| Advisory | CVE | Severity | Class | Project |
|---|---|---|---|---|
| GHSA-79wm-x847-7cvg | CVE-2026-73222 | High · 8.8 | Unauthenticated OS command injection → RCE | claude-code-templates |
| GHSA-6c66-jp8x-q8w8 | — | High · 7.6 | Unauthenticated 0.0.0.0 bind + fail-open auth → SSRF proxy / process spawn |
aidevops |
| GHSA-qq8c-fch4-cxq7 | — | High · 7.3 | Broken access control — admin/metrics routes bypass API-key auth + permissive CORS | crw (fastCRW) |
| GHSA-4cfr-w3v5-w5j5 | — | High · 7.1 | Algorithmic-complexity fail-open guard bypass | destructive_command_guard |
| GHSA-cff8-4h3c-9r4q | — | High · 8.5 | Cross-resource IDOR — MediaLibraryController exposes every ActiveStorage::Blob to any authenticated user |
avo |
| GHSA-25rm-9wvm-m38v | CVE-2026-77382 | Medium · 5.9 | Post-quantum cryptography — discrete-Gaussian sampler precision below Falcon's security threshold | falcon-rust |
| GHSA-2697-fm9m-mqvw | — | Medium · 5.5 | Infinite loop (uncontrolled resource consumption) in the PEF loader — a crafted PEF header hangs Ghidra on import | Ghidra (NSA) |
CVE IDs are issued by GitHub after a compliance review of the published advisory, on their own schedule, and the lag is measured in weeks rather than days: CVE-2026-73222 was assigned four weeks after publication, and CVE-2026-77382 five. The remaining advisories are in that queue; the Ghidra advisory is not, as the Ghidra Team's policy states they are not authorized to generate CVEs. Further reports are in coordinated disclosure and will be listed here once published.
falcon-sampler-kat — known-answer test vectors that detect a Falcon implementation whose exp() approximation is under-provisioned, the defect class behind the falcon-rust advisory above.
The official Falcon KATs do not catch this class. A sampler running at ~2⁻³³ precision instead of the reference's ~2⁻⁵⁰ still reproduces every published test vector, because the defect only flips a rejection decision about 2⁻³³ of the time, so catching it end-to-end would take ~2³³ samples. These vectors test the arithmetic directly, at the point where the error is deterministic rather than probabilistic, and are built by construction rather than by search.
Validated in both directions, which is the part that matters for a test suite:
| implementation | result |
|---|---|
| falcon-rust v0.3.0 (post-fix) | 20/20 agree |
| falcon-rust v0.1.3 (the GHSA-25rm defect) | 10/20 caught the defect |
pornin/rust-fn-dsa v0.4.0, flr_native and flr_emu |
20/20 agree, z bit-exact |
The vectors were merged into falcon-rust at the maintainer's invitation.
Defects found, reported, and fixed upstream, credited by maintainers via commit, PR, or issue. The reporting channel differs from the advisories above; the work does not.
| Project | Finding | Outcome |
|---|---|---|
| falcon-rust Falcon / FN-DSA, NIST PQC signatures |
Beyond the advisory above: Gaussian acceptance-probability fix (930d766), then a follow-up after re-checking my own fix against the spec and finding the sampler centre still short of Falcon's precision bound (fc60813). Later, an out-of-bounds index in ber_exp: the loop ran eight shifts against a seven-byte buffer, reachable whenever the first seven bytes tie with z, about 2⁻⁵⁶ from the sampler's own RNG, which is why it had never been observed |
Four commits merged with me as git author, including the OOB fix and the precision KAT vectors contributed at the maintainer's invitation. Listed among the repo's contributors |
| PyJWT JWT library |
HMACAlgorithm.prepare_key accepted empty HMAC keys with only a warning |
Fixed in 2.13.0, which credits the report in the release commit. That release has since propagated into the dependency history of 90+ downstream repositories, including Microsoft, Sentry, Apache, PyTorch, Canonical, Bazel and Red Hat projects |
| redis-py official Redis client |
Plaintext password disclosure via ConnectionPool.__repr__ (CWE-532) |
Fixed (#3993) |
| leancrypto PQC for bare-metal and Linux kernel |
ASN.1 memory leaks on error paths across six key-parsing modules (ML-DSA, ML-DSA+Ed25519/Ed448, Ed25519, Ed448, SLH-DSA) (6581568); pathLenConstraint not enforced per RFC 5280 §4.2.1.9, so a chain could exceed an intermediate CA's authorised depth (12cc2aea) |
Both fixed upstream, both crediting me in the commit trailer. Path-length fix shipped with a new test-certificate matrix |
| wigolo local-first web-fetch MCP for AI agents |
SSRF fetch path vulnerable to DNS-rebinding / TOCTOU | Hardened via fetch-time address resolution; fix merged |
| libE57Format ASTM E57 point clouds — surveying, BIM, robotics |
Out-of-bounds read in BufferView::read: CheckedFile requests a full physical page regardless of bytes remaining, so a short in-memory buffer reads past its allocation. Reproduced under AddressSanitizer, patched build verified to throw instead |
Fix merged as PR #352 (0e1d480); the maintainer added a regression test adapted from my reproducer |
| tomlkit TOML parser behind Poetry |
Uncontrolled-recursion DoS in parser.py (CWE-674) |
Fixed (#459) |
| whois Python WHOIS client |
SSRF via referral following, plus a follow-up hardening pass | Both merged (#319, #321) |
| enc_rust ML-KEM |
Decapsulation missing Fujisaki–Okamoto implicit rejection | Fix authored and merged (572a37f) |
| libpqc-dyber post-quantum crypto |
FN-DSA / Falcon BerExp sampler precision below the ~2⁻⁴⁰ Rényi-divergence floor the security proof requires (b012e00); then heap overflows in signing, XMSS one-time-key reuse, LMS signatures not verifying, and KEM oracles (ab8614b); an intermittent XMSS verification failure and FN-DSA conversion UB (4eb96fb); and signature-buffer bounds, which was swept across every registered algorithm rather than patched in one place (5b5a6fd) |
Produced the project's 0.2.0 security release. 15 commits carry Reported-by: Conner (Spartan8806) |
| hermes-agent Nous Research agent framework |
Auto-approve edit gate bypassable by a multi-file patch touching a sensitive path | Fix + regression tests submitted, in review |
On calibration: I withdrew one libpqc-dyber finding of my own after re-testing it at runtime rather than from the packing arithmetic, and on libE57Format the maintainer assessed the issue as a plain bug rather than a security one, which I agreed with.
- Android / Pixel — vulnerability research submitted to Google's Android & Devices VRP (Buganizer): firmware reverse engineering, kernel/driver, and device trust-boundary work.
- Windows — local privilege escalation and kernel/driver research (MSRC; ZDI pipeline).
- Focus areas — memory corruption, TOCTOU / logic flaws, cryptanalysis, firmware RE.
Disclosure done cleanly: reported privately where a channel exists, fixes contributed upstream, no public 0-day drops. Additional reports are in coordinated disclosure and are not listed until a maintainer publishes.