Hacker News Reader

but is it securities fraud if an org knows about the vulnerability and doesn't disclose?

It is my (lay) understanding that in the US in particular almost anything is securities fraud: