[bigodbiel]

but is it securities fraud if an org knows about the vulnerability and doesn't disclose?

[tomalpha]

It is my (lay) understanding that in the US in particular almost anything is securities fraud:

https://www.bloomberg.com/opinion/articles/2019-06-26/everyt...