Tracked vulnerabilities, coordinated disclosures, and reserved CVEs. All findings reported through responsible disclosure channels and credited where possible.