← All credits
n0mi1k Security
8 vulnerability records and advisories credit this contributor.
CVE-2026-76168
Apache James: ManageSieve file implementation cross-user path traversal
CVE-2026-73322
Apache Pinot: Incorrect authorization in the single-stage query engine allows reading unauthorized dimension tables via lookup()
CVE-2026-108766
Apache Kylin: missing JDBC-config authorization
CVE-2026-108764
Apache Kylin: job-driver UI proxy SSRF
CVE-2026-108762
Apache Kylin: delete metadata backup path-confinement bypass
CVE-2026-71253
Apache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSON
CVE-2026-63619
Apache Kylin: Missing authorization and path-confinement on system meta dump
CVE-2026-108743
Apache Kylin: spark job OS command injection