Details

The 2026 VulnCheck Exploit Intelligence report is here [/2025-routinely-targeted-vulnerabilities?utm_source=vulncheck&utm_medium=website-banner&utm_content=a-top-50-vulnerabilities-veir](Learn More)

Cookies

We use our own cookies and third-party cookies so that we can display this website correctly and better understand how this website is used, with a view to improving the services we offer. A decision on cookie usage permissions can be changed anytime using the cookie button that will appear after a selection has been made on this banner.

AcceptDeclineLearn more and customize

Vulnerability Disclosure Policy

Last revised on March 6, 2026

Our vulnerability disclosure policy has two goals:

To ensure vendors are given a reasonable amount of time to address reported issues.
To provide the security community and affected users with honest, useful, and actionable vulnerability details.We believe we can achieve these goals by practicing coordinated disclosure. Our implementation of the coordinated disclosure process follows:
VulnCheck will contact the affected vendor with vulnerability details and provide a 120 day deadline to fix the issues or publish an advisory.
VulnCheck may provide customers with vulnerability details so they can take defensive measures while an official patch is being developed.
VulnCheck will remain in regular contact with the vendor to coordinate a date to publish coordinated advisories.
On the same day the vendor publishes a patch or an advisory, VulnCheck will publish a third-party vulnerability advisory.
If the 120 day deadline passes without a vendor patch or advisory, VulnCheck will publish an uncoordinated third-party vulnerability advisory.There are some minor caveats to our process:
No deadline extensions will be given.
VulnCheck will treat any published patch as a public disclosure.
Communication will occur exclusively over email.
VulnCheck will not participate in vulnerability disclosure programs that prohibit public disclosure or in any way attempt to control VulnCheck's work.
If a vendor states that they do not intend to remediate or issue an advisory for a reported vulnerability, the coordinated disclosure timeline may no longer apply.There is one major caveat to our process as well:
If VulnCheck determines the vulnerability is being exploited in the wild, the deadline changes from 120 days to 7 days. The goal is to take away the attacker's advantage and ensure defenders are made aware of the situation.VulnCheck reserves the right to deviate from, or change, the outlined process as needed.

AcceptDeclineLearn more and customize

Last revised on March 6, 2026

Our vulnerability disclosure policy has two goals:

To ensure vendors are given a reasonable amount of time to address reported issues.

To provide the security community and affected users with honest, useful, and actionable vulnerability details.We believe we can achieve these goals by practicing coordinated disclosure. Our implementation of the coordinated disclosure process follows:

VulnCheck will contact the affected vendor with vulnerability details and provide a 120 day deadline to fix the issues or publish an advisory.

VulnCheck may provide customers with vulnerability details so they can take defensive measures while an official patch is being developed.

VulnCheck will remain in regular contact with the vendor to coordinate a date to publish coordinated advisories.

On the same day the vendor publishes a patch or an advisory, VulnCheck will publish a third-party vulnerability advisory.

If the 120 day deadline passes without a vendor patch or advisory, VulnCheck will publish an uncoordinated third-party vulnerability advisory.There are some minor caveats to our process:

No deadline extensions will be given.

VulnCheck will treat any published patch as a public disclosure.

Communication will occur exclusively over email.

VulnCheck will not participate in vulnerability disclosure programs that prohibit public disclosure or in any way attempt to control VulnCheck's work.

If a vendor states that they do not intend to remediate or issue an advisory for a reported vulnerability, the coordinated disclosure timeline may no longer apply.There is one major caveat to our process as well:

If VulnCheck determines the vulnerability is being exploited in the wild, the deadline changes from 120 days to 7 days. The goal is to take away the attacker's advantage and ensure defenders are made aware of the situation.VulnCheck reserves the right to deviate from, or change, the outlined process as needed.