[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f_W-r8y7lUpPx9CbEzSQGSlRSDdGLpvbJifctA2MalUQ":3},{"article":4,"iocs":51,"watch_terms":52,"solutions":53,"lesson":56},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"4d1dc4de-f4a1-4698-b56e-ab6c1a65be58","Flock can now issue CVEs for its own products. Should we trust it?","flock-can-now-issue-cves-for-its-own-products-should-we-trust-it-99cdae","Flock joined the CVE Program as a CNA, giving the company authority to assign IDs to vulnerabilities in its own surveillance cameras and license plate readers. The post Flock can now issue CVEs for its own products. Should we trust it? appeared first on CyberScoop.","Flock, a company known for its controversial surveillance cameras and license plate readers, has become a CVE Numbering Authority (CNA). This allows them to assign CVE IDs to vulnerabilities in their own products. While many vendors are granted CNA status, Flock's history of privacy concerns and alleged law enforcement misuse of its technology raises questions about its credibility in assessing and disclosing its own security flaws.","Flock gains CVE Numbering Authority for its surveillance products, raising trust concerns.","https:\u002F\u002Fcyberscoop.com\u002Fflock-cve-numbering-authority-cna\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2026\u002F10\u002FGettyImages-2295963998.jpg","2026-10-12T22:11:50+00:00","2026-10-13T00:00:15.776311+00:00",7,[17,20,22,25],{"name":18,"type":19},"automated license plate readers","product",{"name":21,"type":19},"AI-powered cameras",{"name":23,"type":24},"Flock","vendor",{"name":26,"type":27},"CVE","technology","02371804-cf6d-4449-98de-f1a2d4d9b266",{"id":28,"icon":30,"name":31,"slug":32},null,"Tools","tools",[34,36,41,46],{"category":35},{"id":28,"icon":30,"name":31,"slug":32},{"category":37},{"id":38,"icon":30,"name":39,"slug":40},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[23,18,21],{"controls":54,"vendors":55},[],[],{"slug":57,"title":58,"body":59,"framework_refs":60,"framework_notes":72},"flock-safety-becomes-cna-can-vendors-self-police-their-own-vulnerabilities","Flock Safety Becomes CNA: Can Vendors Self-Police Their Own Vulnerabilities?","Flock Safety, a surveillance technology vendor with documented privacy controversies, has been granted CNA (CVE Numbering Authority) status, allowing it to self-assign and control the disclosure narrative around vulnerabilities in its own products. While CNA status is common among large vendors, the credibility of self-disclosure hinges entirely on organizational transparency, integrity, and accountability — qualities that critics argue Flock has not consistently demonstrated. When a vendor with a contested track record controls its own vulnerability pipeline, there is inherent risk that disclosures may be delayed, minimized, or framed favorably. This matters significantly because Flock's cameras and license plate readers are deeply embedded in law enforcement infrastructure, meaning security flaws could have serious public safety and civil liberties implications. Organizations relying on Flock technology must not passively trust vendor-issued CVEs as complete or timely, and should maintain independent verification processes.",[61,62,63,64,65,66,67,68,69,70,71],"CIS Control 7: Continuous Vulnerability Management","CIS Control 15: Service Provider Management","NIST SP 800-161: Supply Chain Risk Management","NIST CSF ID.RA-1: Asset vulnerabilities are identified and documented","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST SP 800-53 SA-9: External System Services","ISO\u002FIEC 29147: Vulnerability Disclosure","ISO\u002FIEC 30111: Vulnerability Handling Processes","GDPR Article 32: Security of Processing (where EU data subjects captured by surveillance)","CISA Known Exploited Vulnerabilities (KEV) Catalog cross-referencing","MITRE CNA Rules of Engagement v3.0",{}]