A failure to report high-severity vulnerabilities often happens with open-source projects — vulnerabilities are discovered, disclosed to relevant parties and (hopefully) fixed without anyone filing...