Anthropic's CVD ledger leaves eleven qualifying cards model-unspecified

Eleven fixed Project Glasswing cards establish Anthropic program provenance but do not name a particular model; they contain 12 unique CVEs and five GHSAs.

Bug class: Program-level CVD cluster spanning memory safety, injection, certificate validation, and kernel lifetime flaws
Affected codebase: Multiple open-source projects
Credited system: Claude / Anthropic Research
Latest disclosure: August 17, 2026
Coverage: Project Glasswing cards revealed May 20-August 17, 2026; checked September 16, 2026
Attribution: Direct source attribution
AI role: Unspecified
Severity: critical

Source status: The eleven qualifying cards are public, fixed, patched, and vendor-confirmed, but their current card text does not name a particular model. This page records only Anthropic program-level provenance.

Summary

These eleven cards contain twelve CVEs and five GHSAs across eight projects. Their severity mix is three critical, seven high, and one medium. The cards establish accepted Project Glasswing work but do not identify Mythos, Opus, Sonnet, or another model.

Several identifiers also have independent, more specific Bugflation entries. For example, CVE-2026-4747 has a separate primary source that explicitly names Mythos. That independent credit remains intact, while this grouped page avoids using it to infer the model for the other ten CVD cards.

References

Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.