fwiw these CVEs weren’t reported 6 months ago; they were found during a project which has been running for 6 months.
I would be interested in learning more context around this issue once you are able to share, so hopefully there will be a report/post/etc after the embargo lifts.