@ShadowJonathan@tech.lgbt @cadey@pony.social they are getting cves but the disclosure happens as the patch is made (not merged).