Posts

All the articles I've posted.

• CVE-2026-46547: Reflected XSS via the Redirect URL on NocoDB's Page Leaving Warning

  25 Oct, 2026

  A reflected XSS in NocoDB's page leaving warning, where unvalidated redirect and back URLs let javascript URLs run. Fixed in NocoDB 2026.04.1.

• CVE-2026-27822: Critical Stored XSS in the RustFS Console Leading to Admin Account Takeover

  25 Oct, 2026

  A stored XSS in the RustFS Console's file preview that could leak an administrator's S3 credentials and lead to full account takeover. Rated Critical (CVSS 9.0).

• CVE-2026-27480: Timing-Based Username Enumeration in Static Web Server

  25 Oct, 2026

  A timing side channel in Static Web Server's Basic Authentication that revealed which usernames were valid. Rated Medium and fixed in v2.41.0.

• Migrating to Astro and My Goals for 2026

  7 Feb, 2026

  A brief update on my migration from Next.js to Astro and my focus on bug hunting and global outreach in 2026.