Public record
Correction history
When our interpretation changes, this record explains what changed and why. Vendor edits to their own advisories appear in the advisory change feed.
How to request a correction · Download this history
Separate confirmed releases from publication bounds
25 Oct 2026
Before: The private-report display could present advisory-date candidates or report-to-publication durations as time to fix. The private median mixed durations with upper bounds.
After: Only reviewed release evidence establishes a confirmed fix date. Patched-at-publication cases without that evidence show an upper bound. Unpatched-at-publication cases show a historical lower bound. Medians of confirmed fixes and publication bounds are separate, and ambiguous 120-day outcomes are unknown.
Why: An advisory's publication date does not prove when its fix became available. Methodology 1.1.0 makes this limitation explicit; private grades continue to use publication bounds conservatively where the source confirms a patch existed.