Uncovering Flaws in Open-Source Vulnerability Disclosures

Aqua Nautilus analyzed thousands of open-source projects and found systemic gaps in the vulnerability disclosure lifecycle that expose vulnerability details on public platforms (GitHub, NVD) before patches/CVEs are fully published. The report defines new exposure states (‘Half-Day’, ‘0.75-Day’), illustrates real-world timelines for Log4Shell, Text4Shell, and Binwalk showing long windows where attackers could harvest commits/PRs/PoCs, details two large-scale harvesting methods (GitHub trigger-word scans and NVD monitoring), and recommends mitigations such as private reporting, proactive scanning of commits/PRs, and runtime protection.