guest@sudomake:~$ cd /research

research_

Found. Reported. Patched.

cves
guest@sudomake:~/research$ ls -la ./advisories
idtargetseveritystatus
CVE-2026-55806Drupal coreCache poisoning & open redirectlowpublicCVE-2026-40167Collabora OnlineSSRF in settings endpointsmoderatepending

// Details go public only after the vendor ships a fix.

bug bounty

Three platforms. One handle each.

YesWeHack✓ verified
@melih67
65
reports
244
points
#1144
rank
profile ↗
HackerOne✓ verified
@molly67
$3,000
bounty
1
thanks
profile ↗
Bugcrowd✓ verified
@Musky
3
valid vulns
100%
accuracy
profile ↗
top payout

Unauthenticated reflected SSRF & RFI in a Collabora editor

HackerOne · Inspectorio · ● resolved · bounty paid
$3,000
what I find most
  • IDORCWE-639
  • Broken access controlCWE-284
  • Business logicCWE-840
  • SSRFCWE-918
  • Sensitive data exposureCWE-200
  • Host header injectionCVE-2026-55806