Solid triage table. One gap worth adding to it: the advisory-DB lag. The CVE-2026-111497 record (updated Oct 23) carries a 9.2 CVSS v4.0 score, but as of October 23 the advisory databases still did not map the CVE to the PyPI packages that auto-load the vulnerable Brotli decoder, so pip-audit, Dependabot and Safety report clean on setups that are actually exposed. For anyone using scanner output as the "are we affected" check, the only reliable answer right now is the Brotli version itself (fixed in 1.0.10 / 1.1.1 / 1.2.1). I covered that scanner-side angle in my last post. And one small question: the CVE record lists 9.2 while your matrix says 9.1 - different scoring source, or a typo?