Public archive

Research

06disclosures

DisclosuresWordfence profile ↗

16 Sep 2026CVE-2026-85122

Easy Form Builder 4.0.0–4.1.3Unauthenticated stored XSS via form type confusionCWE-79 · Civitasmass

8.8High 14 Sep 2026CVE-2026-82049

CPython < 3.14.0b1Tarfile extraction filter bypass via hard link to symlinkCWE-59 · JING QIAN (Civitasmass)

8.4High 12 Aug 2026CVE-2026-18961

VentraConnect Passwordless Login ≤ 1.4.3Unauthenticated authentication bypass via Spotify OAuth callbackCWE-287 · Civitasmass

8.1High 04 Aug 2026CVE-2026-17542

Bit File Manager < 6.9.1Subscriber+ sensitive data disclosure via bitapps_fm_connectorCWE-200 · JING QIAN

6.5Medium 27 Jul 2026CVE-2026-15014

SMS Alert for WooCommerce ≤ 3.9.7Unauthenticated authentication bypass to account takeoverCWE-288 · Civitasmass

9.8Critical 16 Jul 2026CVE-2026-14503

pCloud WP Backup ≤ 2.0.3Authorization failure exposing full-site backupsCWE-200 · Civitasmass

Platform activity

IntigritiWP Engine Bug Bounty · 1 accepted High

HackenProof17 paid reports · C4 H8 M4 L1

Results

Kaggle · AI Agent Security - Multi-Step Tool AttacksGold medal · 4,186 teams · September 2026

Gray Swan IPI ArenaIndirect prompt injection · July 2026

10th place 2026

The NeuroGolf ChampionshipARC tasks · ONNX model optimization