A list of all awesome CVELabs
An awesome CVELabs is an independent team that:
- Finds vulnerabilities without profiting economically (excludes bounty programs)
- Is not a hub CNA (like Zero Day Initiative)
- Is not a vendor CNAs (vendors that index CVEs of his own products)
- Researchers that found CVEs work on the team
- Quantity: Claroty Team82
- Productivity: Fluid Attacks
- Activity (opposite to Inactivity, with the most recent "Last" parameter): watchTowr
- Diversity (opposite to Concentration, with the oldest "First" parameter): SEC Consult
- Oldest: SEC Consult
- Fertility: Assetnote
- (A)dvisories: Total Advisories
- (Q)uantity: Total CVEs
- (M)onths: Last CVE - First CVE
- (P)roductivity: Total CVE / Months (CVE per month)
- (V)endors: Unique vendors over CVE
- (C)oncentration: Total CVE / Vendors (CVE per vendor)
- (I)nactivity: Today - Last CVE (months since last CVE)
- (R)esearchers: Unique researchers over CVE
- (F)ertility: Total CVE / Researchers
Descendent order according to CVE column:
| # | Lab | A | Q | First | Last | M | P | V | C | I | R | F |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | Claroty Team82 | 740 | 765 | - | - | - | - | - | - | - | - | - |
| 2 | SEC Consult | 248 | 557 | 00/01/01 | 26/02/11 | 313 | 1.8 | - | - | 2 | - | - |
| 3 | Nozomi Networks | 137 | 444 | - | - | - | - | - | - | - | - | - |
| 4 | Tenable Research | 191 | 248 | - | - | - | - | - | - | - | - | - |
| 5 | Source Incite | 255 | 247 | 24/01/15 | 24/01/15 | 0 | - | 31 | 8.0 | 27 | 10 | 24.7 |
| 6 | Positive Technologies | 230 | 230 | - | - | - | - | - | - | - | - | - |
| 7 | Google Project Zero | 39 | 188 | 15/07/31 | 25/12/12 | 125 | 1.5 | - | - | 4 | - | - |
| 8 | Fluid Attacks | 180 | 180 | 22/01/09 | 26/03/24 | 50 | 3.6 | 37 | 4.9 | 1 | 18 | 10.0 |
| 9 | JFrog Security Research | 173 | 176 | 19/02/06 | 26/02/09 | 84 | 2.1 | 88 | 2.0 | 2 | 25 | 7.0 |
| 10 | watchTowr | 85 | 158 | 22/07/01 | 26/04/02 | 45 | 3.5 | 33 | 4.8 | 0 | 9 | 17.6 |
| 11 | Star Labs SG | 142 | 145 | 18/11/27 | 24/07/31 | 68 | 2.1 | 15 | 9.7 | 21 | 29 | 5.0 |
| 12 | Mandiant | 134 | 144 | - | - | - | - | 43 | 3.3 | - | 33 | 4.4 |
| 13 | NCC Group | 54 | 134 | 10/12/21 | 25/02/25 | 170 | 0.8 | - | - | 14 | 23 | 5.8 |
| 14 | Trustwave SpiderLabs | 108 | 123 | - | - | - | - | - | - | - | - | - |
| 15 | CyberArk Labs | 119 | 119 | - | - | - | - | 54 | 2.2 | - | 21 | 5.7 |
| 16 | Bishop Fox | 38 | 113 | 20/02/15 | 23/11/06 | 45 | 2.5 | - | - | 29 | 14 | 8.1 |
| 17 | Horizon3 | 50 | 77 | 26/04/01 | 26/04/01 | 0 | - | 22 | 3.5 | 0 | - | - |
| 18 | Qualys | 69 | 69 | - | - | - | - | - | - | - | - | - |
| 19 | Integrity Labs | 72 | 68 | 13/07/09 | 25/09/22 | 146 | 0.5 | 48 | 1.4 | 7 | 10 | 6.8 |
| 20 | Orange Cyberdefense | 65 | 65 | - | - | - | - | - | - | - | 25 | 2.6 |
| 21 | SafeBreach Labs | 56 | 56 | 19/06/08 | 26/01/26 | 79 | 0.7 | - | - | 3 | - | - |
| 22 | Synacktiv | 64 | 50 | 22/11/28 | 25/06/26 | 31 | 1.6 | 29 | 1.7 | 10 | 27 | 1.9 |
| 23 | Census Labs | 19 | 31 | 09/07/02 | 23/03/16 | 164 | 0.2 | 11 | 2.8 | 37 | 10 | 3.1 |
| 24 | Assetnote | 20 | 27 | 22/06/09 | 25/03/24 | 33 | 0.8 | 13 | 2.1 | 13 | 1 | 27.0 |
| 25 | Portcullis Labs | 20 | 25 | - | - | - | - | - | - | - | - | - |
| 26 | IOActive | 18 | 24 | - | - | - | - | 2 | 12.0 | - | 11 | 2.2 |
| 27 | VulnCheck | 20 | 20 | - | - | - | - | - | - | - | - | - |
| 28 | Flashback | 7 | 15 | 20/06/18 | 23/02/02 | 32 | 0.5 | - | - | 38 | 1 | 15.0 |
| 29 | Patchstack | 8 | 9 | - | - | - | - | - | - | - | - | - |
| 30 | SentinelOne | 9 | 9 | 20/06/17 | 22/02/03 | 20 | 0.5 | - | - | 50 | 9 | 1.0 |
| 31 | WithSecure Labs | 4 | 5 | 22/01/10 | 23/06/08 | 17 | 0.3 | - | - | 34 | - | - |
| 32 | Securitum | 4 | 4 | - | - | - | - | - | - | - | - | - |
| 33 | Wiz Research | 1 | 1 | 26/03/13 | 26/03/13 | 0 | - | - | - | 1 | - | - |
- (-) Not applicable: data not available for this lab (anti-bot, SSO-protected, or structurally inaccessible)
- ( ) Blank space: metric cannot be computed (M=0 or missing dates)
The following labs are included in the list but could not be scraped. Their data is unavailable:
| Lab | URL | Cause |
|---|---|---|
| FortiGuard (Fortinet) | fortiguard.com/psirt | Heavy anti-bot SPA — advisory content is loaded via authenticated AJAX calls; headless browser is fingerprinted and blocked |
| Core Security | coresecurity.com/core-labs/advisories | Returns HTTP 403 on all advisory pages; anti-bot protection blocks automated access |
| Core Security Core Labs | coresecurity.com/core-labs/advisories | Same as above — duplicate entry pointing to the same blocked endpoint |
| VerSprite | versprite.com/advisories | WordPress REST API is accessible but advisory posts contain no CVE IDs in their content — CVE data is not embedded in the public posts |
- https://www.3ds.com/vulnerability/advisories: Credits to researchers outside of the organization / NOT_A_LAB_IS_AN_INDEX
- https://www.trellix.com/: The data is not structured correctly / UNSTRUCTURED_DATA