← All credits
n0mi1k
11 vulnerability records and advisories credit this contributor.
CVE-2026-81270
Apache Allura: Information exposure via search
CVE-2026-80190
Apache Allura: Stored XSS via code repositories
CVE-2026-80180
Apache Allura: Stored XSS via markdown HTML processing
CVE-2026-85229
Apache SkyWalking: CWE-79 stored XSS in Booster UI dashboard widgets (incomplete fix of CVE-2025-54057)
CVE-2026-80181
Apache Allura: Server-side request forgery
CVE-2026-70449
Apache Wicket: Path traversal in resource style/variation/locale
CVE-2026-66908
Apache Camel: Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted
CVE-2026-66907
Apache Camel: Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result
CVE-2026-66906
Apache Camel: Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir
CVE-2026-60093
Apache Camel: Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir