Flock Safety has been authorized as a Common Vulnerabilities and Exposures Numbering Authority, giving the public-safety technology company a formal role in identifying and disclosing security flaws in its own products.
The designation was announced on October 6, 2026, and published by the CVE Program on October 6 and October 7.
It allows Flock Safety to assign CVE identifiers and publish related records for vulnerabilities affecting Flock-branded hardware and software.
Table of Contents
What the Flock Safety designation means
A CVE identifier is a standardized reference number used by security professionals, technology companies and public agencies to discuss a specific vulnerability.
Organizations authorized as CVE Numbering Authorities can assess eligible reports within a defined product scope, reserve CVE identifiers and publish vulnerability records in the official CVE catalogue.
Flock Safety’s approved scope is limited to its own branded hardware and software products, according to the CVE Program’s announcement.
The company said the new status gives it a direct process for working with independent security researchers instead of relying on an outside organization to request identifiers on its behalf.
Flock Safety said the arrangement is intended to help coordinate disclosure timelines, recognize researchers who report valid findings and reduce the risk of duplicate or conflicting vulnerability records.
Why vulnerability disclosure matters for public safety technology
Flock Safety sells technology used by communities, law-enforcement agencies and private organizations, including automated license plate reader systems and other connected security products.
Because these systems can collect, transmit or process information used in investigations, security weaknesses can create operational and privacy risks even when there is no evidence that a particular flaw has been exploited.
A standardized CVE record can help customers determine which product or software version is affected, understand the potential impact and identify available patches or mitigations.
The National Vulnerability Database explains that CVE records are published first through the CVE Program, after which the database may add information such as severity scores, weakness classifications and affected product data.
Flock Safety had already changed its security process
The company’s new CNA status follows a series of security-related updates from Flock Safety in 2026.
Flock Safety said in September that an independent security firm had completed testing of its platform and that critical and high-severity findings identified during the assessment had been fixed and independently retested, according to its security testing update.
The company also maintains a public security-advisories page describing how it plans to disclose vulnerabilities after a fix or mitigation is available.
That policy says future advisories are expected to identify the affected product or firmware, explain what an attacker could do, provide a severity assessment and include the assigned CVE identifier where applicable.
As of the page’s latest update on September 15, 2026, Flock Safety said it had not yet published an advisory under that policy.
What happens when a vulnerability is reported
Under the company’s stated process, a researcher can report a suspected security issue directly to Flock Safety.
The company then evaluates the report, works toward a fix or mitigation and coordinates disclosure with the researcher where possible.
If the issue falls within Flock Safety’s CNA scope and qualifies for a CVE record, the company can assign the identifier and publish the record itself.
That process does not mean every report will become a CVE, nor does receiving a CVE identifier by itself indicate how severe a vulnerability is.
The identifier is primarily a common reference point that allows defenders, customers and researchers to track the issue across security tools and databases.
What customers and researchers should watch next
The practical test of Flock Safety’s new status will be how consistently it publishes detailed, timely and technically useful records.
Customers will likely look for clear information about affected versions, remediation steps, severity and whether any action is required on deployed cameras or connected systems.
Researchers, meanwhile, will be watching how the company handles credit, disclosure deadlines and disagreements about the scope or seriousness of reported issues.
Flock Safety said its security advisories will be available through its website, while the CVE Program identified the company as the 291st CNA from the United States.
For Canadian organizations evaluating public-safety or automated license plate reader technology, the development is a reminder to ask vendors how vulnerabilities are reported, how quickly fixes are issued and whether security records are made publicly accessible.
Frequently Asked Questions
What is Flock Safety’s new cybersecurity designation?
Flock Safety has been authorized as a CVE Numbering Authority, allowing it to assign CVE identifiers and publish vulnerability records for its own branded hardware and software.
What is a CVE identifier?
A CVE identifier is a standardized reference used to identify and discuss a specific cybersecurity vulnerability across vendors, databases and security tools.
Does the designation mean Flock Safety has disclosed a new vulnerability?
No. The designation gives Flock Safety authority to publish future vulnerability records, but the announcement itself does not identify a new security flaw.
What products are covered by Flock Safety’s CNA scope?
The approved scope covers Flock-branded hardware and software products.
Where can customers find Flock Safety security information?
Flock Safety says security advisories and vulnerability-reporting information are available through its public security-advisories page.
Fact-Checked: Key facts were checked against the CVE Program announcement, Flock Safety’s official statement and its published security-advisory information.
Disclaimer: Organizations using Flock Safety products should consult the company’s official advisories and their own security teams for product-specific guidance.