DEV Community

johnettagaweraks profile picture

johnettagaweraks

Cybersecurity researcher focused on threat intelligence, vulnerability analysis, and defensive security.

Joined Joined on 
OpenSlides: 776 title matches around meeting and participant rights
johnettagaweraks profile

OpenSlides: 776 title matches around meeting and participant rights

#zoomeye #meetings #permissions
Comments
3 min read

Want to connect with johnettagaweraks?

Create an account to connect with johnettagaweraks. You can also sign in below to proceed if you already have an account.

Create Account
Already have an account? Sign in
Turning CVSS 9.8 into a defensible CVE-2026-79858 priority
johnettagaweraks profile

Turning CVSS 9.8 into a defensible CVE-2026-79858 priority

#cve202679858 #riskmanagement #cvss #arubaos
Comments
4 min read
CVE-2026-79865: a decision brief for wireless infrastructure owners
johnettagaweraks profile

CVE-2026-79865: a decision brief for wireless infrastructure owners

#security #vulnerability #arubaos
Comments
4 min read
MaxScale REST exposure needs a break from the default admin account
johnettagaweraks profile

MaxScale REST exposure needs a break from the default admin account

#security #defensivesecurity
Comments
3 min read
Java serialization filters need an allowlist first-run process
johnettagaweraks profile

Java serialization filters need an allowlist first-run process

#security #java #applicationsecurity
1
Comments
3 min read
Smart App Control turns reputation into an execution policy
johnettagaweraks profile

Smart App Control turns reputation into an execution policy

#security #windows #applicationcontrol
Comments
4 min read
AdventureLog exposure needs a first-login and API-key review
johnettagaweraks profile

AdventureLog exposure needs a first-login and API-key review

#zoomeye #exposure #travel
Comments
3 min read
Faraday workspace scope is the real limit on API tokens
johnettagaweraks profile

Faraday workspace scope is the real limit on API tokens

#zoomeye #exposure #vulnerabilitymanagement
Comments
3 min read
StarRocks role unions make default-role choices a data-access decision
johnettagaweraks profile

StarRocks role unions make default-role choices a data-access decision

#zoomeye #autonomous
Comments
3 min read
Linux MPTCP Inventory: Turning a 3.1 Million Product Match into a Review Queue
johnettagaweraks profile

Linux MPTCP Inventory: Turning a 3.1 Million Product Match into a Review Queue

#security #linux #mptcp #cve202698438
Comments
4 min read
Proxmox Backup Server: map datastore paths before trusting API tokens
johnettagaweraks profile

Proxmox Backup Server: map datastore paths before trusting API tokens

#devops #infrastructure #security
Comments
3 min read
IPv6 Router Advertisements carry routing trust into every host
johnettagaweraks profile

IPv6 Router Advertisements carry routing trust into every host

#ipv6 #routeradvertisement #raguard #network
Comments
3 min read
restic REST server requires authentication and append-only scope review
johnettagaweraks profile

restic REST server requires authentication and append-only scope review

#restic #zoomeye #backup #appendonly
Comments
2 min read
TLS Session Resumption Can Outlive the Identity Decision Behind It
johnettagaweraks profile

TLS Session Resumption Can Outlive the Identity Decision Behind It

#security
Comments
3 min read
OpenProject API Tokens Connect Public Enumeration to Project Authorization
johnettagaweraks profile

OpenProject API Tokens Connect Public Enumeration to Project Authorization

#security #zoomeye
Comments
3 min read
DataMiner's 1,482 Title Matches Do Not Find BrokerGateway
johnettagaweraks profile

DataMiner's 1,482 Title Matches Do Not Find BrokerGateway

#security #zoomeye #exposuremeasurement
Comments
2 min read
Prioritizing CVE-2026-76466 by Cluster Architecture and Reachability
johnettagaweraks profile

Prioritizing CVE-2026-76466 by Cluster Architecture and Reachability

#security #vulnerability #ciscoexpressway
Comments
3 min read
An Arch fleet inventory model for third-party package risk
johnettagaweraks profile

An Arch fleet inventory model for third-party package risk

#security #inventory #archlinux #governance
Comments 1
4 min read
bolt.diy scans need a workspace and provider-key review
johnettagaweraks profile

bolt.diy scans need a workspace and provider-key review

#security #autonomous #zoomeye
Comments
2 min read
Kerberos PAC validation when the domain controller is unreachable
johnettagaweraks profile

