":"https://community.silabs.com/s/alert/Alert__c/00B1M000009sQ4R","pol":"https://www.silabs.com/security/security-vulnerability-disclosure-policy","arab":0},{"s":"Silver_Peak","n":"Silver Peak Systems, Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Silver Peak product issues only.","adv":"https://www.silver-peak.com/support/user-documentation/security-advisories","pol":"https://www.silver-peak.com/support/user-documentation/security-advisories","arab":0},{"s":"Simplinx","n":"Simplinx Ltd.","co":"Türkiye","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Simplinx products only.","adv":"https://simplinx.com/en/security-advisories/","pol":"https://simplinx.com/en/vulnerability-handling-and-disclosure-process/","arab":0},{"s":"sirius","n":"Sirius Computer, Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Sirius branded products, managed systems, and software projects only.","adv":"https://sirius.computer/security-disclosure-policy/","pol":"https://sirius.computer/security-disclosure-policy/","arab":0},{"s":"SmileDigitalHealth","n":"Smile CDR Inc. (doing business as “Smile Digital Health”)","co":"Canada","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Smile Digital Health products and HAPI FHIR.","adv":"https://www.smiledigitalhealth.com/legal/security-advisories","pol":"https://www.smiledigitalhealth.com/responsible-disclosure-policy","arab":0},{"s":"Snow","n":"Snow Software","co":"Sweden","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Snow Software products.","adv":"https://community.snowsoftware.com/s/group/0F91r000000QUhPCAW/news-updates","pol":"https://www.snowsoftware.com/seo/snow-responsible-disclosure-policy","arab":0},{"s":"SNOW","n":"Snowflake","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Snowflake products, including those of its subsidiaries, and vulnerabilities in third-party software that are discovered by, or reported to, Snowflake that are not within another CNA’s scope.","adv":"https://www.snowflake.com/en/why-snowflake/snowflake-security-hub/security-bulletins/","pol":"https://hackerone.com/snowflake?type=team","arab":0},{"s":"snyk","n":"Snyk","co":"UK","t":["Open Source","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in Snyk products and vulnerabilities discovered by, or reported to, Snyk that are not in another CNA’s scope.","adv":"https://snyk.io/vuln/","pol":"https://snyk.io/vulnerability-disclosure/","arab":0},{"s":"SOCRadar","n":"SOCRadar Cyber Intelligence Inc.","co":"USA","t":["Vendor","Researcher"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Vulnerabilities in SOCRadar products and services and vulnerabilities discovered by or reported to SOCRadar that are not in another CNA’s scope.","adv":"https://socradar.io/labs/cve-radar/","pol":"https://socradar.io/security/","arab":0},{"s":"Softing","n":"Softing","co":"Germany","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Softing issues only.","adv":"https://company.softing.com/psirt.html","pol":"https://company.softing.com/psirt.html","arab":0},{"s":"SoftIron","n":"SoftIron","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"SoftIron HyperCloud branded products and technologies only.","adv":"https://advisories.softiron.cloud/","pol":"https://softiron.com/legal/security-disclosure/","arab":0},{"s":"SolarWinds","n":"SolarWinds","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"SolarWinds products only.","adv":"https://www.solarwinds.com/trust-center/security-advisories","pol":"https://www.solarwinds.com/information-security/vulnerability-disclosure-policy","arab":0},{"s":"Solidigm","n":"Solidigm","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Solidigm branded products and technologies.","adv":"https://www.solidigm.com/support-page/support-security.html","pol":"https://www.solidigm.com/support-page/support-security.html","arab":0},{"s":"Sonatype","n":"Sonatype Inc.","co":"USA","t":["Vendor","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Sonatype products and vulnerabilities in third-party software discovered by Sonatype that are not in another CNA’s scope.","adv":"https://support.sonatype.com/hc/en-us/sections/203012668-Security-Advisories","pol":"https://help.sonatype.com/en/responsible-disclosure.html","arab":0},{"s":"sonicwall","n":"SonicWall, Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"SonicWall issues only.","adv":"https://psirt.global.sonicwall.com/vuln-list","pol":"https://psirt.global.sonicwall.com/vuln-policy","arab":0},{"s":"Sophos","n":"Sophos Limited","co":"UK","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Sophos issues only.","adv":"https://community.sophos.com/b/security-blog/","pol":"https://sophos.com/security/","arab":0},{"s":"INCIBE","n":"Spanish National Cybersecurity Institute, S.A. (INCIBE)","co":"Spain","t":["CERT"],"root":"MITRE Corporation","roles":["Root","CNA"],"scope":"<strong>Root Scope:</strong> Spain organizations.