← All credits
sec-reex
8 vulnerability records and advisories credit this contributor.
CVE-2026-91991
Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs
CVE-2026-82241
Budibase backend-core SSRF via incomplete default blacklist
CVE-2026-65607
SiYuan before v3.7.2 Path Traversal via /export/temp/
CVE-2026-65604
Skipper Incomplete Fix for CVE-2026-50197 Policy Bypass
CVE-2026-90913
Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
CVE-2026-94276
Apache APISIX: Openid-connect introspection validation issue
CVE-2026-58440
Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`)
CVE-2026-64622
Network-AI 5.12.2 through 5.13.3 Missing Authorization via ApprovalInbox