Z.ai's public vulnerability ledger shows 2,436 findings across 269 projects, with 2,383 still private.

cvd.z.ai went live after the GLM-5.3 launch as a coordinated-disclosure ledger. The severity split: 107 critical, 990 high, 1,286 medium, 53 low. Only 53 are publicly disclosed. The site claims a 45-year impact span with the earliest flaws traceable to 1981 and an average 26.6-year latency before discovery. Z.ai No published program terms, scope boundaries, reward structure, or disclosure timelines. That's a large gap given how much is still held private, and it makes the ledger read more like a capability demo than a disclosure program.