← All credits

AdamKorcz

17 vulnerability records and advisories credit this contributor.

CVE-2026-110879

jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)

CVE-2026-119128

ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie

CVE-2026-118686

EspoCRM before 9.3.11 and 10.0.8 Unauthenticated Denial of Service via Password-Redaction Regex

CVE-2026-105215

ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback

CVE-2026-105212

ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment

CVE-2026-105210

ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers

CVE-2026-105209

ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment

CVE-2026-105207

ZITADEL before 4.17.3 Account Takeover via External IdP Linking

CVE-2026-111922

Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins

CVE-2026-110849

n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binary-Data File Preview