The second interinstitutional negotiation on the Cyber Resilience Act set the framework for a political agreement expected later this month. However, the controversial issue of who should receive sensitive vulnerability information is still to be fully…