← All credits

Hama1cco

8 vulnerability records and advisories credit this contributor.

CVE-2026-111421

Apache Airflow: Execution API: set_xcom skips the reserved-key check, so task-written XComs instantiate airflow.* classes on the API server

CVE-2026-123533

Gitoxide before 0.42.0 Denial of Service via Crafted Commit-Graph File

CVE-2026-121434

Froxlor 2.3.0 before 2.3.15 Authorization Bypass via Certificates.update API

CVE-2026-121448

Dockhand before 1.0.54 Path Traversal via Stack Environment Routes

CVE-2026-116171

SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix

CVE-2026-109574

Hugo before v0.167.0 Path Traversal via css.Sass Import Fallback

CVE-2026-111884

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Current-Password Step-Up on E-mail Change Enables Account Takeover

CVE-2026-109595

Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver