Every vulnerability I have disclosed, newest first. Pick an area to filter.

7 CVEs found+1 pending

2026

• 2026-10-16CVE-2026-94134high 8.1

  Any Key Will Do: SSH Host Key Checks Off by Default in Apache Airflow

  Apache Airflow SSH/SFTP providersMissing host key verificationAppSecalso on OX Security
• 2026-10-06CVE pendinghigh 8.5

  Any User, Any URL: Webhook SSRF in Harbor

  HarborSSRFContainer Securityalso on OX Security
• 2026-04-21CVE-2026-33626high 7.5

  The Model Will Fetch Anything: SSRF in LMDeploy

  LMDeploySSRFAI Securitycovered by The Hacker News, Sysdig
• 2026-03-30CVE-2026-4789critical 9.8

  When the Guard Makes the Call: SSRF in Kyverno

  KyvernoSSRFKubernetesalso on Orca Security
• 2026-03-12CVE-2026-3059critical 9.8

  Pickle at the Door: Unauthenticated RCE in SGLang

  SGLangUnsafe deserializationAI Securityalso on Orca Securitycovered by The Hacker News
• 2026-02-18CVE-2026-23226high 7.5

  A Use-After-Free in the Linux Kernel's ksmbd

  Linux kernel ksmbdUse-after-freeLinux Kernelalso on Orca Security

Everything on this site by date, notes included: timeline.