← All credits
CassianStarck
3 vulnerability records and advisories credit this contributor.
CVE-2026-50105
RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
CVE-2026-58445
Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API
CVE-2026-58416
Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)