Advisories for open-source maintainers and consumers: disclosure floods, patch backlogs and AI-generated reports.
Two CVSS 10 regex flaws give unauthenticated code execution on self-managed GitLab; one is exploited. Upgrade to 19.5.1, 19.4.3, 19.3.6 or a 21 Oct backport.
Of 6,157 Glasswing vulnerabilities disclosed to open-source maintainers, about 8% were patched by October 2026. Expect a long tail of dependency fixes.
A predictable session key in HFS 3.0.0 to 3.2.0, found with Claude Mythos, lets attackers forge an admin login and run code. Update to 3.2.1 or later.
Since 15 April 2026 NIST no longer adds severity scores or product data to most new CVEs. Tools that match on NVD data miss or misjudge risk.
curl closed its HackerOne bug bounty on 31 January 2026 to stop paying for invented AI reports. How maintainers can filter the flood without missing real bugs.
