Open-source vulnerability disclosure

What we find, and get fixed, across open-source software.

Mettle is an AI research lab focused on cybersecurity. This page tracks the vulnerabilities we report to open-source projects, from first report to public advisory.

: public in coordinated disclosure

Disclosure pipeline

Reported findings move through coordinated disclosure to a public advisory or fix. Stages are drawn to scale.

By severity

By ecosystem

Published findings

These findings have a public record. Each one links to its advisory, issue or bug report.

Severity

Published findings: project, severity, issue and public reference
Project	Severity	Issue	Reference
		(variant)	(opens in a new tab)

No findings are public yet. Each appears here once its fix is merged upstream or an advisory is published — and the public reference is verified.