Security Engineer at Amazon. I hunt unauthenticated remote code execution in the infrastructure that runs large language models: agent frameworks, inference servers, workflow orchestrators, and the serialization formats they trust.
7 CVEs assigned · 9 published advisories · 127 reports across 45 projects
| Advisory | Project | CVSS | Class |
|---|---|---|---|
| CVE-2026-57516 | ray |
 |
Code injection (CWE-94) |
| CVE-2026-45675 | open-webui |
 |
Privilege escalation (CWE-269) |
| CVE-2026-59714 | open-webui |
 |
Missing authorization (CWE-862) |
| GHSA-pqxw-g93w-hj9x | trigger.dev |
 |
Improper isolation (CWE-653) |
| CVE-2026-53577 | kestra |
 |
Incorrect authorization (CWE-863) |
| CVE-2026-63342 | hatchet |
 |
Incorrect authorization (CWE-863) |
| GHSA-59h8-w5q6-mfmp | trigger.dev |
 |
Missing authentication (CWE-306) |
| CVE-2026-73301 | @budibase/server |
 |
Missing authorization (CWE-862) |
| CVE-2026-59715 | open-webui |
 |
Missing authentication (CWE-306) |
Root cause, reproduction, and fix diffs for every one of these: sfwani/advisories
Table regenerates daily from the GitHub Advisory Database.
|
Unauthenticated reachability An auth gated code execution sink is a bug. The same sink reachable before auth is a 10.0. My highest severity findings are reachability failures rather than novel sinks: CWE-306 and CWE-862 standing in front of machinery that was never meant to be public. |
Sandboxes that are not sandboxes Agent frameworks ship "safe" Python evaluators built on AST allowlists. Format string dunder traversal, decorator abuse, and incomplete node denylists walk straight out of most of them. |
|
Deserialization on exposed ports
|
Request forgery into control planes My highest volume class (CWE-918): metadata endpoints, internal schedulers, and cluster APIs one redirect away from a user supplied URL. |
