Extend ZDI dispute timelines to the CNA-determination stage

Updates the CVE-2026-0765, 0766 and 0767 timelines: records that on 2026-07-06 the CVE Program forwarded the dispute to the issuing CNA (ZDI) for its determination under the record-dispute procedure, that neither ZDI nor the CVE Program responded to the earlier 2026-05-04 dispute, and that Open WebUI's original closure of each report gave the reporter no written explanation at the time, which was a mistake on Open WebUI's part. Drops the "despite the vendor's out-of-scope disposition" note on publication, since no written disposition was issued to the reporter.

Author: Classic298

docs/security/vendor-dispositions/cve-2026-0765.mdx

@@ -22,13 +22,14 @@ This CVE is formally disputed. The dispute is open and being pursued through the
 
 | Date | Event |
 | :--- | :--- |
-| 2025-10 | ZDI submits the underlying report through Open WebUI's security channel; Open WebUI closes it as out of scope per its published security policy. |
-| 2026-01-23 | ZDI publishes the CVE (ZDI-26-031) despite the vendor's out-of-scope disposition. |
-| 2026-05-04 | Open WebUI files a formal dispute with the CVE Program and notifies ZDI directly. Neither responds. |
+| 2025-10 | ZDI submits the underlying report through Open WebUI's security channel. Open WebUI closes it as out of scope and not a vulnerability under its published security policy, but does so without giving the reporter a written explanation at the time, which was a mistake on Open WebUI's part. |
+| 2026-01-23 | ZDI publishes the CVE (ZDI-26-031). |
+| 2026-05-04 | Open WebUI files a formal dispute with the CVE Program and notifies ZDI directly. Neither ZDI nor the CVE Program responds. |
 | 2026-06-15 | Open WebUI files another dispute with the CVE Program; the Secretariat directs it to the issuing CNA (ZDI), which owns the record. The request is subsequently closed. |
 | 2026-07-02 | With the CNA non-responsive, Open WebUI escalates the dispute a third time, to the CVE Program's Root / Top-Level Root under the CVE Record Dispute Policy (v2.0.0). |
+| 2026-07-06 | Under the CVE Program's record-dispute procedure, the Program forwards the dispute to the issuing CNA (ZDI) for its determination. |
 
-As of 2026-07-02 the dispute remains open and the CVE record has not been amended. This disposition stands as Open WebUI's official assessment.
+As of 2026-07-06, the dispute is before the issuing CNA (ZDI) for its determination and the CVE record has not been amended. This disposition stands as Open WebUI's official assessment.
 
 ---
 

docs/security/vendor-dispositions/cve-2026-0766.mdx

@@ -22,13 +22,14 @@ This CVE is formally disputed. The dispute is open and being pursued through the
 
 | Date | Event |
 | :--- | :--- |
-| 2025-10 | ZDI submits the underlying report through Open WebUI's security channel; Open WebUI closes it as out of scope per its published security policy. |
-| 2026-01-23 | ZDI publishes the CVE (ZDI-26-032) despite the vendor's out-of-scope disposition. |
-| 2026-05-04 | Open WebUI files a formal dispute with the CVE Program and notifies ZDI directly. Neither responds. |
+| 2025-10 | ZDI submits the underlying report through Open WebUI's security channel. Open WebUI closes it as out of scope and not a vulnerability under its published security policy, but does so without giving the reporter a written explanation at the time, which was a mistake on Open WebUI's part. |
+| 2026-01-23 | ZDI publishes the CVE (ZDI-26-032). |
+| 2026-05-04 | Open WebUI files a formal dispute with the CVE Program and notifies ZDI directly. Neither ZDI nor the CVE Program responds. |
 | 2026-06-15 | Open WebUI files another dispute with the CVE Program; the Secretariat directs it to the issuing CNA (ZDI), which owns the record. The request is subsequently closed. |
 | 2026-07-02 | With the CNA non-responsive, Open WebUI escalates the dispute a third time, to the CVE Program's Root / Top-Level Root under the CVE Record Dispute Policy (v2.0.0). |
+| 2026-07-06 | Under the CVE Program's record-dispute procedure, the Program forwards the dispute to the issuing CNA (ZDI) for its determination. |
 
-As of 2026-07-02 the dispute remains open and the CVE record has not been amended. This disposition stands as Open WebUI's official assessment.
+As of 2026-07-06, the dispute is before the issuing CNA (ZDI) for its determination and the CVE record has not been amended. This disposition stands as Open WebUI's official assessment.
 
 ---
 

docs/security/vendor-dispositions/cve-2026-0767.mdx

@@ -22,13 +22,14 @@ This CVE is formally disputed. The dispute is open and being pursued through the
 
 | Date | Event |
 | :--- | :--- |
-| 2025-10 | ZDI submits the underlying report through Open WebUI's security channel; Open WebUI closes it as out of scope per its published security policy. |
-| 2026-01-23 | ZDI publishes the CVE (ZDI-26-033) despite the vendor's out-of-scope disposition. |
-| 2026-05-04 | Open WebUI files a formal dispute with the CVE Program and notifies ZDI directly. Neither responds. |
+| 2025-10 | ZDI submits the underlying report through Open WebUI's security channel. Open WebUI closes it as out of scope and not a vulnerability under its published security policy, but does so without giving the reporter a written explanation at the time, which was a mistake on Open WebUI's part. |
+| 2026-01-23 | ZDI publishes the CVE (ZDI-26-033). |
+| 2026-05-04 | Open WebUI files a formal dispute with the CVE Program and notifies ZDI directly. Neither ZDI nor the CVE Program responds. |
 | 2026-06-15 | Open WebUI files another dispute with the CVE Program; the Secretariat directs it to the issuing CNA (ZDI), which owns the record. The request is subsequently closed. |
 | 2026-07-02 | With the CNA non-responsive, Open WebUI escalates the dispute a third time, to the CVE Program's Root / Top-Level Root under the CVE Record Dispute Policy (v2.0.0). |
+| 2026-07-06 | Under the CVE Program's record-dispute procedure, the Program forwards the dispute to the issuing CNA (ZDI) for its determination. |
 
-As of 2026-07-02 the dispute remains open and the CVE record has not been amended. This disposition stands as Open WebUI's official assessment.
+As of 2026-07-06, the dispute is before the issuing CNA (ZDI) for its determination and the CVE record has not been amended. This disposition stands as Open WebUI's official assessment.
 
 ---