Archives
All the articles I've archived.
2026 4
October 3
-
CVE-2026-46547: Reflected XSS via the Redirect URL on NocoDB's Page Leaving Warning
A reflected XSS in NocoDB's page leaving warning, where unvalidated redirect and back URLs let javascript URLs run. Fixed in NocoDB 2026.04.1.
-
CVE-2026-27822: Critical Stored XSS in the RustFS Console Leading to Admin Account Takeover
A stored XSS in the RustFS Console's file preview that could leak an administrator's S3 credentials and lead to full account takeover. Rated Critical (CVSS 9.0).
-
CVE-2026-27480: Timing-Based Username Enumeration in Static Web Server
A timing side channel in Static Web Server's Basic Authentication that revealed which usernames were valid. Rated Medium and fixed in v2.41.0.
February 1
-
Migrating to Astro and My Goals for 2026
A brief update on my migration from Next.js to Astro and my focus on bug hunting and global outreach in 2026.