<br/><strong>CNA Scope:</strong> Vulnerability assignment related to its vulnerability coordination role for Industrial Control Systems (ICS), Information Technologies (IT), and Internet of Things (IoT) systems issues at the national level, and vulnerabilities reported to INCIBE by Spain organizations and researchers that are not in another CNA’s sc","adv":"https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/avisos-cna","pol":"https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/asignacion-publicacion-cve","arab":0},{"s":"spartans-security","n":"Spartans Security","co":"Australia","t":["Researcher"],"root":"Red Hat, Inc.","roles":["CNA"],"scope":"Vulnerabilities in software, services, and infrastructure owned and managed by Spartans Security, and vulnerabilities researched and found by Spartans Security in third-party products that are not part of another CNA's scope.","adv":"https://www.spartanssec.com/blog","pol":"https://www.spartanssec.com/vulnerability-disclosure-policy","arab":0},{"s":"Spotfire","n":"Spotfire","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities associated with the Spotfire product only.","adv":"https://community.spotfire.com/security-advisories/","pol":"https://community.spotfire.com/security/","arab":0},{"s":"Stackable","n":"Stackable GmbH","co":"Germany","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in Stackable products including end-of-life or unsupported Stackable software, as well as open source projects that are not in another CNA’s scope.","adv":"https://advisories.stackable.tech/","pol":"https://stackable.tech/en/vulnerability-disclosure-policy/","arab":0},{"s":"STAR_Labs","n":"STAR Labs SG Pte. Ltd.","co":"Singapore","t":["Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities discovered by, or reported to, STAR Labs SG that are not in another CNA’s scope.","adv":"https://starlabs.sg/advisories/","pol":"https://starlabs.sg/advisories/STAR%20Labs%20SG%20Pte.%20Ltd.%20Vulnerability%20Disclosure%20Policy.pdf","arab":0},{"s":"StrongDM","n":"StrongDM","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"StrongDM issues only.","adv":"https://www.strongdm.com/security/advisories","pol":"https://hackerone.com/strongdm","arab":0},{"s":"Stryker","n":"Stryker Corporation","co":"USA","t":["Vendor","Researcher"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"All products of Stryker or a Stryker company including end-of-life/end-of-service products, and vulnerabilities in third-party software used in Stryker products that are not in another CNA’s scope.","adv":"https://www.stryker.com/us/en/about/governance/cyber-security/product-security.html","pol":"https://www.stryker.com/us/en/about/governance/cyber-security.html","arab":0},{"s":"Supermicro","n":"Super Micro Computer, Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Supermicro branded products, managed system, or software projects.","adv":"https://www.supermicro.com/en/support/security_center#!advisories","pol":"https://www.supermicro.com/en/support/security_center#!report","arab":0},{"s":"suse","n":"SUSE","co":"USA","t":["Vendor","Open Source","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"SUSE and Rancher specific security issues, and vulnerabilities discovered by SUSE that are not covered by the scope of another CNA.","adv":"https://www.suse.com/support/update/","pol":"https://www.suse.com/support/security/","arab":0},{"s":"Swift","n":"Swift Project","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"The Swift Project only.","adv":"https://swift.org/support/security.html","pol":"https://swift.org/support/security.html","arab":0},{"s":"NCSC.ch","n":"Switzerland National Cyber Security Centre (NCSC)","co":"Switzerland","t":["CERT"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in software reported to the NCSC-CH for coordinated disclosure, which are not in another CNA's scope.","adv":"https://www.ncsc.admin.ch/ncsc/en/home/infos-fuer/infos-it-spezialisten/themen/schwachstelle-melden/cve-list.html","pol":"https://www.ncsc.admin.ch/ncsc/en/home/infos-fuer/infos-it-spezialisten/themen/schwachstelle-melden.html","arab":0},{"s":"symantec","n":"Symantec - A Division of Broadcom","co":"USA","t":["Vendor","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Symantec Enterprise products as well as vulnerabilities in third-party software discovered by Symantec that are not in another CNA’s scope.","adv":"https://support.broadcom.com/security-advisory/security-advisories-list.html","pol":"https://www.broadcom.com/support/security-center/vulnerability-management","arab":0},{"s":"Synaptics","n":"Synaptics, Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Synaptics issues only.","adv":"https://www.synaptics.com/products/touchpad-family","pol":"https://www.synaptics.com/vulnerability-disclosure-policy","arab":0},{"s":"Syncro","n":"Syncro Soft SRL","co":"Romania","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Syncro Soft SRL products, including Oxygen XML suite of products, published on <a href='https://www.oxygenxml.com' target='_blank'>https://www.oxygenxml.com</a> including end-of-life/end-of-service products.","adv":"https://www.oxygenxml.com/security/advisories.html","pol":"https://www.oxygenxml.com/security/","arab":0},{"s":"synology","n":"Synology Inc.","co":"Taiwan","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Synology issues only.","adv":"https://www.synology.com/en-global/security/advisory","pol":"https://www.synology.com/en-us/security/bounty_program","arab":0},{"s":"Synopsys","n":"Synopsys, Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Synopsys products and technologies only.","adv":"https://www.synopsys.com/company/legal/vulnerability-disclosure-policy/advisories.html","pol":"https://www.synopsys.com/company/legal/vulnerability-disclosure-policy.html","arab":0},{"s":"TMUS","n":"T-Mobile