EU Cyber Resilience Act · Regulation (EU) 2024/2847
Manufacturers of products with digital elements shall “identify and document vulnerabilities and components contained in products … including by drawing up a software bill of materials” and “address and remediate vulnerabilities without delay”. Annex I, Part II
Article 14 reporting duties have been in effect since 11 September 2026: actively exploited vulnerabilities must be notified within 24 hours.
Latest CVE added to the CISA KEV catalogue · 27 October 2026
Google Brotli Unchecked Return Value Vulnerability
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service…
As of 28 October 2026, from Lucerna's live CVE index.
Upload an SBOM. Lucerna matches every component against the full CVE index, tells you which vulnerabilities actually affect your build, and tracks what you must fix and report.
Smart products may live for years, but vulnerabilities never stop.
Vulnerability Management System
