← All credits
Zhixi "Jace" Sun, independent security researcher
5 vulnerability records and advisories credit this contributor.
CVE-2026-111454
Apache Airflow: API: asset endpoints return scheduled/producing/consuming Dag IDs the caller cannot read
CVE-2026-111421
Apache Airflow: Execution API: set_xcom skips the reserved-key check, so task-written XComs instantiate airflow.* classes on the API server
CVE-2026-95629
Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory
CVE-2026-101259
Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions
CVE-2026-95628
Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)