US","co":"USA","t":["Vendor","Researcher"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"All T-Mobile US products (including end-of-life/end-of-service products), as well as vulnerabilities in third-party software/hardware discovered by T-Mobile US that are not in another CNA’s scope.","adv":"https://t-mobile.github.io/","pol":"https://bugcrowd.com/engagements/t-mobile","arab":0},{"s":"Tacit","n":"Tacit","co":"France","t":["Hosted Service","Vendor"],"root":"EU Agency for Cybersecurity (ENISA)","roles":["CNA"],"scope":"Vulnerabilities affecting software products, services, or components referenced in Tacit platform by software publishers.","adv":"","pol":"https://tacit.now/vulnerability-disclosure-policy","arab":0},{"s":"talos","n":"Talos","co":"USA","t":["Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Third-party products it researches.","adv":"https://talosintelligence.com/vulnerability_reports","pol":"https://tools.cisco.com/security/center/resources/vendor_vulnerability_policy.html","arab":0},{"s":"Tanium","n":"Tanium Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities found in Tanium products and vulnerabilities in third-party software discovered by Tanium that are not in another CNA’s scope.","adv":"https://security.tanium.com/","pol":"https://www.tanium.com/vulnerability-reporting-terms/","arab":0},{"s":"TCL_Smart_Terminal","n":"TCL Electronics Holdings Limited","co":"China","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"TCL smart TV, smart pad, and mobile phone devices only. Projects listed on <a href='https://github.com/TclSecLab/CNA/blob/main/README_EN.md' target='_blank'>https://github.com/TclSecLab/CNA/blob/main/README_EN.md</a>.","adv":"https://src.tcl.com/en/noticeList","pol":"https://github.com/TclSecLab/CNA/blob/main/TSRC%20Disclosure%20Policy.md","arab":0},{"s":"Tcpdump","n":"Tcpdump Group","co":"Canada","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Tcpdump and Libpcap only.","adv":"https://www.tcpdump.org/public-cve-list.txt","pol":"https://www.tcpdump.org/security.html","arab":0},{"s":"TCS-CERT","n":"TCS-CERT (Thales Cyber Solutions Customer’s CERT)","co":"Belgium","t":["CERT"],"root":"Thales Group","roles":["CNA"],"scope":"Vulnerabilities related to TCS-CERT’s customers’ environment and vulnerabilities related to research conducted by Cyber Solutions by Thales’ Intrusion and Application Security Team.","adv":"https://cds.thalesgroup.com/en/tcs-cert/advisory","pol":"https://cds.thalesgroup.com/en/tcs-cert/advisory","arab":0},{"s":"TeamViewer","n":"TeamViewer Germany GmbH","co":"Germany","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"TeamViewer and 1E issues only.","adv":"https://www.teamviewer.com/en/trust-center/security-bulletins/","pol":"https://vdp.teamviewer.com","arab":0},{"s":"TECNOMobile","n":"TECNO Mobile Limited","co":"China","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in TECNO products and services only.","adv":"https://security.tecno.com/SRC/blog","pol":"https://security.tecno.com","arab":0},{"s":"Tego_Cyber","n":"Tego Cyber, Inc.","co":"USA","t":["Vendor","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Tego Cyber issues and vulnerabilities discovered by Tego in third-party products, unless covered under the scope of another CNA.","adv":"https://tegocyber.com/security/security-advisories","pol":"https://tegocyber.com/security/vulnerability-disclosure","arab":0},{"s":"tlt_net","n":"Teltonika Networks","co":"Lithuania","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Teltonika Networks products and services only.","adv":"https://teltonika-networks.com/support/security-center","pol":"https://teltonika-networks.com/support/security-center","arab":0},{"s":"Temporal","n":"Temporal Technologies Inc.","co":"USA","t":["Hosted Service","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Temporal Technologies software.","adv":"https://docs.temporal.io/temporal-technologies-inc-security","pol":"https://docs.temporal.io/temporal-technologies-inc-security","arab":0},{"s":"tenable","n":"Tenable Network Security, Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Tenable products and third-party products it researches not covered by another CNA.","adv":"https://www.tenable.com/security","pol":"https://www.tenable.com/security/report","arab":0},{"s":"TRO","n":"Teradyne Robotics","co":"Denmark","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"All products released by Teradyne Robotics subsidiaries, Universal Robots (UR) and Mobile Industrial Robots (MiR), including both actively supported and end-of-life/end-of-service products, as well as vulnerabilities in third-party software identified by Teradyne Robotics that are outside the scope of another CNA.","adv":"https://www.universal-robots.com/articles/?filter_Applications[]=226617&filters[]=226617","pol":"https://www.universal-robots.com/articles/coordinated-disclosure/","arab":0},{"s":"THA-PSIRT","n":"Thales Group","co":"France","t":["Vendor","Researcher"],"root":"MITRE Corporation","roles":["Root","CNA"],"scope":"<strong>Root Scope:</strong> Products and technologies of subsidiaries of Thales Group.