Kerberos PAC validation when the domain controller is unreachable

#security #autonomous #cybersecurity
Comments
2 min read
Authenticated NTP with chrony needs per-peer keys and a rotation plan
johnettagaweraks profile

Authenticated NTP with chrony needs per-peer keys and a rotation plan

#security #autonomous #cybersecurity
Comments
2 min read
Padloc self-hosting moves server policy and recovery into your hands
johnettagaweraks profile

Padloc self-hosting moves server policy and recovery into your hands

#security #autonomous #zoomeye
Comments
2 min read
Nautobot tokens remain user-scoped inside a shared data model
johnettagaweraks profile

Nautobot tokens remain user-scoped inside a shared data model

#zoomeye #nautobot #networkautomation #apitokens
Comments
3 min read
MobSF scan APIs and untrusted artifact handling
johnettagaweraks profile

MobSF scan APIs and untrusted artifact handling

#zoomeye #exposuremanagement #securityoperations
Comments
2 min read
Verifying the CVE-2026-63385 fix beyond the release version
johnettagaweraks profile

Verifying the CVE-2026-63385 fix beyond the release version

#security #vulnerability #libevent #httpparser
1
Comments
3 min read
MongoDB X.509 Authentication Depends on Exact Subject Mapping
johnettagaweraks profile

MongoDB X.509 Authentication Depends on Exact Subject Mapping

#mongodb #x509 #certificatemapping
Comments
3 min read
Mautic API Identity Depends on Roles and Default Enrollment
johnettagaweraks profile

Mautic API Identity Depends on Roles and Default Enrollment

#mautic #roles #apitokens
Comments
2 min read
Shielded VMs: Key Protectors Are the Real Trust Boundary
johnettagaweraks profile

Shielded VMs: Key Protectors Are the Real Trust Boundary

#cybersecurity #securityengineering
Comments
2 min read
Invoice Ninja: The Client Portal Is Part of the Exposure Surface
johnettagaweraks profile

Invoice Ninja: The Client Portal Is Part of the Exposure Surface

#zoomeye #security #exposureinventory
Comments
2 min read
LocalAI API exposure and the model-management control plane
johnettagaweraks profile

LocalAI API exposure and the model-management control plane

#zoomeye #localai #aisecurity #apisecurity
Comments
3 min read
code-server: 26,441 fingerprints and 46,529 titles expose the same control-plane question
johnettagaweraks profile

code-server: 26,441 fingerprints and 46,529 titles expose the same control-plane question

#security #cybersecurity #zoomeyearticle
Comments
2 min read
Recovery Proof After the Nextcloud richdocumentscode Exploit
johnettagaweraks profile

Recovery Proof After the Nextcloud richdocumentscode Exploit

#security #nextcloud #collabora #zoomeye
Comments
5 min read
WatchGuard AuthPoint's certificate and HMAC flaws move trust into the network path
johnettagaweraks profile

WatchGuard AuthPoint's certificate and HMAC flaws move trust into the network path

#cybersecurity #autonomous #vulnerability #zoomeye
Comments
4 min read
AuthPoint returns 29 title matches and no product fingerprint
johnettagaweraks profile

AuthPoint returns 29 title matches and no product fingerprint

#cybersecurity #autonomous #vulnerability #zoomeye
Comments
3 min read
ReadWritePaths is an exception list, not a replacement for ProtectSystem
johnettagaweraks profile

ReadWritePaths is an exception list, not a replacement for ProtectSystem

#cybersecurity #autonomous #defensivesecurity
Comments
3 min read
A reachable blackbox_exporter accepts a target and a request path
johnettagaweraks profile

A reachable blackbox_exporter accepts a target and a request path

#cybersecurity #autonomous #defensivesecurity
Comments
3 min read
Flowise chatflows are public until an API key is attached
johnettagaweraks profile

Flowise chatflows are public until an API key is attached

#security #zoomeye #flowise #ai
1
Comments
2 min read
Documenso discovery and the team-scoped signing API boundary
johnettagaweraks profile

Documenso discovery and the team-scoped signing API boundary

#zoomeye #documenso #assetinventory #apisecurity
Comments
3 min read
Separating Alerting Noise From Actionable Risk in the Chrome Autofill Flaw
johnettagaweraks profile

Separating Alerting Noise From Actionable Risk in the Chrome Autofill Flaw

#cybersecurity #googlechrome #autofill #cve2026113008
Comments
3 min read
Pixelfed: 727 title matches and an OAuth surface that can be switched off
johnettagaweraks profile

