project
A vulnerability coordination and disclosure center within Carnegie Mellon University's Software Engineering Institute, researching and reporting security flaws.
No evidence-backed relationships are recorded.
MITRE rated CrewAI's nine-name code-sandbox blocklist a CVSS 8.1 flaw, bypassed by a call that executes no import. The fix removed the feature, so teams running agent-written code need isolation at the OS or process level.
Reality
CVE-2026-75501 puts an unauthenticated UPnP control endpoint on the WAN side of a premium ISP gateway. With no patch and no vendor reply, the carriers own the mitigation.
Reality
CERT/CC says the Airoha SDK flaw CVE-2025-20701 was fixed upstream on August 4, 2025 and in Skullcandy firmware 1.0.0.30, but units already sold on 1.0.0.28 have no update path, so the fix only reaches new stock.
Reality
Since September 17, 2026, reports to CISA go through VINCE-NT, a platform the agency owns and manages itself, and anyone with an open case will be told individually when it moves across.
Reality
CERT/CC disclosed an unauthenticated file read and a code execution path in mwEmbed with no fix available. The advisory's only product is a list of network controls you apply yourself.
Reality
CERT/CC says an unauthenticated UPnP control endpoint on WAN port 5000 lets anyone write port-forward rules into subscriber LANs. No fixed firmware exists, so the fix belongs to the ISP.
Reality
The Linux Foundation's coalition for AI-generated vulnerability reports starts taking automated submissions next month. Its membership terms set the ceiling on what it can absorb.
Reality