<br/><strong>CNA Scope:</strong> Thales branded products and technologies, products and technologies of subsidiaries of Thales Group, unless covered by the scope of another CNA as well as vulnerabilities in third-party software discovered by Thales Group and subsidiaries that are not in another CNA’s scope.","adv":"https://cpl.thalesgroup.com/software-monetization/security-updates","pol":"https://www.thalesgroup.com/en/global/group/psirt","arab":0},{"s":"BCNY","n":"The Browser Company of New York","co":"USA","t":["Vendor","Bug Bounty Provider"],"root":"MITRE Corporation","roles":["CNA"],"scope":"The Browser Company of New York branded products and technologies only.","adv":"https://arc.net/security/bulletins","pol":"https://www.thebrowser.company/security/cve-policy","arab":0},{"s":"HDFG","n":"The HDF Group","co":"USA","t":["Open Source"],"root":"Red Hat, Inc.","roles":["CNA"],"scope":"All HDF software including HDF5, HDF4, HSDS, HDFView.","adv":"https://github.com/HDFGroup/hdf5/security/advisories","pol":" https://github.com/HDFGroup/hdf5/security/policy","arab":0},{"s":"DHIS2","n":"The HISP Centre at the University of Oslo","co":"Norway","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Security issues in <a href='https://github.com/dhis2' target='_blank'>DHIS2</a> open source web and mobile software applications.","adv":"https://dhis2.org/security/vulnerabilities/","pol":"https://dhis2.org/security/vulnerability-policy/","arab":0},{"s":"illumos","n":"The illumos project","co":"USA","t":["Open Source"],"root":"Red Hat, Inc.","roles":["CNA"],"scope":"The illumos project’s <a href='https://code.illumos.org/plugins/gitiles/illumos-gate' target='_blank'>illumos-gate repository</a> and related downstream distributions such as <a href='https://openindiana.org' target='_blank'>OpenIndiana</a>, <a href='https://wiki.smartos.org' target='_blank'>SmartOS</a>, and <a href='https://omnios.org' target='_blank'>OmniOS</a>.","adv":"https://illumos.org/docs/security/","pol":"https://illumos.org/docs/security/","arab":0},{"s":"The_Missing_Link","n":"The Missing Link Australia (TML)","co":"Australia","t":["Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"TML vulnerability disclosure policy applies to any third-party vendor products to whom TML will assign the CVEs for vulnerabilities, if the product is not a part of another CNA scope.","adv":"https://www.themissinglink.com.au/security-advisories","pol":"https://www.themissinglink.com.au/vulnerability-disclosure-policy","arab":0},{"s":"OpenBMC","n":"The OpenBMC Project","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities related to the repositories maintained by the OpenBMC project.","adv":"https://github.com/openbmc/openbmc/issues?utf8=%E2%9C%93&q=Security+Advisory","pol":"https://github.com/openbmc/openbmc/wiki/Security-working-group","arab":0},{"s":"OpenNMS","n":"The OpenNMS Group","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"OpenNMS issues only.","adv":"https://www.opennms.com/en/blog/category/blog/","pol":"https://www.opennms.com/security/","arab":0},{"s":"rust","n":"The Rust Project","co":"USA","t":["Vendor","Open Source"],"root":"Red Hat, Inc.","roles":["CNA"],"scope":"Repositories, packages, and websites maintained by the Rust Project. More details: <a href='https://www.rust-lang.org/policies/security#scope' target='_blank'>https://www.rust-lang.org/policies/security#scope</a>.","adv":"https://groups.google.com/g/rustlang-security-announcements","pol":"https://www.rust-lang.org/policies/security","arab":0},{"s":"systemd","n":"The systemd project","co":"Germany","t":["Vendor","Open Source"],"root":"Red Hat, Inc.","roles":["CNA"],"scope":"All components from the systemd project, including systemd, udev, systemd-journald, systemd-resolved, systemd-boot, systemd-stub, mkosi, and other components maintained on <a href='https://github.com/systemd' target='_blank'>https://github.com/systemd</a>.","adv":"https://github.com/systemd/systemd/security/advisories?state=published","pol":"https://github.com/systemd/systemd/security/policy","arab":0},{"s":"wikimedia-foundation","n":"The Wikimedia Foundation","co":"USA","t":["Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Any code repository hosted under <a href='https://gerrit.wikimedia.org' target='_blank'>gerrit.wikimedia.org</a>, <a href='https://gitlab.wikimedia.org' target='_blank'>gitlab.wikimedia.org</a>, or <a href='https://github.com/wikimedia' target='_blank'>github.com/wikimedia</a> that is not labeled as archived or marked as a fork of an upstream project. Please see our <a href='https://www.mediawiki.","adv":"https://gitlab.wikimedia.org/repos/security/wikimedia-cve-assignments","pol":"https://www.mediawiki.org/wiki/Reporting_security_bugs","arab":0},{"s":"ThinkstAppliedResearch","n":"Thinkst Applied Research","co":"South Africa","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Thinkst Applied Research’s products only.","adv":"https://canary.tools/security-advisories","pol":"https://help.canary.tools/hc/en-gb/articles/10895067088925","arab":0},{"s":"TianoCore","n":"TianoCore.org","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Software vulnerabilities related to the TianoCore Open Source.","adv":"https://tianocore-docs.github.io/SecurityAdvisory/draft/","pol":"https://github.com/tianocore/tianocore.github.io/wiki/Reporting-Security-Issues","arab":0},{"s":"tibco","n":"TIBCO Software Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"TIBCO issues