← All credits
tonghuaroot
34 vulnerability records and advisories credit this contributor.
CVE-2026-74866
@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name
CVE-2026-58436
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
CVE-2026-72761
Webhook SSRF guard bypassed by IPv6 transition addresses (NAT64/6to4/Teredo pass is_global check) in vulnerability-lookup
CVE-2026-50749
Apache Answer: Missing authorization in revision audit reject allows authenticated users to reject pending revisions
CVE-2026-48912
Apache Answer: Improper authorization in avatar update cleanup allows authenticated users to delete arbitrary uploaded files by URL
CVE-2026-48911
Apache Answer: Unauthenticated OAuth Email-Binding Account Takeover via Existing User Confirmation Flow
CVE-2026-48834
Apache Answer: Denial of service via crafted Accept-Language header parsing
CVE-2026-68494
jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for CVE-2026-18401 / GHSA-72hv-8253-57qq)
CVE-2026-63305
AVideo through 29.0 OS Command Injection via ffmpeg.json.php
CVE-2026-63304
AVideo through 29.0 OS Command Injection via listFFmpegProcesses