Source code is not a signing key. A vendor’s list of known-but-unpatched flaws is a queue of working zero-days with the analysis done.