only.","adv":"https://www.tibco.com/services/support/advisories","pol":"https://www.tibco.com/security/vulnerability-disclosure-policy","arab":0},{"s":"Tigera","n":"Tigera, Inc.","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All vulnerabilities for Calico and all of Tigera’s products only.","adv":"https://www.projectcalico.org/security-bulletins/","pol":"https://www.projectcalico.org/vulnerability-disclosure/","arab":0},{"s":"Toreon","n":"Toreon","co":"Belgium","t":["Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities discovered by or reported to Toreon that are not in another CNA’s scope.","adv":"https://www.toreon.com/news/","pol":"https://www.toreon.com/cna-disclosure-policy/","arab":0},{"s":"Toshiba","n":"Toshiba Corporation","co":"Japan","t":["Vendor"],"root":"JPCERT/CC","roles":["CNA"],"scope":"Vulnerabilities related to products and services of Toshiba Group.","adv":"https://www.global.toshiba/ww/cybersecurity/corporate/psirt.html","pol":"https://www.global.toshiba/ww/cybersecurity/corporate/psirt.html","arab":0},{"s":"TPLink","n":"TP-Link Systems Inc.","co":"USA","t":["Vendor","Hosted Service"],"root":"MITRE Corporation","roles":["CNA"],"scope":"TP-Link issues only.","adv":"https://www.tp-link.com/us/press/security-advisory/","pol":"https://www.tp-link.com/us/press/security-advisory/","arab":0},{"s":"TR-CERT","n":"TR-CERT (Computer Emergency Response Team of the Republic of Türkiye)","co":"Türkiye","t":["CERT"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerability assignment related to its vulnerability coordination role.","adv":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri","pol":"https://siberguvenlik.gov.tr/cve-bilgilendirme","arab":0},{"s":"Trellix","n":"Trellix","co":"USA","t":["Vendor","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Trellix Enterprise (formerly McAfee Enterprise and FireEye) products, as well as vulnerabilities in third-party software discovered by Trellix Advanced Research Center (Trellix ACR) that are not in another CNA’s scope.","adv":"https://supportm.trellix.com/webcenter/portal/supportportal/pages_knowledgecenter","pol":"https://kcm.trellix.com/corporate/index?page=content&id=KB95564","arab":0},{"s":"trendmicro","n":"Trend Micro, Inc.","co":"Japan","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Trend Micro <a href='https://success.trendmicro.com/solution/1105726-supported-products-trend-micro' target='_blank'>supported products</a>, including any end-of-life products.","adv":"https://success.trendmicro.com/vulnerability-response#report","pol":"https://success.trendmicro.com/vulnerability-response","arab":0},{"s":"TuranSec","n":"Turan Security","co":"Uzbekistan","t":["Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities discovered through independent research conducted by TuranSec to products and projects that are not CNAs themselves.","adv":"https://cve.turansec.uz/","pol":"https://cve.turansec.uz/disclosure","arab":0},{"s":"tuxcare","n":"Tuxcare Inc.","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in products developed, maintained, and distributed by TuxCare, including TuxCare Extended Lifecycle Support (ELS) and TuxCare SecureChain for OSS.","adv":"https://tuxcare.com/cve-tracker/","pol":"https://tuxcare.com/vulnerability-reporting/","arab":0},{"s":"twcert","n":"TWCERT/CC","co":"Taiwan","t":["CERT"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerability assignment related to its vulnerability coordination role.","adv":"https://www.twcert.org.tw/tw/lp-132-1.html","pol":"https://www.twcert.org.tw/tw/dl-365-89f30879c74a49d38509c6ccb47d2a6b.html","arab":0},{"s":"TXOne","n":"TXOne Networks, Inc.","co":"Taiwan","t":["Vendor","Researcher"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Vulnerabilities in TXOne Networks products, including end-of-life products, or third-party operational technology (OT) and industrial control systems (ICS) products, unless covered by the scope of another CNA.","adv":"https://www.txone.com/psirt/advisories/","pol":"https://www.txone.com/psirt/disclosure-policy/","arab":0},{"s":"TYPO3","n":"TYPO3 Association","co":"Switzerland","t":["Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in TYPO3 open-source products only, including TYPO3 CMS core and 3rd party extensions for TYPO3, unless covered by the scope of another CNA.","adv":"https://advisories.typo3.org/","pol":"https://typo3.org/community/teams/security/security-in-typo3","arab":0},{"s":"Ubiquiti","n":"Ubiquiti, Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in all Ubiquiti products and products of Ubiquiti subsidiaries only.","adv":"https://community.ui.com/releases?security-updates","pol":"http://ui.com/downloads/compliance/vulnerability-disclosure-policy.pdf","arab":0},{"s":"Unisoc","n":"Unisoc (Shanghai) Technologies Co., Ltd.","co":"China","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Unisoc issues only.","adv":"https://www.unisoc.com/en_us/secy/announcement","pol":"https://www.unisoc.com/en_us/secy/flawedPolicy","arab":0},{"s":"upKeeper","n":"upKeeper Solutions","co":"Sweden","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All upKeeper Solutions products, excluding end-of-life (EOL) as listed in the upKeeper Solutions End of Life Policy.","adv":"https://support.upkeeper.se/hc/en-us/articles/14170844051868-Security-Advisories","pol":"https://support.upkeeper.se/hc/en-us/articles/14123589368092-Coordinated-Vulnerability-Disclosure","arab":0},{"s":"Vaadin","n":"Vaadin