Track record
Attribution, stated plainly.
Each entry links to a public source. Credited CVEs name the researcher in the vendor's own advisory. Acknowledgments were issued by the vendor or agency named. Reproductions are CVEs found by other researchers, rebuilt independently in order to understand them.
1CVE credited by Microsoft
4Acknowledgments from Microsoft and NASA
10Public CVEs reproduced, none claimed as discoveries
62Programs with valid submissions on Bugcrowd
Bug bounty and disclosure programs
Programs with reported findings.
MicrosoftThree online services acknowledgments published by MSRCMSRCNASALetter of appreciation under its Vulnerability Disclosure PolicyNASA VDPDropboxBugcrowdMastercardBugcrowdDell TechnologiesBugcrowdUnited AirlinesBugcrowdLenovoBugcrowdLastPassBugcrowdTripadvisorBugcrowdRakutenBugcrowdSeagateBugcrowdUnder ArmourBugcrowdKeeper SecurityBugcrowdT-MobileBugcrowdTwilioBugcrowdNFLBugcrowdU.S. Homeland SecurityBugcrowdU.S. TreasuryBugcrowd
Each tile links to its public source: Microsoft's acknowledgments, NASA's letter or the lead tester's Bugcrowd Hall of Fame, as of 9 Nov 2026. These are public bug bounty and disclosure programs. None is a client of ZeroDay Labs or endorses it. Logos are trademarks of their owners.
CVEs credited to this research
1 entry
CVE-2026-118742Azure Front Door Elevation of Privilege VulnerabilityMicrosoftHigh 8.6
Incorrect permission assignment for critical resource in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network. This is Microsoft's published description. Microsoft has not released further technical detail, so none is given here.
- Attribution
- Credited as finder by Microsoft in the Security Update Guide
- Affected
- Azure Front Door
- Category
- Privilege Escalation
- Severity from
- CVSS 3.1 base score in the CVE record. Microsoft rates it Important
- Verified
- 11 Nov 2026
Acknowledgments
4 entries
Microsoft online services acknowledgment, January 2026Microsoft
Microsoft lists this as an online services acknowledgment. No CVE is associated with it, and Microsoft does not publish the details of the report.
- Attribution
- Listed by name on the MSRC Security Update Guide
- Verified
- 9 Nov 2026
Microsoft online services acknowledgment, December 2025Microsoft
Microsoft lists this as an online services acknowledgment. No CVE is associated with it, and Microsoft does not publish the details of the report.
- Attribution
- Listed by name on the MSRC Security Update Guide
- Verified
- 9 Nov 2026
Microsoft online services acknowledgment, November 2025Microsoft
Microsoft lists this as an online services acknowledgment. No CVE is associated with it, and Microsoft does not publish the details of the report.
- Attribution
- Listed by name on the MSRC Security Update Guide
- Verified
- 9 Nov 2026
NASA Vulnerability Disclosure Policy letter of appreciationNASA
The letter recognises a vulnerability reported in line with NASA's Vulnerability Disclosure Policy. The vulnerability itself is not public and is not described here.
- Attribution
- Letter issued by the NASA Office of the Chief Information Officer
- Verified
- 9 Nov 2026
Public CVEs, independently reproduced
These vulnerabilities were found by other researchers, and ZeroDay Labs claims no credit for discovering them. Severity comes from the official CVE record.
CVE-2025-55182React Server Components pre-authentication RCEMetaCritical 10
Public CVE. Independent PoC. Not discovered here.
Unsafe deserialization of untrusted data in the packages that implement React Server Components (CWE-502), reachable before authentication.
- Attribution
- Vendor advisory. Independent PoC by Muhammad Waseem
- Affected
- React Server Components 19.0.0, 19.1.0, 19.1.1, 19.2.0
- Category
- Remote Code Execution
- Severity from
- CVE record, CNA Meta
- Verified
- 9 Nov 2026
CVE-2025-57819FreePBX authentication bypass leading to SQL injection and RCEFreePBXCritical 10
Public CVE. Independent PoC. Not discovered here.
Insufficiently sanitized input allows unauthenticated access to the FreePBX Administrator, arbitrary database manipulation and, from there, code execution (CWE-89, CWE-288).
- Attribution
- Vendor advisory. Independent PoC by Muhammad Waseem
- Affected
- FreePBX 15, 16 and 17 endpoint module
- Category
- Remote Code Execution
- Severity from
- CVE record, CVSS 4.0, CNA GitHub
- Verified
- 9 Nov 2026
CVE-2025-53770Microsoft SharePoint Server deserialization RCEMicrosoftCritical 9.8
Public CVE. Independent PoC. Not discovered here.
