All articles

September 2026 Source Audit: 845 Public CVEs After Attribution Review

A primary-source review splits Anthropic's mixed-model campaign, moves seven unsupported rows to pending, and adds 13 validated CVEs plus seven accepted no-CVE issues.

The September audit brings Bugflation to 175 grouped finding pages, 845 unique CVE IDs, and 40 system profiles. Relative to the August 19 ledger, it adds 40 pages and five profiles. Thirty-five new pages carry CVEs; five cover accepted work without CVE assignments. One CVE-backed page also contains an accepted no-CVE issue.

The net increase from the August ledger is 328 unique CVEs: 329 introductions and the documented removal of withdrawn Nomad CVE-2026-7474. The source-level reconciliation is:

• 40 net CVEs from Anthropic’s Project Glasswing update;
• 87 AISLE CVEs across the registry waves and eight upstream-verified backfills;
• 152 net-new Nebu CVEs after removing two unsupported QuickJS rows and deduplicating CVE-2026-43074;
• 12 exact September MSRC credits;
• one June Microsoft Teams CVE mapped by Enclave’s August write-up;
• two Chrome 153 credits;
• 26 Apple CVEs added or amended in its security pages;
• three Xint Android CVEs unembargoed on August 25;
• three Bynario-assisted Linux CVEs;
• one Claude-credited NSD CVE; and
• one GitHub Security Lab Jupyter CVE.

This breakdown is about global identifiers. A CVE can credit several systems without being counted more than once.

Review changed attribution, not only arithmetic

A follow-up source review found that the September update’s aggregate counts were reproducible but several semantic labels were too broad. The correction therefore rechecked individual model labels, upstream acceptance, security impact, product names, and vendor severity instead of treating a successful tracker reconciliation as the end of the audit.

The content schema now records an optional AI role: discovery, analysis, review, triage, repair, mixed, or unspecified. Evidence dates can identify a disclosure, latest disclosure in a cluster, attribution publication, or source snapshot, and grouped entries can publish a coverage interval. The visible ledger uses the neutral heading Evidence date where rows can mix those date types.

Anthropic’s 89 rows span five attribution groups

Anthropic’s CVD dashboard reports a large disclosure pipeline. Bugflation filters the machine-readable ledger for rows that are revealed, fixed, patched, vendor-confirmed, and backed by a CVE or GHSA. Eighty-nine rows pass: 75 are CVE-backed and 14 are GHSA-only. They reduce to 80 unique CVEs and 68 unique GHSAs across 56 projects.

The earlier version assigned all 89 rows to Claude Mythos Preview. The individual cards instead divide as follows:

The campaign is now split into those exact subsets. The eleven unlabeled cards remain at the broad Claude / Anthropic Research program level. An independent source can still support a more specific credit on a separate entry; it is not used to infer the model on the rest of the group.

Apple’s CVE-2026-28984 also moves from Mythos to broad, model-unspecified Anthropic CVD credit. Apple confirms the vulnerability and program credit, but the cited Anthropic ledger contains no row for that CVE. The previous claim that its Mythos row merely failed the strict state filter was unsupported.

Nebu’s accepted subset is 153 CVEs

NebuSec’s bug list exposes 1,178 rows. The accepted subset now contains 127 fixed Linux CVEs, six fixed browser CVEs, and 20 fixed cross-project CVEs. Three browser identifiers are Firefox records and three are Chromium records.

That produces 153 CVEs attributed to Nebu. CVE-2026-43074 overlaps the Anthropic campaign, so Nebu contributes 152 new identifiers to the global total. The audit excludes 996 Linux rows marked Fixing and 22 redacted Netcore rows marked Reserved.

Two QuickJS tracker rows, CVE-2026-36156 and CVE-2026-36157, are no longer counted. Neither had a public CVE record, upstream fix, or project advisory at the cutoff. This is a pending-evidence classification, not a claim that the underlying reports are false. Five no-CVE Chromium issue rows also move to pending because acceptance was not independently established from all issue bodies. The two unpublished HotCRP identifiers remain accepted because project GHSAs independently establish their vulnerabilities and exact CVE mappings.

