I reported a Git widget serialization path traversal in Appsmith that was published as GHSA-r553-q33m-v7pf. The issue affected Git-connected Appsmith applications. An authenticated user with edit ...

I reported an authorization bypass in Gitea that was published as CVE-2026-24791 / GHSA-wrr5-99h5-gq57. The issue affected public-only access tokens and OAuth grants. A token marked as public-only...

I reported an HTTP/3 mutual TLS bypass in Traefik that was published as CVE-2026-53622 / GHSA-9cr8-q42q-g8m7. The issue affected deployments that used router-specific TLSOptions as an access-contr...

I reported a missing-authentication issue in rclone’s remote control file-serving handler that was published as CVE-2026-49980 / GHSA-qw24-gh76-8rvv. The bug was in the GET/HEAD path exposed by rc...

I reported a SAML SP state-binding issue in SimpleSAMLphp that was published as CVE-2026-49284 / GHSA-q8r6-xj3f-wrrm. The issue affected SP-initiated login flows in multi-IdP deployments. If Simpl...

I reported an HTTP-Artifact validation issue in SimpleSAMLphp’s SAML2 libraries that was published as CVE-2026-49283 / GHSA-6929-8p9f-26jx. The bug was a validator confusion issue in the HTTP-Arti...

I reported a GenAI/MCP read-only policy bypass in ProxySQL that was published as CVE-2026-48774 / GHSA-7wh6-2vcc-gcm4. The issue affected ProxySQL’s MCP run_sql_readonly tool for MySQL targets. Th...

I reported a pre-authentication memory corruption issue in ProxySQL that was published as CVE-2026-48773 / GHSA-58ww-865x-grpr. The issue affected ProxySQL’s first-packet handling for MySQL and Po...

I reported a domain-fronting mTLS bypass in Traefik that was published as CVE-2026-48491 / GHSA-5r4w-85f3-pw66. The issue affected wildcard router TLSOptions on the regular HTTPS/HTTP2 path. A pro...

I reported a path traversal vulnerability in simplesamlphp-module-casserver that was published as CVE-2026-46491 / GHSA-jrrg-99xh-5j2q. The issue affects deployments that use the file-based CAS ti...