Deserialization of untrusted data in on-premises SharePoint Server lets an unauthorized attacker execute code over a network (CWE-502). Microsoft reported exploitation in the wild.
- Attribution
- Vendor advisory. Independent PoC by Muhammad Waseem
- Affected
- On-premises SharePoint Server
- Category
- Remote Code Execution
- Severity from
- CVE record, CNA Microsoft
- Verified
- 9 Nov 2026
CVE-2025-31131YesWiki path traversal through the squelette parameterYesWikiHigh 8.6
Public CVE. Independent PoC. Not discovered here.
The squelette parameter is vulnerable to path traversal, giving read access to arbitrary files on the server (CWE-22).
- Attribution
- Vendor advisory. Independent PoC by Muhammad Waseem
- Affected
- YesWiki before 4.5.2
- Category
- Web Security
- Severity from
- CVE record, CNA GitHub
- Verified
- 9 Nov 2026
CVE-2025-31125Vite server.fs.deny bypass with inline and raw importsViteMedium 5.3
Public CVE. Independent PoC. Not discovered here.
Non-allowed files can be read with ?inline&import or ?raw?import. Only apps that expose the dev server to the network are affected (CWE-200, CWE-284).
- Attribution
- Vendor advisory. Independent PoC by Muhammad Waseem
- Affected
- Vite development server
- Category
- Web Security
- Severity from
- CVE record, CNA GitHub
- Verified
- 9 Nov 2026
CVE-2025-29927Next.js middleware authorization bypassVercelCritical 9.1
Public CVE. Independent PoC. Not discovered here.
Authorization checks that run in Next.js middleware can be skipped (CWE-285). See the official advisory for affected versions and patches.
- Attribution
- Credited in the advisory to Allam Rachid (zhero) and Allam Yasser (inzo_). Independent PoC by Muhammad Waseem
- Affected
- Next.js before 12.3.5, 13.5.9, 14.2.25 and 15.2.3
- Category
- Authentication Bypass
- Severity from
- CVE record, CNA GitHub
- Verified
- 9 Nov 2026
CVE-2025-24799GLPI unauthenticated SQL injection in the inventory endpointGLPI ProjectHigh 7.5
Public CVE. Independent PoC. Not discovered here.
An unauthenticated user can perform SQL injection through the inventory endpoint (CWE-89).
- Attribution
- Vendor advisory. Independent scanner by Muhammad Waseem
- Affected
- GLPI before 10.0.18
- Category
- Web Security
- Severity from
- CVE record, CNA GitHub
- Verified
- 9 Nov 2026
CVE-2025-1661HUSKY Products Filter unauthenticated local file inclusionrealmag777Critical 9.8
Public CVE. Independent PoC. Not discovered here.
Local file inclusion through the template parameter of the woof_text_search AJAX action, without authentication (CWE-22).
- Attribution
- Credited in the CVE record to Hiroho Shimada. Independent PoC by Muhammad Waseem
- Affected
- HUSKY Products Filter Professional for WooCommerce, up to 1.3.6.5
- Category
- Web Security
- Severity from
- CVE record, CNA Wordfence
- Verified
- 9 Nov 2026
CVE-2025-24813Apache Tomcat path equivalence via partial PUTApache Software FoundationCritical 10
Public CVE. Independent PoC. Not discovered here.
Internal-dot path equivalence with a write-enabled Default Servlet can lead to remote code execution, information disclosure or added content in uploaded files (CWE-44, CWE-502).
- Attribution
- Credited in the CVE record to COSCO Shipping Lines DIC and sw0rd1ight. Independent PoC by Muhammad Waseem
- Affected
- Apache Tomcat
- Category
- Remote Code Execution
- Severity from
- CVE record, CISA ADP
- Verified
- 9 Nov 2026
CVE-2025-24016Wazuh server deserialization RCEWazuhCritical 9.9
Public CVE. Independent PoC. Not discovered here.
Unsafe deserialization of DistributedAPI parameters allows remote code execution on Wazuh servers (CWE-502).
- Attribution
- Vendor advisory. Independent PoC by Muhammad Waseem
- Affected
- Wazuh 4.4.0 to before 4.9.1
- Category
- Remote Code Execution
- Severity from
- CVE record, CNA GitHub
- Verified
- 9 Nov 2026
No reproductions match that search.