Joint statement raising concerns on unpatched vulnerability reporting in the Cyber Resilience Act