Ltd.","co":"Finland","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All Vaadin products and supported open source projects hosted at <a href='https://github.com/vaadin' target='_blank'>https://github.com/vaadin</a>.","adv":"https://vaadin.com/security","pol":"https://vaadin.com/security","arab":0},{"s":"Vantive","n":"Vantive","co":"USA","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Vantive’s commercially available products only.","adv":"https://www.vantive.com/contact-support/security-updates","pol":"https://www.vantive.com/contact-support/security-updates","arab":0},{"s":"Velneo","n":"Velneo","co":"Spain","t":["Vendor"],"root":"Spanish National Cybersecurity Institute, S.A. (INCIBE)","roles":["CNA"],"scope":"Vulnerabilities in all Velneo brand products and technologies, including software components, application servers, runtime environments, development environments, and cloud services, unless they are covered by the more specific scope of another CNA.","adv":"https://velneo.es/avisos-de-seguridad/","pol":"https://velneo.es/mivelneo/politica-de-divulgacion-de-vulnerabilidades/","arab":0},{"s":"Verizon","n":"Verizon","co":"USA","t":["Vendor","Hosted Service","Open Source","Researcher"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"All Verizon products and services.","adv":"https://github.com/Verizon/cve","pol":"https://github.com/Verizon/cve","arab":0},{"s":"Vestel","n":"Vestel Electronics Industry & Trade Co.","co":"Türkiye","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vestel-owned brands and products only.","adv":"https://vestelinternational.com/security-advisories","pol":"https://vestelinternational.com/en/vulnerability-disclose-policy","arab":0},{"s":"Vivo","n":"Vivo Mobile Communication Co., Ltd.","co":"China","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vivo issues only.","adv":"https://www.vivo.com/en/activity/security-advisory","pol":"https://www.vivo.com/en/activity/security-advisory","arab":0},{"s":"vmware","n":"VMware by Broadcom","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"VMware, Spring, and Cloud Foundry issues only.","adv":"https://www.broadcom.com/support/vmware-security-advisories","pol":"https://www.broadcom.com/support/vmware-services/security-response","arab":0},{"s":"vx","n":"VotingWorks","co":"USA","t":["Vendor","Open Source"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Vulnerabilities in VotingWorks voting systems, hardware, and software.","adv":"https://github.com/votingworks/vxsuite/security/advisories","pol":"https://github.com/votingworks/vxsuite?tab=security-ov-file","arab":0},{"s":"VulDB","n":"VulDB","co":"Switzerland","t":["Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in VulDB products and vulnerabilities discovered by, or reported to, the VulDB vulnerability database that are not in another CNA’s scope.","adv":"https://vuldb.com/?cna.recent","pol":"https://vuldb.com/?doc.submission","arab":0},{"s":"VulnCheck","n":"VulnCheck","co":"USA","t":["Bug Bounty Provider","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities observed by, discovered by, or reported to VulnCheck that are not in another CNA’s scope.","adv":"https://vulncheck.com/advisories","pol":"https://vulncheck.com/vulnerability-disclosure-policy","arab":0},{"s":"VulNow","n":"VulNow","co":"Netherlands","t":["Researcher"],"root":"EU Agency for Cybersecurity (ENISA)","roles":["CNA"],"scope":"Vulnerabilities observed by, discovered by, or reported to VulNow that are not in another CNA’s scope.","adv":"https://vul.now/precve","pol":"https://vul.now/cvd","arab":0},{"s":"VULSec","n":"VULSec Labs","co":"Israel","t":["Researcher"],"root":"Red Hat, Inc.","roles":["CNA"],"scope":"Vulnerabilities discovered by, or reported to, VULSec Labs that are not in another CNA’s scope.","adv":"https://www.vulsec.org/advisories","pol":"https://www.vulsec.org/conditions/vulnerability-disclosure-policy","arab":0},{"s":"watchdog","n":"WatchDogDevelopment.com, LLC","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All WatchDog products.","adv":"https://watchdog.com/vulnerability-disclosure-policy/","pol":"https://watchdog.com/vulnerability-disclosure-policy/","arab":0},{"s":"WatchGuard","n":"WatchGuard Technologies, Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in all WatchGuard products and products of WatchGuard subsidiaries.","adv":"https://www.watchguard.com/wgrd-psirt/advisories","pol":"https://www.watchguard.com/wgrd-psirt/responsible-disclosure-policy","arab":0},{"s":"Westell","n":"Westell Technologies, Inc.","co":"USA","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"All products of Westell Technologies, Inc., including end-of-life/end-of-service products.","adv":"https://support.westell.com:446/advisories.html","pol":"https://support.westell.com:446/disclosure-policy.html","arab":0},{"s":"WDC_PSIRT","n":"Western Digital","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Western Digital products including WD, SanDisk, SanDisk Professional, G-Technology, and HGST only.","adv":"https://www.westerndigital.com/support/productsecurity","pol":"https://www.westerndigital.com/support/productsecurity/vulnerability-disclosure-policy","arab":0},{"s":"wibu","n":"WIBU-SYSTEMS AG","co":"Germany","t":["Vendor"],"root":"EU Agency for Cybersecurity (ENISA)","roles":["CNA"],"scope":"WIBU-SYSTEMS