Ecosystem changes

Changes to the vulnerability data, disclosure and maintainer landscape developers rely on.

October 2026 1

HighEcosystem changeOngoing

Project Glasswing: AI-found bugs are reaching your dependencies faster than maintainers can patch

Of 6,157 Glasswing vulnerabilities disclosed to open-source maintainers, about 8% were patched by October 2026. Expect a long tail of dependency fixes.

2 Oct 2026Open source

April 2026 1

HighEcosystem changeOngoing

NVD stops enriching most CVEs: your scanner’s severity data now has gaps

Since 15 April 2026 NIST no longer adds severity scores or product data to most new CVEs. Tools that match on NVD data miss or misjudge risk.

15 Apr 2026Vulnerability data Open source

January 2026 1

InformationalEcosystem changeOngoing

curl ends its bug bounty over AI slop: what every maintainer should set up now

curl closed its HackerOne bug bounty on 31 January 2026 to stop paying for invented AI reports. How maintainers can filter the flood without missing real bugs.

21 Jan 2026Open source