Thirteen additional CVEs pass primary-source review

The follow-up adds thirteen identifiers that were absent from the previous corpus:

• Bynario AI assistance on Linux NFC CVE-2026-80794 and CVE-2026-80795, plus Bluetooth CVE-2026-64433. The accepted patches carry explicit Assisted-by: Bynario AI trailers; the entries do not convert assistance into a claim of autonomous discovery.
• NSD CVE-2026-18664, where NLnet Labs directly thanks Qifan Zhang, Claude, and Ada Logics for an ACL endianness flaw fixed in NSD 4.15.1.
• Jupyter maintainer-tools CVE-2026-84973, backed by a high-severity project GHSA and included in GitHub Security Lab’s official AI-agent index. The particular agent remains unspecified.
• Eight AISLE backfills across libgit2, AWS-LC, Bouncy Castle, GnuTLS, OpenSSL, and PostgreSQL. Each was reconciled against an affected-project or CNA source.

Vendor severity controls those AISLE entries. GnuTLS is high rather than the registry’s critical score; PostgreSQL CVE-2026-6638 is low at 3.7; and the two OpenSSL issues are moderate and low. The GLib2/GIO record CVE-2026-86469 is also corrected so it is no longer mislabeled as GNU glibc.

Seven accepted issues currently have no CVE

Five FreeRDP project advisories directly name BynarIO Atlas and document an automated identification and validation pipeline followed by manual review. They cover a critical transport-policy bypass, two high-severity memory or pointer-lifetime flaws, and two moderate disclosure or bounds issues. All are fixed in FreeRDP 3.31.0.

GitHub Security Lab adds two more accepted no-CVE findings. GHSL-2026-199 covers privileged workflow execution in DataDog’s Trivy fork and is kept under the system-unspecified AI-agent profile. A graphql-ruby authorization bypass directly names Taskflow Agent, records manual verification, and is fixed in 2.6.6.

The earlier no-CVE Linux groups were tightened too. The Gemini page now keeps three commits with concrete out-of-bounds, lifetime, or NULL-dereference impact and syzbot evidence; four warning or correctness fixes no longer appear as security findings. The Sashiko tracing cleanup entry now states that its path has been unreachable in mainline since Linux 6.3 and was fixed preventively before a planned change makes it reachable again.

Apple and Microsoft provenance is now literal

Apple source labels now match the pages they cite: 127110 is iOS 26.5 and iPadOS 26.5, 127121 is Safari 26.5, 149035 is macOS Golden Gate 27, and 149038 is visionOS 27. September entries no longer describe those 27-series records as a 26.7 release train.

The September MSRC CVRF feed explicitly credits researchers “with Xint” on three memory-safety CVEs. Those entries now use direct attribution under the published methodology instead of the previous self-reported label.

Eleven assignments are ahead of the public CVE API

Of the 329 identifiers introduced since the August ledger, 318 returned public CVE records on September 16. Eleven were unavailable through the API but have another public acceptance layer:

• eight Anthropic assignments whose revealed cards are fixed, patched, vendor-confirmed, and carry a CVE or GHSA mapping;
• two Nebu/HotCRP assignments mapped by public project GHSAs; and
• Jupyter CVE-2026-84973, mapped by the maintainer’s public GHSA.

Missing API data alone is not disqualifying. Missing both the public CVE record and an upstream acceptance source is why the two QuickJS rows remain pending.

Pending leads stay visible without affecting totals

The September pending-evidence queue retains the two QuickJS rows, five Chromium issue-only rows, the Drishti/Open5GS lead, contextual Anthropic reports, OpenAI’s Astra evaluation, XBOW deduplication telemetry, and the remaining AISLE reconciliation backlog. None contributes to accepted totals until its specific evidence gap is resolved.

For reproducibility, the repository records September 16 response timestamps, body sizes, and SHA-256 hashes for the Anthropic, Nebu, and AISLE tracker snapshots. An automated ledger audit now validates model references, CVE formats, global totals, and every stored system-profile count; attribution, security significance, severity, and acceptance remain human review tasks.

Published September 16, 2026 by Bugflation Editorial. Follow new articles and findings through the RSS feed.