It's for 1-day attacks I'd imagine. Especially for python, once the patch is public threat actors can abuse it but they can embargo the cve and offer private pa

It's for 1-day attacks I'd imagine. Especially for python, once the patch is public threat actors can abuse it but they can embargo the cve and offer private patches for commercial customers early to avoid that scenario.