These are the CVEs I discovered during my vulnerability research journey. Each vulnerability was identified through manual analysis, source code review, and security testing across different components and applications.
The reports below summarize my research process, including how each issue was discovered, why it is considered a security vulnerability, its potential impact, and how it could be reproduced in a controlled environment.
You can refer to the reports below to learn more about each CVE.
| CVE | Bounty | Priority | Vulnerability | Report | Date |
|---|---|---|---|---|---|
| CVE-2026-42743 | 89.7 AXP | High | Masteriyo LMS Lemon Squeezy Webhook Forgery | 🔗 📄 | 28 May, 2026 |
| CVE-2026-54804 | 22.8 AXP | High | Melhor Envio Subscriber API Token Disclosure and Overwrite | 🔗 📄 | 16 Jun, 2026 |
| CVE-2026-54826 | 7.6 AXP | Medium | SupportCandy Attachment IDOR via Thread Endpoint | 🔗 📄 | 17 Jun, 2026 |
| CVE-2026-54840 | 14.6 AXP | Medium | Newsletters - Unauthenticated Subscriber Management Account Takeover | 🔗 📄 | 18 Jun, 2026 |
| CVE-2026-57341 | 13 AXP | Medium | Colissimo Officiel Unauthenticated Shipping Rate Tampering | 🔗 📄 | 29 Jun, 2026 |
| CVE-2026-57365 | 6.5 AXP | Medium | Stored XSS in reCAPTCHA for Asgaros Forum via Site Key | 🔗 📄 | 6 Jul, 2026 |
| CVE-2026-57408 | 13 AXP | Low | Payment Status Forgery via Unauthenticated Webhook | 🔗 📄 | 8 Jul, 2026 |
| CVE-2026-61948 | 18.6 AXP | High | Unauthenticated SQL Injection in Mini Cart Coupon REST Endpoint | 🔗 📄 | 16 Jul, 2026 |
| CVE-2026-59557 | 13 AXP | Medium | Events Made Easy Arbitrary Person Record Modification Without Login | 🔗 📄 | 24 Jul, 2026 |
I have participated in the Patchstack Alliance vulnerability research program across multiple months, where I reported security vulnerabilities, received bounties, and appeared on the monthly researcher leaderboard.
The screenshot below shows one of my achievements in April 2026, where I ranked 14th on the Patchstack monthly leaderboard.
