Vulnerabilities and bugs I've reported to open-source projects. Disclosed findings link to their advisory, CVE record or issue; private reports link to the project.
Sent through GitHub's private vulnerability reporting. Details stay private until each advisory is published, then the project moves up to Disclosed with the full write-up.
📋 Disclosure log (7 entries)
| Date | Project | Finding | Status |
|---|---|---|---|
| 2026‑11‑11 | SinTan1729/chhoto-url | GHSA-xq5g-cjm5-w3q2 One unauthenticated login OOM-kills a memory-limited deployment (Argon2 verification, 64 MiB per attempt) | 🟠 High |
| 2026‑11‑11 | SinTan1729/chhoto-url | GHSA-pv8r-78qm-87c2 Argon2 password hash is silently discarded when it fails to parse — authentication disabled (fail-open) | 🟠 High |
| 2026‑11‑09 | python/cpython | CVE-2026-124249 http.cookiejar applies expired Set-Cookie to cookie store before policy validation | 🟡 Medium |
| 2026‑10‑30 | honojs/hono | Issue #5592 cache middleware caches cookie-authenticated responses per URL, disclosing one user's data to another | ✅ Fixed |
| 2026‑10‑28 | excon/excon | GHSA-h8qf-v835-mx7g Case sensitive redaction for redirect follower | 🟠 High |
| 2026‑10‑27 | nuxt/nuxt | CVE-2026-119200 · GHSA-9v7c-q64q-vv33 Dot segments in the request path bypass server/middleware path checks and server route rules on page routes | 🟡 Medium |
| 2026‑10‑21 | pnpm/pnpm | Issue #17205 pnpm 12.14.0 retries a rejected tar-entry fetch for one minute, stalling CI installs | ✅ Fixed |
Cards are built from the GitHub API by scripts/generate.py and refreshed every 6 hours by GitHub Actions.