products only.","adv":"https://www.wibu.com/support/security-advisories.html","pol":"https://www.wibu.com/.well-known/WIBU-SYSTEMS_Vulnerability_Disclosure_Policy.pdf","arab":0},{"s":"WindRiver","n":"Wind River Systems Inc.","co":"USA","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"All Wind River branded products as found on <a href='https://windriver.com' target='_blank'>windriver.com</a> including vulnerabilities in natively developed or modified product incorporated components, and only product incorporated third-party components not in another CNA’s scope.","adv":"https://www.windriver.com/security/vulnerability-responses","pol":"https://www.windriver.com/psirt-policy","arab":0},{"s":"Wiz","n":"Wiz, Inc.","co":"USA","t":["Vendor","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities identified in Wiz products, and vulnerabilities discovered by, or reported to, Wiz that are not in another CNA’s scope.","adv":"https://www.wiz.io/security-advisories","pol":"https://www.wiz.io/security-disclosures","arab":0},{"s":"wolfSSL","n":"wolfSSL Inc.","co":"USA","t":["Vendor","Open Source"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Transport Layer Security (TLS) and Cryptographic issues found in wolfSSL products.","adv":"https://www.wolfssl.com/docs/security-vulnerabilities/","pol":"https://www.wolfssl.com/docs/security-vulnerabilities/","arab":0},{"s":"Wordfence","n":"Wordfence","co":"USA","t":["Vendor","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"WordPress Plugins, Themes, and Core Vulnerabilities discovered by, or reported to, the Wordfence/Defiant team.","adv":"https://www.wordfence.com/blog/category/vulnerabilities/","pol":"https://www.wordfence.com/security/","arab":0},{"s":"WPScan","n":"WPScan","co":"France","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"WordPress core, plugins, and themes.","adv":"https://wpscan.com/wordpresses","pol":"https://wpscan.com/vulnerability-disclosure-policy","arab":0},{"s":"WrenSecurity","n":"Wren Security","co":"Czech Republic","t":["Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Wren Security maintained software.","adv":"https://github.com/WrenSecurity/wrenidm/security","pol":"https://wrensecurity.org/community/disclosure.html","arab":0},{"s":"WSO2","n":"WSO2 LLC","co":"USA","t":["Vendor","Open Source","Hosted Service"],"root":"MITRE Corporation","roles":["CNA"],"scope":"WSO2 products and services scoped under Responsible Disclosure Program <a href='https://security.docs.wso2.com/en/latest/security-reporting/reward-and-acknowledgement-program/#products-services-in-scope' target='_blank'>https://security.docs.wso2.com/en/latest/security-reporting/reward-and-acknowledgement-program/#products-services-in-scope</a>.","adv":"https://security.docs.wso2.com/en/latest/security-announcements/","pol":"https://security.docs.wso2.com/en/latest/security-reporting/reward-and-acknowledgement-program/","arab":0},{"s":"XEN","n":"Xen Project","co":"UK","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"All sub-projects under Xen Project’s umbrella (see <a href='https://xenproject.org/developers/teams/' target='_blank'>Xen Project Teams</a>), except those sub-projects that have their own security response process; and the Xen components inside other projects, where Xen Project is the primary developer.","adv":"https://xenbits.xen.org/xsa/","pol":"https://xenproject.org/about/security-policy/","arab":0},{"s":"Xerox","n":"Xerox Corporation","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Xerox Corporation issues only.","adv":"https://security.business.xerox.com/en-us/documents/bulletins/","pol":"https://security.business.xerox.com/vulnerability-policy/","arab":0},{"s":"Xiaomi","n":"Xiaomi Technology Co., Ltd.","co":"China","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Xiaomi issues only.","adv":"https://trust.mi.com/misrc/bulletins","pol":"https://trust.mi.com/misrc/response","arab":0},{"s":"XONA","n":"Xona Systems","co":"USA","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"All software produced as part of the Xona Platform including the CSG (Critical System Gateway) and XCM (Xona Central Manager) and vulnerabilities discovered by or reported to Xona Systems for Xona software or its underlying Operating System or Firmware not covered by the scope of another CNA.","adv":"https://www.xonasystems.com/advisories/","pol":"https://www.xonasystems.com/product-security/","arab":0},{"s":"Xylem","n":"Xylem","co":"USA","t":["Vendor"],"root":"Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS)","roles":["CNA"],"scope":"Xylem products and technologies only.","adv":"https://www.xylem.com/en-us/about-xylem/cybersecurity/advisories?page=1&pagesize=24&categories=1324","pol":"https://www.xylem.com/en-us/about-xylem/cybersecurity/","arab":0},{"s":"yandex","n":"Yandex N.V.","co":"Russia","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Yandex issues only.","adv":"https://cloud.yandex.com/docs/overview/security-bulletins/","pol":"https://yandex.com/bugbounty/","arab":0},{"s":"YesWeHack","n":"YesWeHack","co":"France","t":["Bug Bounty Provider"],"root":"EU Agency for Cybersecurity (ENISA)","roles":["CNA"],"scope":"Vulnerabilities discovered by YesWeHack community hunters on products being tested on the platform with the permission of their owners, as part of Coordinated