Waiting On A Patch Screensaver
The Waiting On A Patch screensaver shows bugs the Zero Day Initiative has reported to a vendor that still have no fix, key-less. It’s free, runs in your browser, and ESC exits.
Live preview
Press ESC to leave fullscreen. Settings are saved in your browser only.
How the Waiting On A Patch screensaver works
The saver reads the source described above and draws it on a canvas — no account, no tracking.
Bugs the Zero Day Initiative has reported to a vendor that still have no fix, key-less. There is no CVE at this stage and no detail — only a case number, the vendor, a CVSS vector and who found it. The queue, not the archive.
It refreshes on a schedule, so what you see stays current.
Colours and any options can be changed in settings; nothing is stored beyond your own browser.
What the Zero Day Initiative's pending bugs are
The Zero Day Initiative, ZDI, is a vulnerability-disclosure programme run by Trend Micro (the upcoming-advisories page credits its own researchers as well as outside ones). It reports flaws to the affected vendor and publishes an advisory once a fix exists. Under its disclosure policy, ZDI gives a responsive vendor 120 days to address a vulnerability; at the end of that window, if the vendor is unresponsive or cannot reasonably explain why it is unfixed, ZDI publishes a limited advisory including mitigation. Extensions are at ZDI’s discretion and granted only in rare cases.
Until an advisory is public, ZDI tracks each bug with its own identifier, ZDI-CAN- followed by a number. The upcoming list shows the affected vendor, a severity score, the date reported, a deadline and who discovered it. The score is a CVSS value linked to a vector string such as AV:L/AC:L/PR:L/UI:N, which encodes how the flaw is reached, how complex it is and what privileges it needs.
Entries intentionally omit technical details so that nobody can exploit the bug before a patch is available. A CVSS score is an estimate of severity in the abstract, not a measure of how likely exploitation is. Treat this as a view of the disclosure pipeline, not a warning about any specific product.
A worked example
Bugs the Zero Day Initiative has reported to a vendor that still have no fix, key-less. There is no CVE at this stage and no detail — only a case number, the vendor, a CVSS vector and who found it. The queue, not the archive.
Settings & tips
- Accent and Background recolour the display.
- Every value on screen comes from the live source — nothing is simulated.
- Press ESC to leave fullscreen.
Frequently asked questions
- Is this real data?
- Yes — it comes from the source named on this page and is refreshed on a schedule.
- Is a key needed?
- No. This source is fully key-less.
- Is it free?
- Yes, and it runs entirely in your browser.
- What does ZDI-CAN mean?
- It is the identifier ZDI assigns to a reported vulnerability that has not yet been publicly disclosed, for example ZDI-CAN-33882.
- How does the ZDI decide when to publish?
- It publishes an advisory once the vendor issues a fix. Under its disclosure policy a responsive vendor gets 120 days; if the vendor is unresponsive or cannot reasonably explain why the bug is unfixed by then, ZDI publishes a limited advisory with mitigation.
- What does the CVSS vector tell me?
- It encodes attributes such as attack vector, attack complexity, required privileges and user interaction, which feed into the severity score.