Research

DisclosuresWordfence profile ↗

12 Oct 2026CVE-2026-105261

PublishPress Future 4.10.1–4.10.5Contributor+ stored XSS via shortcode attributesCWE-79 · Civitasmass

6.8Medium 16 Sep 2026CVE-2026-85122

Easy Form Builder 4.0.0–4.1.3Unauthenticated stored XSS via form type confusionCWE-79 · Civitasmass

8.8High 14 Sep 2026CVE-2026-82049

CPython < 3.14.0b1Tarfile extraction filter bypass via hard link to symlinkCWE-59 · JING QIAN (Civitasmass)

8.4High 12 Aug 2026CVE-2026-18961

VentraConnect Passwordless Login ≤ 1.4.3Unauthenticated authentication bypass via Spotify OAuth callbackCWE-287 · Civitasmass

8.1High 4 Aug 2026CVE-2026-17542

Bit File Manager < 6.9.1Subscriber+ sensitive data disclosure via bitapps_fm_connectorCWE-200 · JING QIAN

6.5Medium 27 Jul 2026CVE-2026-15014

SMS Alert for WooCommerce ≤ 3.9.7Unauthenticated authentication bypass to account takeoverCWE-288 · Civitasmass

9.8Critical 16 Jul 2026CVE-2026-14503

pCloud WP Backup ≤ 2.0.3Authorization failure exposing full-site backupsCWE-200 · Civitasmass

Platform activity

Intigriti2 accepted · WP Engine High, LangChain VDP

HackerOneAutomattic · 1 resolved with bounty

HackenProof17 paid reports · C4 H8 M4 L1

KaggleCompetitions Master · 1 gold, 3 silver, 1 bronze

Results

Kaggle · KaggricultureSilver medal · 10,148 teams · October 2026

379th place 2026

Kaggle · Biohub - Cell Tracking During DevelopmentSilver medal · 3,947 teams · September 2026

175th place 2026

Kaggle · AI Agent Security - Multi-Step Tool AttacksGold medal · 4,186 teams · September 2026

Kaggle · The Pokémon Company - PTCG AI Battle Challenge SimulationBronze medal · 6,807 teams · August 2026

502nd place 2026

Gray Swan IPI ArenaIndirect prompt injection · July 2026

10th place 2026

Kaggle · The 2026 NeuroGolf ChampionshipSilver medal · 2,963 teams · July 2026