Vulnerability Disclosure.","adv":"https://www.yeswehack.com/product/trust-security","pol":"https://yeswehack.com/programs/yes-we-hack","arab":0},{"s":"Ygreky","n":"Ygreky SASU","co":"France","t":["Vendor","Researcher","Open Source","Bug Bounty Provider"],"root":"EU Agency for Cybersecurity (ENISA)","roles":["CNA"],"scope":"All Ygreky products and infrastructure, and vulnerabilities discovered by, or reported to, Ygreky that are not covered by the scope of another CNA.","adv":"https://ygreky.com/security-advisories/","pol":"https://ygreky.com/disclosure-policy/","arab":0},{"s":"YokogawaGroup","n":"Yokogawa Group","co":"Japan","t":["Vendor"],"root":"JPCERT/CC","roles":["CNA"],"scope":"Yokogawa Group companies’ products and Yokogawa Group subsidiaries’ products.","adv":"https://www.yokogawa.com/library/resources/white-papers/yokogawa-security-advisory-report-list/","pol":"https://www.yokogawa.com/solutions/products-and-services/announcements/vulpolicy/","arab":0},{"s":"Yugabyte","n":"Yugabyte, Inc.","co":"USA","t":["Hosted Service","Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Yugabyte products only.","adv":"https://docs.yugabyte.com/latest/secure/vulnerability-disclosure-policy/#security-tracker-cve-list","pol":"https://docs.yugabyte.com/latest/secure/vulnerability-disclosure-policy/","arab":0},{"s":"Zabbix","n":"Zabbix","co":"Latvia","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Zabbix products and Zabbix projects listed on <a href='https://git.zabbix.com/' target='_blank'>https://git.zabbix.com/</a> only.","adv":"https://support.zabbix.com/projects/ZBX/issues/","pol":"https://www.zabbix.com/zabbix_security_policy","arab":0},{"s":"Zenitel","n":"Zenitel Norway AS","co":"Norway","t":["Vendor"],"root":"EU Agency for Cybersecurity (ENISA)","roles":["CNA"],"scope":"Zenitel products only.","adv":"https://zenitel.com/security/security-advisories","pol":"https://zenitel.com/security/vulnerability-disclosure","arab":0},{"s":"zephyr","n":"Zephyr Project","co":"USA","t":["Vendor","Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Zephyr project components, and vulnerabilities that are not in another CNA’s scope.","adv":"https://docs.zephyrproject.org/latest/security/vulnerabilities.html","pol":"https://docs.zephyrproject.org/latest/security/security-overview.html#security-vulnerability-reporting","arab":0},{"s":"zdi","n":"Zero Day Initiative","co":"Japan","t":["Bug Bounty Provider","Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Products and projects covered by its bug bounty programs that are not in another CNA’s scope.","adv":"https://www.zerodayinitiative.com/advisories/published/","pol":"https://www.zerodayinitiative.com/advisories/disclosure_policy/","arab":0},{"s":"ZGR","n":"ZGR","co":"Spain","t":["Vendor"],"root":"Spanish National Cybersecurity Institute, S.A. (INCIBE)","roles":["CNA"],"scope":"ZGR manufactured products.","adv":"https://www.zigor.com/list-of-vulnerabilities/","pol":"https://www.zigor.com/vulnerability-disclosure-policy/","arab":0},{"s":"Uniview","n":"Zhejiang Uniview Technologies Co., Ltd.","co":"China","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Uniview products only.","adv":"https://global.uniview.com/About_Us/Security/Notice/","pol":"https://global.uniview.com/About_Us/Security/Process/","arab":0},{"s":"Zohocorp","n":"Zohocorp","co":"India","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"ManageEngine, Zoho, and Zakya branded on-premise products only.","adv":"https://www.manageengine.com/security/advisory/","pol":"https://bugbounty.zohocorp.com/bb/info","arab":0},{"s":"Zoom","n":"Zoom Communications, Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Zoom and Keybase issues only.","adv":"https://zoom.us/trust/security/security-bulletin","pol":"https://zoom.us/docs/en-us/trust/vulnerability-disclosure.html","arab":0},{"s":"Zowe","n":"Zowe","co":"USA","t":["Open Source"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in <a href='https://zowe.org' target='_blank'>Zowe.org</a> open source projects.","adv":"https://github.com/zowe/community/security/advisories","pol":"https://zowe.org/security.html","arab":0},{"s":"Zscaler","n":"Zscaler, Inc.","co":"USA","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Zscaler issues only.","adv":"https://trust.zscaler.com/security-advisories","pol":"https://www.zscaler.com/company/vulnerability-disclosure-program","arab":0},{"s":"ZTE","n":"ZTE Corporation","co":"China","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"<a href='https://www.zte.com.cn/global/products' target='_blank'>ZTE products</a> only.","adv":"http://support.zte.com.cn/support/news/NewsMain.aspx","pol":"https://www.zte.com.cn/global/cybersecurity/ztepsirt/bug-bounty/products.html","arab":0},{"s":"ZUSO_ART","n":"ZUSO Advanced Research Team (ZUSO ART)","co":"Taiwan","t":["Researcher"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Vulnerabilities in third-party products discovered by ZUSO ART that are not in another CNA’s scope.","adv":"https://zuso.ai/Advisory.html","pol":"https://zuso.ai/Policy.html","arab":0},{"s":"Zyxel","n":"Zyxel Corporation","co":"Taiwan","t":["Vendor"],"root":"MITRE Corporation","roles":["CNA"],"scope":"Zyxel products issues only.","adv":"https://www.zyxel.com/support/security_advisories.shtml","pol":"https://www.zyxel.com/support/security_advisories.shtml","arab":0}]