← All credits
Oscar Naveda
13 vulnerability records and advisories credit this contributor.
CVE-2026-13229
Zammad 7.0.1 - Improper authorization in ticket article attachment cloning
CVE-2026-10716
Directus <12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creation
CVE-2026-7460
mailcow-dockerized 2026-03b - Stored XSS in Queue Manager via unescaped
CVE-2026-42840
ERPNext 16.16.0 - Stored XSS in POS customer section via unescaped template literals
CVE-2026-42839
ERPNext 16.16.0 - Stored XSS in POS cart item rendering
CVE-2026-10715
Camaleon CMS 2.9.2 - Improper authorization in draft autosave endpoint
CVE-2026-11779
PayloadCMS 3.84.1 - Authenticated account lockout bypass through default unlock access
CVE-2026-11994
Akaunting 3.1.21 - Authenticated stored XSS in report description rendering
CVE-2026-11943
Akaunting 3.1.21 - Authenticated stored XSS in document timeline
CVE-2026-11942
Akaunting 3.1.21 - Stored XSS in delete confirmation modal