Yes — it comes from the source named on this page and is refreshed on a schedule.

No. This source is fully key-less.

Yes, and it runs entirely in your browser.

What does a CNA of last resort do?

It can assign CVE identifiers and publish records for vulnerabilities that no other CNA’s scope covers, working within the authority of the Root that sponsors it.

What does a CNA’s scope mean?

It defines the products or situations for which that organisation may assign CVE identifiers; outside it, reports go to another CNA.

Does having a CNA mean a vendor is secure?

No. It means the vendor can assign identifiers for its own flaws, and says nothing about how many flaws exist or how fast they are fixed.

Who Can Name A Flaw Screensaver

The Who Can Name A Flaw screensaver shows the organisations authorised to assign CVE numbers, key-less. It’s free, runs in your browser, and ESC exits.

How the Who Can Name A Flaw screensaver works

The saver reads the source described above and draws it on a canvas — no account, no tracking.

The organisations authorised to assign CVE numbers, key-less. Identifiers do not come from a central desk — the CVE Program delegates the right to vendors, national CERTs and bounty platforms, each only within a declared scope.

It refreshes on a schedule, so what you see stays current.

Colours and any options can be changed in settings; nothing is stored beyond your own browser.

How CVE Numbering Authorities fit together

The CVE Program gives each publicly known security vulnerability a unique identifier such as CVE-2026-12345. MITRE serves as the program’s Secretariat, handling administrative support and infrastructure, but the numbering itself is spread out: many organisations act as CVE Numbering Authorities, or CNAs, and each can assign numbers for flaws in its own territory.

A CNA’s territory is its declared scope. A software vendor may cover only its own products, a national CERT may cover vulnerabilities found within its country, a bug bounty platform may cover issues reported through it, and open-source projects may take care of their own code. Top-Level Roots report directly to the CVE Board and each oversees its own hierarchy of CNAs, which includes a CNA of last resort (CNA-LR) that can assign identifiers for vulnerabilities no other CNA’s scope covers.

The list shows recently added authorities together with their country and scope text, plus a count by country. Being a CNA is permission to assign identifiers within a scope, not a mark of product quality or of the speed at which a company fixes issues.

A worked example

Settings & tips

Accent and Background recolour the display.
Every value on screen comes from the live source — nothing is simulated.
Press ESC to leave fullscreen.

Frequently asked questions

Is this real data?: Yes — it comes from the source named on this page and is refreshed on a schedule.
Is a key needed?: No. This source is fully key-less.
Is it free?: Yes, and it runs entirely in your browser.
What does a CNA of last resort do?: It can assign CVE identifiers and publish records for vulnerabilities that no other CNA’s scope covers, working within the authority of the Root that sponsors it.
What does a CNA’s scope mean?: It defines the products or situations for which that organisation may assign CVE identifiers; outside it, reports go to another CNA.
Does having a CNA mean a vendor is secure?: No. It means the vendor can assign identifiers for its own flaws, and says nothing about how many flaws exist or how fast they are fixed.

← All Security & Privacy screensavers