← All credits
n0mi1k
44 vulnerability records and advisories credit this contributor.
CVE-2026-73668
Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values
CVE-2026-77147
Apache Syncope: Groovy Sandbox escape for empty CommandArgs
CVE-2026-82617
Apache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns
CVE-2026-73334
Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation
CVE-2026-80181
Apache Allura: Server-side request forgery
CVE-2026-85229
Apache SkyWalking: CWE-79 stored XSS in Booster UI dashboard widgets (incomplete fix of CVE-2025-54057)
CVE-2026-80180
Apache Allura: Stored XSS via markdown HTML processing
CVE-2026-81270
Apache Allura: Information exposure via search
CVE-2026-80190
Apache Allura: Stored XSS via code repositories
CVE-2026-70449
Apache Wicket: Path traversal in resource style/variation/locale