Ok, I did have a look at the project & I am once again wondering if there shouldn't be a "no public interest" clause for CVEs. This is a 0 forks, 2 starts, 1 contributor (and claude) github repo. I wouldn't be surprised if there wasn't more CVEs for this projects than users, a feat otherwise only Linux manages.
I was literally just looking at them & I have no idea what it is but some of them are bonkers: https://db.gcve.eu/vuln/cve-2026-81681