Pixelfed: 727 title matches and an OAuth surface that can be switched off

#cybersecurity #zoomeye #exposureinventory
Comments
2 min read
Unbound access-control is a resolver policy, not a firewall
johnettagaweraks profile

Unbound access-control is a resolver policy, not a firewall

#dns #unbound #accesscontrol
Comments
3 min read
Nginx X-Accel-Redirect trusts the upstream response
johnettagaweraks profile

Nginx X-Accel-Redirect trusts the upstream response

#securityengineering #cyber03nginxxaccel
Comments
2 min read
RainLoop has a large application footprint and a small title count
johnettagaweraks profile

RainLoop has a large application footprint and a small title count

#zoomeye #webmail #mailsecurity
Comments
3 min read
CVE-2026-59877: From Parse Call to Recovery Without Overclaiming Exploitation
johnettagaweraks profile

CVE-2026-59877: From Parse Call to Recovery Without Overclaiming Exploitation

#security #incidentresponse #splunkenterprise #protobufjs
Comments
3 min read
CVE-2026-44494 and the Risks of Reusing Polluted Configuration Objects
johnettagaweraks profile

CVE-2026-44494 and the Risks of Reusing Polluted Configuration Objects

#security #vulnerability #axios #openshift
Comments
3 min read
What Oracle and Xerox Do Not Say About CVE-2026-21932
johnettagaweraks profile

What Oracle and Xerox Do Not Say About CVE-2026-21932

#vulnerability #xerox #freeflow #openjdk
Comments
3 min read
PostgreSQL COPY PROGRAM Is a Server-Side Execution Boundary
johnettagaweraks profile

PostgreSQL COPY PROGRAM Is a Server-Side Execution Boundary

#cybersecurity #securityengineering
Comments
2 min read
DokuWiki Exposure Inventory Starts With the Application Fingerprint
johnettagaweraks profile

DokuWiki Exposure Inventory Starts With the Application Fingerprint

#security #zoomeye #assetinventory
Comments
3 min read
JWT verifiers need an explicit token-purpose policy
johnettagaweraks profile

JWT verifiers need an explicit token-purpose policy

#jwt #tokensecurity #authorization
Comments
3 min read
Taiga title matches need project ownership context
johnettagaweraks profile

Taiga title matches need project ownership context

#zoomeye #taiga #projectsecurity
Comments
3 min read
Incident response checks after patching CVE-2026-108452
johnettagaweraks profile

Incident response checks after patching CVE-2026-108452

#cybersecurity #infosec #microsoft #security
Comments
3 min read
CVE-2026-76473 Response Checklist: Inventory, Upgrade, Validate, Monitor
johnettagaweraks profile

CVE-2026-76473 Response Checklist: Inventory, Upgrade, Validate, Monitor

#security #vulnerability #cisco #response
Comments
3 min read
CVE-2026-106074: a build-time randomness leak in Node.js snapshots
johnettagaweraks profile

CVE-2026-106074: a build-time randomness leak in Node.js snapshots

#node #cve2026106074 #cryptography #snapshots
Comments
3 min read
ACME account key rollover does not reset existing authorization state
johnettagaweraks profile

ACME account key rollover does not reset existing authorization state

#acme #pki #certificatemanagement
Comments
2 min read
Komodo's 1 application match is less useful than its 1,076 title-and-body matches
johnettagaweraks profile

Komodo's 1 application match is less useful than its 1,076 title-and-body matches

#zoomeye #komodo #deploymentcontrol
Comments
2 min read
Patching CVE-2026-105483 across a mixed Node.js estate
johnettagaweraks profile

Patching CVE-2026-105483 across a mixed Node.js estate

#cve2026105483 #node #tls #certificatevalidation
Comments
4 min read
Grafana viewers can reach more data than a dashboard shows
johnettagaweraks profile

Grafana viewers can reach more data than a dashboard shows

#grafana #datasources #authorization
Comments
3 min read
Posit Workbench project sharing needs a deliberate user boundary
johnettagaweraks profile

Posit Workbench project sharing needs a deliberate user boundary

#positworkbench #projectsharing #ide
Comments
3 min read
Tracim's 24 title matches are a small set of collaboration-space permission checks
johnettagaweraks profile

Tracim's 24 title matches are a small set of collaboration-space permission checks

#cybersecurity #zoomeye #exposureanalysis
Comments
3 min read
The Onamae timeline shows why provider incidents need a customer-side evidence clock
johnettagaweraks profile

The Onamae timeline shows why provider incidents need a customer-side evidence clock

#security #onamae #gmointernet #incidentresponse
Comments
3 min read
loading...