Submit finding

All findings

CVE-2026-3087 + 19 more high

NebuSec's accepted cross-project ledger subset contains 20 CVEs

NebuSec publishes 20 fixed, publicly corroborated CVEs across CPython, NGINX, Android/Linux, Suricata, Windows, HotCRP, D-Link, and curl; two QuickJS rows remain pending.

Bug class
Memory safety, injection, denial of service, and validation vulnerabilities
Affected codebase
Multiple open-source and commercial projects
Credited system
Nebu
Source snapshot
September 16, 2026
Coverage
Fixed cross-project rows visible by September 16, 2026
Attribution
Self-reported attribution
AI role
Discovery
Severity
high
Source status: Twenty rows marked Fixed have public CVE or project-advisory corroboration. CVE-2026-55493 and CVE-2026-63491 were not in the public CVE API but map to HotCRP GHSAs. Two QuickJS IDs without an upstream fix, advisory, or public CVE record remain pending.

Summary

The accepted set covers two CPython CVEs, two NGINX CVEs, two Android/Linux CVEs, one Suricata CVE, three Windows CVEs, two HotCRP CVEs, seven D-Link CVEs, and one curl CVE.

CVE-2026-43074 also appears in Anthropic’s fixed CVD ledger. Both systems keep their credit, while the site-wide identifier count includes it once.

CVE-2026-55493 and CVE-2026-63491 were not yet retrievable from the public CVE JSON corpus at the cutoff, but their public HotCRP GHSAs independently establish the accepted vulnerabilities and exact identifier mappings.

CVE-2026-36156 and CVE-2026-36157 appear as fixed QuickJS rows in NebuSec’s tracker, but neither row links an upstream patch or advisory and neither ID had a public CVE record at the cutoff. They remain in the pending-evidence queue and do not contribute to accepted totals.

The tracker also displays 22 Netcore rows, but every one is redacted and marked Reserved. They are excluded until public details and an accepted state exist.

References

Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.