Every number on this site, and where it came from

Every figure quoted on this site is fetched from the system that owns it, on a half-hourly timer, and stored with the URL it came from. Nothing below is typed in by hand, and nothing is counted by this site about itself.

That is a deliberate correction rather than a flourish. Until August 2026 these pages said 48 published advisories and 13 CVEs, in five places at once, because the figures were prose and prose does not update itself. The public record said 42 and 20. A claim a reader can check and find wrong is worth less than no claim at all, so the numbers moved here and the prose now quotes them.

Where each one comes from

The Postiz records come from the GCVE dump for Numbering Authority 125, at the endpoint the GCVE registry itself lists for that authority. Each entry is a full CVE Record Format 5.1 document, so severity, weakness class and CVE assignment are read off the record rather than off a page describing it. Where a record carries both a CVSS 3.1 and a 4.0 vector, the 4.0 one is counted, on the grounds that it is the later opinion.

The totals across both programmes come from the advisory listing on gadvisory.org, counted from the sitemap that platform publishes for machines.

The programme identifiers are checked against the registries rather than quoted from memory. Postiz is CNA-2026-0055, one of 563 CVE Numbering Authorities, with MITRE Corporation as its Top-Level Root. It is also GCVE Numbering Authority 125, one of 46 in that registry.

The contribution figures come from the GitHub contributor graph for each repository the projects page links to. The list is not maintained here: adding a project with a repository URL starts its counters on the next run.

What the conformance line means

GCVE publishes a set of best current practice documents, and BCP-06 is the one covering how a numbering authority should govern itself. GNA 125 publishes a machine-readable self-assessment against it, at a fixed URL, stating the disclosure model, whether allocation is automated, and how long a report waits for its first review. The answer to that last one is 7 days and it is published rather than promised in an email.

BCP-07 covers known-exploited vulnerabilities. GNA 125 publishes that feed too. It currently has 0 entries, which is the good answer.

When a source fails

A source that does not answer leaves its figures exactly as they were. It never blanks them and never writes a zero, because a zero is what a broken parse looks like and a stale number is easier to notice than a confident wrong one. The status line at the top of this page says how many sources answered on the last run, and the page says so plainly when the whole thing has gone stale.