Details for private reports will be disclosed after vendor confirmation, public advisory, or explicit permission from the vendor.
Entries are based on manual verification and vendor-visible artifacts.
Started from 4 May.
Last updated: 2026-11-07.
| CVE-2026-54010 | CVE-2026-64192 | CVE-2026-86958 |
|---|---|---|
| CVE-2026-116483 | CVE-2026-117386 | CVE-2026-118594 |
| Project | Count | Status |
|---|---|---|
| NGINX | 1 | commit |
| Bun | 1 | bun#30621 |
| Chrome PDFium | 1 | commit |
| OpenClaw | 1 | GHSA |
| DuckDB | 3 | #22663 #22660 PR #23100 |
| VLC media | 1 | #29884 |
| openbao | 1 | #3235 |
| canonical-workshop | 1 | GHSA accepted PR #929 |
| Protobuf | 1 | commit; Google OSS VRP tracking |
| git | 1 | PATCH |
| Cloudflare | 1 | HackerOne Bounty award |
| ClickHouse | 3 | BugCrowd |
| SUM | 16 |
| Vendor / Project | Count | Notes |
|---|---|---|
| Bun | 5 | Several hardening fixes observed; credit/status unclear |
| QEMU | 1 | triage in progress |
| Windows | 2 | MSRC |
| gitea | 1 | GHSA |
| Apple macOS | 2 | Safari, Side channel |
| SUM | 11 |
There are many duplicated reports so I gave up to track them.