Insights

GNA scorecard

How well each GCVE Numbering Authority fills the records it publishes, scored against a published set of rules: Describe, Scope, Assess, Act, 25 points each. Only what the assigner wrote itself counts; severity and weaknesses added later by an ADP are shown as a dependency, not as the assigner's work.

2
Ranked GNAs
2
Under the threshold
180 days
Rolling window
0
Grade A
Prepared 2026-09-30T19:10:08+00:00 by Vulnerability-Lookup v6.2.1-115-g136b9f0e Methodology v1 since 2026-09-29 Ranked from 10 publications in the window API
# GNA Grade Score Records Badge
1 CIRCLGNA-1 B 88.83 226
2 VULNARCHIVEGNA-1988 E 37.84 387
Under the threshold (2)

Fewer than 10 publications in the window. The score is indicative and these are not ranked: three perfect records are not evidence of a practice.

bcsecGNA-128 84.8 1 record
AHA!GNA-1337 71.25 4 records

The ranked GNAs graded A over the window: a mean score of 90 or more across their publications.

No ranked GNA reaches grade A in the window.

Named practices with an objective threshold, over the window, among the ranked GNAs. A listing names what to change; the bottom of a ranking does not.

No severity statement on any record of the window 1
The rules Each record earns a credit in 0..1 per rule; the record's score is the weighted sum, the assigner's is the mean.

Describe: can a reader tell what the vulnerability is? (25 points)

  • Description (10): An English description that is not a placeholder: full credit from 200 characters, 0.7 from 80, 0.4 from 40, none below.
  • Title (5): A title.
  • Cwe (10): A weakness as a CWE identifier in problemTypes; a free-text problem type without one earns a quarter.

Scope: can a reader tell whether they are affected? (25 points)

  • Affected (10): An affected entry naming both a vendor and a product; one side missing or 'n/a' earns half.
  • Versions (8): An affected entry stating versions, as a version or a bound; a defaultStatus alone earns half.
  • Cpe (7): A CPE on an affected entry, or a cpeApplicability block.

Assess: can a reader tell how bad it is? (25 points)

  • Severity (15): A severity statement in the CNA container: a CVSS v3 or v4 vector, an SSVC decision, or a vendor rating as an 'other' metric. A CVSS v2 vector alone earns half.
  • Modern severity (5): A CVSS v4 vector or an SSVC decision.
  • Impacts (5): An impacts entry (a CAPEC identifier or an impact description).

Act: can a reader tell what to do about it? (25 points)

  • References (7): At least one reference.
  • Reference tags (5): At least one reference carrying tags.
  • Remediation (8): A reference tagged 'patch'; one tagged 'vendor-advisory', 'mitigation' or 'release-notes' earns 0.6.
  • Solutions (5): A solution or a workaround.

Grades: A from 90, B from 75, C from 60, D from 45, E from 0. Timeliness is displayed on each assigner's page and never scored: a long reservation-to-publication delay is a disclosure embargo as often as a backlog. The full text, with the methodology history, is in the documentation.