← All credits
tonghuaroot
25 vulnerability records and advisories credit this contributor.
CVE-2026-63041
Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers
CVE-2026-63042
Apache InLong: Missing authorization on DataNode management endpoints
CVE-2026-58436
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
CVE-2026-72761
Webhook SSRF guard bypassed by IPv6 transition addresses (NAT64/6to4/Teredo pass is_global check) in vulnerability-lookup
CVE-2026-48834
Apache Answer: Denial of service via crafted Accept-Language header parsing
CVE-2026-48911
Apache Answer: Unauthenticated OAuth Email-Binding Account Takeover via Existing User Confirmation Flow
CVE-2026-48912
Apache Answer: Improper authorization in avatar update cleanup allows authenticated users to delete arbitrary uploaded files by URL
CVE-2026-50749
Apache Answer: Missing authorization in revision audit reject allows authenticated users to reject pending revisions
CVE-2026-63305
AVideo through 29.0 OS Command Injection via ffmpeg.json.php
CVE-2026-63304
AVideo through 29.0 OS Command Injection via listFFmpegProcesses