Vulnerability Reporting Transparency
Endor Labs follows the 90+30 day disclosure policy from Google Project Zero (see here), as well as the 2025 policy trial for reporting transparency (see here). Accordingly, we use this page to publicly track vulnerability reports for both active reports and completed ones.
Most recent update: Aug 12, 2026
Active Reports
Endor Labs Reference
Project / Repository
Date Reported
90-Day Deadline Expires
Closed Reports
Once a vulnerability report is marked as Fixed, Working as Intended (WAI) or Won't Fix, it will move into the table below. Note that the links to Fixed issues won't be publicly accessible until up to 30 days after a report is marked as Fixed.
Endor Labs Reference
Public Reference
Project / Repository
Date Reported
Result
Date Fixed
Version(s) Fixed
Comment
ENDOR-VUL-2026-1501
CVE-2026-26030
2026-01-15
Fixed
2026-02-10
1.39.4
Marked as duplicate
ENDOR-VUL-2025-2312
CVE-2026-25049
2025-12-23
Fixed
2026-01-23
1.123.17, 25.2
Merged with similar reports