What it is
NebuSec describes Nebu as an AI-native, agent-agnostic pipeline for vulnerability discovery, reproduction, reporting, and repair. Its public research pages connect that system to a machine-readable bug list covering the Linux kernel, Firefox, Chromium, and several other software families.
What is verified
The September 16 snapshot exposes 1,178 rows, but 153 CVE rows meet Bugflation’s public acceptance filter:
- 127 Linux rows are marked
Fixedand carry CVE IDs. - Six browser rows carry public CVEs: three Firefox and three Chromium.
- Twenty cross-project rows have public CVE or project-advisory corroboration.
The affected-project records and CVE assignments corroborate the vulnerabilities. NebuSec’s own tracker supplies the AI-system attribution, so the three grouped entries are labeled self-reported.
What is not counted
The ledger excludes 996 Linux rows still marked Fixing. It also excludes 22
Netcore rows whose details are redacted and whose status is Reserved. A row
being visible in the tracker is not enough; it must expose an accepted public
issue or CVE and a fixed state.
Two fixed QuickJS rows lack an upstream patch, project advisory, and public CVE record. Five no-CVE Chromium issue rows were also not independently verified as accepted. All seven remain pending and do not contribute to accepted totals.