Pending CVE assignment for a published repository security advisory (GHSA-xm28-xvqc-gxxg), ( GHSA-526j-582w-7fm9 )

[thientd]

Hi, I'm hoping to get some guidance on pending CVE assignments.

I'm the reporter/author on two published repository security advisories that
still have no CVE ID assigned, past the usual 72-hour review window:

• GHSA-xm28-xvqc-gxxg (copernik-eu/copernik-xml-factory, XXE / CWE-611,
  fixed in 0.1.2). Published ~a week ago; a CVE was requested ~a week ago
  and again two days ago.
• GHSA-526j-582w-7fm9 (python-social-auth/social-core). Published 2026-06-30,
  same situation.

Could someone clarify whether these requests are still queued, were declined,
or need anything further — and the right next step to get them unstuck? As far
as I can tell neither project is covered by another CNA, so both should be
eligible. Happy to provide any details. Thanks very much.