Skip to content
View tomasilluminati's full-sized avatar
♾️
♾️
23 followers · 28 following

Achievements

Achievement: Pull SharkAchievement: Pair Extraordinaire

Achievements

Achievement: Pull SharkAchievement: Pair Extraordinaire

Highlights

Block or report tomasilluminati

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
tomasilluminati/README.md

About Me

I'm a Cybersecurity Analyst and Threat Intelligence Specialist with hands-on experience in offensive security, threat hunting, and vulnerability research.

Core Areas of Work

  • Threat Intelligence
  • Vulnerability Research
  • Offensive Security
  • Malware Analysis & Reverse Engineering
 Cybersecurity animation

Discovered CVEs (13)

Vulnerabilities I discovered and reported. Open an entry for technical details and references.

CVE-2026-106550: Denial of service in node-convict config.set()

Component: mozilla/node-convict
Affected Versions: >= 6.2.2

CVE Published: 2026-10-06 (CERT/CC)
Status: DISCLOSED

References

CVE.org, Write-up (GitHub)

CVE-2026-14978: .terraformignore exclusion bypass in HashiCorp go-slug

Component: hashicorp/go-slug
Affected Versions: >= 0.4.0, <= 0.18.2
Fixed in: 0.18.3

Severity: Medium (5.5, CVSS 3.1, IBM CNA)
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Advisory Published: 2026-08-19 (IBM)
Status: PATCHED and DISCLOSED

References

Advisory (IBM), HashiCorp HCSEC-2026-31, Advisory (GitHub), CVE.org, NVD

CVE-2026-76164: Authenticated SSRF in the AIL Framework crawler

Component: ail-project/ail-framework
Affected Versions: < 7.0
Fixed in: 7.0

Severity: High (7.1, CVSS 4.0, CIRCL CNA)
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Advisory Published: 2026-08-19 (CIRCL)
Status: PATCHED and DISCLOSED

References

Advisory (CIRCL / GCVE), CVE.org

CVE-2026-13723: Arbitrary file overwrite in app-builder via symlink following

Component: develar/app-builder
Affected Versions: <= 4.2.0
Upstream Fix: No upstream release identified in the CERT/CC advisory; downstream mitigations are documented.

Severity: Medium (6.5, CVSS 3.1, CISA-ADP, via NVD)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Advisory Published: 2026-07-29 (CERT/CC)
Status: DISCLOSED

References

Advisory (CERT/CC), CVE.org, NVD

CVE-2026-39359: Unauthenticated path traversal in Wazuh authd

Component: wazuh / wazuh-manager
Affected Versions: >= 4.0.0, < 4.10.4 or >= 4.11.0, < 4.14.5
Fixed in: 4.10.4; 4.14.5

Severity: High (7.5, CVSS 3.1, GitHub CNA)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Advisory Published: 2026-07-16 (GitHub)
Status: PATCHED and DISCLOSED

References

Advisory (GitHub), CVE.org, NVD

CVE-2026-59890: MANIFEST.in exclusion bypass in setuptools

Component: pypa/setuptools
Affected Versions: < 83.0.0
Fixed in: 83.0.0

Severity: Medium (6.1, CVSS 3.1, GitHub CNA)
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Advisory Published: 2026-07-04 (GitHub)
Status: PATCHED and DISCLOSED

References

Advisory (GitHub), CVE.org, NVD, Patch

CVE-2026-56448: Path traversal in AIL Framework investigation downloads

Component: ail-project/ail-framework
Affected Versions: <= 6.8.0
Patch: 0041456

Severity: High (8.3, CVSS 4.0, CIRCL CNA)
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/S:P

Advisory Published: 2026-06-22 (CIRCL)
Status: PATCHED and DISCLOSED

References

Advisory (CIRCL / GCVE), CVE.org

CVE-2026-49401: Permission bypass in Deno via Unicode path normalization

Component: deno
Affected Versions: < 2.7.14
Fixed in: 2.7.14

Severity: High (8.4, CVSS 3.1, NVD)
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Advisory Published: 2026-05-27 (GitHub)
Status: PATCHED and DISCLOSED

References

Advisory (GitHub), CVE.org, NVD

CVE-2026-42304: Denial of service in Twisted DNS name decompression

Component: Twisted (twisted.names)
Affected Versions: < 26.4.0rc2
Fixed in: 26.4.0rc2

Severity: High (7.5, CVSS 3.1, GitHub CNA)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Advisory Published: 2026-04-29 (GitHub)
Status: PATCHED and DISCLOSED

References

Advisory (GitHub), CVE.org, NVD

CVE-2026-33487: XML signature verification bypass in goxmldsig

Component: russellhaering/goxmldsig
Affected Versions: < 1.6.0
Fixed in: 1.6.0

Severity: High (7.5, CVSS 3.1, GitHub CNA)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Advisory Published: 2026-03-18 (GitHub)
Status: PATCHED and DISCLOSED

References

Advisory (GitHub), CVE.org, NVD

CVE-2026-33242: Path traversal and API gateway bypass in Salvo

Component: salvo / salvo-proxy
Affected Versions: >= 0.39.0, < 0.89.3
Fixed in: 0.89.3

Severity: High (7.5, CVSS 3.1, GitHub CNA)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Advisory Published: 2026-03-18 (GitHub)
Status: PATCHED and DISCLOSED

References

Advisory (GitHub), CVE.org, NVD

CVE-2026-29091: Code injection in locutus call_user_func_array

Component: locutus
Affected Versions: < 3.0.0
Fixed in: 3.0.0 (GitHub Advisory Database)

Severity: High (8.1, CVSS 3.1, GitHub CNA)
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Advisory Published: 2026-03-03 (GitHub)
Status: PATCHED and DISCLOSED

References

Advisory (GitHub), CVE.org, NVD

CVE-2026-23950: Unicode path reservation race condition in node-tar

Component: node-tar (npm: tar)
Affected Versions: < 7.5.4
Fixed in: 7.5.4

Severity: High (8.8, CVSS 3.1, GitHub CNA)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L

Advisory Published: 2026-01-19 (GitHub)
Status: PATCHED and DISCLOSED

References

Advisory (GitHub), CVE.org, NVD

Certifications

TRM Crypto Seizure Specialist (TRM-CSS) badge. Verify credential
TRM-CSS
Crypto Seizure Specialist
TRM Labs 		Certificate of Cloud Security Knowledge (CCSK v5) badge. Verify credential
CCSK v5
Certificate of Cloud Security Knowledge
Cloud Security Alliance

Community & Affiliations

OWASP OSINT.UK OSMOSIS IAFIE IALEIA ISOC ISOC ISOC ISOC ASIS

Footer

Popular repositories Loading

  1. tomasilluminati tomasilluminati Public

    Personal Bio README

  2. bazel bazel Public

    Forked from bazelbuild/bazel

    a fast, scalable, multi-language and extensible build system

    Java

  3. commons-compress commons-compress Public

    Forked from apache/commons-compress

    Apache Commons Compress

    Java

  4. app-builder app-builder Public

    Forked from develar/app-builder

    Generic helper tool to build app in a distributable format

    Go

  5. libarchive libarchive Public

    Forked from libarchive/libarchive

    Multi-format archive and compression library

    C

  6. security-research security-research Public