I’ve cited CVE numbers in enough posts now — CVE-2026-48124 in Cursor, CVE-2026-55607 in Claude Code — that it’s worth explaining what that label actually is, and why patch times for similar-sounding bugs can differ by a factor of seven.
CVE stands for Common Vulnerabilities and Exposures. It’s a public catalog, not a severity rating — a CVE number is just a standardized ID (year plus a sequence number) assigned to one specific, identified flaw, so security teams, vendors, and researchers across different companies can all refer to the exact same bug without confusion. It’s issued by a distributed network of organizations called CVE Numbering Authorities, which include the vendors themselves for their own products. Getting a CVE number doesn’t mean a bug is serious; it means it’s been catalogued so the rest of the industry can track it, patch it, and cross-reference it consistently.
Responsible disclosure is the separate practice this connects to. When a researcher finds a vulnerability, the norm — not a legal requirement, but a strong industry convention — is to report it privately to the vendor first, giving them a window to fix it before any public write-up names the specific flaw. That window is genuinely a negotiation: researchers want a reasonable deadline so vendors don’t sit on bugs indefinitely, and vendors want enough time to actually build, test, and ship a real fix rather than a rushed one. Cymulate’s disclosure to Google explicitly set a 90-day clock and published in full once that period passed with no patch — a common, and fairly aggressive, default.
Why the timelines vary so much in practice, even for similar bugs: fix complexity is the biggest factor — a config validation check is a smaller change than restructuring how a sandbox hands control to a host process, and the second kind can require re-architecting rather than patching. Triage speed matters too — how fast a report gets routed to the engineer who actually understands that subsystem, rather than sitting in a queue. And organizational size cuts both ways: a bigger security team can parallelize, but more approval layers can also slow down what should be a quick fix. None of that is an excuse for a 50-day gap on a category of bug that’s already been publicly named four times this year — it’s just the honest reason two vendors can receive comparable reports in the same week and ship fixes seven weeks apart.
The practical takeaway, if you’re the one deciding whether to keep running a tool with an open report against it: a CVE number existing tells you a flaw is real and catalogued. It doesn’t tell you how urgent it is, or how long you’ll be exposed while it’s fixed — for that, you actually have to read what the report says, the same way I went through what today’s disclosure specifically covers.
