For reporters and researchers. Numbers updated 2026-11-12 11:22 UTC.
Press and research
Limbowatch measures how long published security advisories wait before scanners can see them. Everything here is free to cite with credit, and every number links to how it was measured.
Talk to us
Yujia Lin built Limbowatch and answers questions about the data and the method. Write to:
Or open an issue on GitHub.
The numbers today
Ready to quote. They update every day; please give the date.
On 12 November 2026, 10,059 security advisories published by maintainers on GitHub were waiting for GitHub’s review. They aren’t yet in GitHub’s reviewed Advisory Database or OSV, which most dependency scanners read. 4,918 are rated critical or high.
Live trackerIn the 7 days to 11 November 2026, maintainers published 847 new advisories in the repositories we watch. GitHub reviewed 107 of the ones waiting.
How the weekly flow is countedThe advisories in limbo have waited a median of 55 days so far. 3,195 have waited more than 3 months, and 606 more than a year.
How waits are measured5,589 of them have no CVE at all, so scanners that start from CVEs can’t see them either.
CVE states in the trackerAnother 15,045 published advisories are in ecosystems GitHub doesn’t review, such as C/C++ and container images. Scanners that read GitHub’s database will probably never see them.
What “likely permanent” meansGitHub’s documentation says its review of a published advisory “can take up to 72 hours”. GitHub has said it has missed its own goals since mid-April 2026, and in October the median was 23 days, for 990 reviewed advisories.
Sources in the research logIn October 2026, 1 in 6 upstream advisories behind 15 popular open-source projects was in limbo, and the median wait for GitHub’s review was 23 days.
State of the Gap, October 2026On 13 popular open-source projects, GitHub’s Dependabot raised 2,020 alerts and none for the 1,080 confirmed findings in limbo that Limbowatch reported there (277 advisories; 262 findings rated critical or high). Every affected package was in GitHub’s own dependency graph (8 November 2026).
The comparisonOn a demo app with real lockfiles, Limbowatch found 16 advisories in limbo that GitHub’s Dependabot alerts and OSV-Scanner did not report (7 November 2026). Each was rechecked against GitHub and OSV.
The evidence
Every live number is a floor: Limbowatch sees only the 67,471 repositories it watches. Methodology
The queue, as a chart
Free to republish with credit. The SVG scales to any size.
Download the chart (SVG)Every advisory in limbo (CSV)Today’s counts (JSON)
Stories in the data
More in than out, so far
In the 7 days to 11 November 2026, maintainers published 847 new advisories in the repositories we watch, and GitHub reviewed 107 of those waiting. We have two weeks of data: a rate, not yet a trend. The daily report shows each day.
Dependabot sees the package, not the advisory
In 13 popular projects, every package affected by an advisory in limbo was in GitHub’s dependency graph, and Dependabot alerted on none of them. It will once GitHub reviews the advisories; until then, the projects get no warning. The comparison
Critical and fixed, not yet reviewed
Many advisories are published with the fix already released. Tools that read GitHub’s database or OSV don’t alert users of the vulnerable version until the review is done. Examples are below.
Outside GitHub’s review
15,045 advisories are in ecosystems GitHub doesn’t review, like C/C++ libraries and container images. Scanners that read GitHub’s database won’t flag them unless that changes.
Reserved, but empty, CVE IDs
613 advisories cite a CVE that is reserved but not yet published, so looking it up returns nothing. The CVE Program’s policy expects a record within 72 hours of disclosure.
85 days for one CVE
A critical advisory for an NSA open-source project waited 85 days for its CVE to be published. It covers a release .jar and a Docker image, so GitHub won’t review it, and OSV lists the CVE without a package: scanners can’t match it. The story
Examples you can check
Critical advisories with a released fix, published this past year, still waiting longest. Each links to our facts page and to the maintainers’ advisory on GitHub.
| Package | Advisory | Fixed in | Waiting |
|---|---|---|---|
| lookyloo/lookylooPyPI | GHSA-m9g6-23c8-vrxf | 1.35.1 | 358 days |
| @usebruno/clinpm | GHSA-246j-fv2m-6jhx | 2.14.4 | 348 days |
| shaneisrael/firesharePyPI | GHSA-c4f5-g622-q72m | v1.3.0 | 336 days |
| OpenAgentPlatform/Divenpm | GHSA-xv8m-365j-x6h2 | v0.11.1 | 328 days |
| 5irenpm | GHSA-5hpf-p8fw-j349 | 0.15.2 | 324 days |
| lemon8866/StreamVaultMaven | GHSA-c747-q388-3v6m | 251126 | 321 days |
How to cite
Limbowatch (limbo.watch), data as of 2026-11-12. Advisory data from GitHub repository security advisories and the GitHub Advisory Database, CC BY 4.0.
Data is licensed CC BY 4.0. Advisory facts come from GitHub; we don’t republish advisory text, so quote the maintainers’ advisory directly.
Logo
An hourglass whose last grain is stuck in the neck: published above, not yet reviewed below.
About Limbowatch
- An independent open-source project, created by Yujia Lin after the advisory for a vulnerability Yujia reported spent months invisible to scanners. Not affiliated with GitHub, OSV, MITRE or NIST.
- It reads only public data: published advisories, GitHub’s reviewed database, OSV, the CVE List and NVD.
- The people reviewing advisories are doing their jobs. The point is the length of the queue, not who is in it.
- Code under Apache-2.0 and data under CC BY 4.0, both on GitHub.