Afan

Patchstack Bug Bounty Program

7 credited records · 7 in the last 12 months · 0 in CISA KEV

Names are free text from CNA records; the same person may appear under different spellings. Write to us for corrections.

Get told when this name is credited on a new CVE

If it's you, this is the easiest way to track your records: we'll notify you in the daily email digest when a new one is published.

Credited records

Researchers

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2026-110955No exploit	Wurdey <= 1.0.0 - Unauthenticated Administrator Authentication Bypassunknown · wurdey · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.1%	1 day ago
39Monitor	CVE-2026-100109Proof of concept	Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_userunknown · security for woocommerce · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.3%	2 days ago
32Monitor	CVE-2026-14873No exploit	Bulk Password Reset <= 1.3.3 - Authenticated (Subscriber+) Arbitrary Password Resetrubenw · bulk password reset · CWE-862 Broken access control (IDOR)	High8.0	—	0.4%	Sep 10, 2026
39Monitor	CVE-2026-15341No exploit	User Session Synchronizer <= 1.4.0 - Unauthenticated Authentication Bypass to Account Takeover via 'ussync-key', 'ussync-token', and 'ussync-ref' Parametersrafasashi · user session synchronizer · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.5%	Aug 14, 2026
39Monitor	CVE-2026-15303No exploit	6Storage Rentals <= 2.27.0 - Unauthenticated Account Takeover via 'email' Parametersixstorage · 6storage rentals · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.8%	Aug 14, 2026
35Monitor	CVE-2026-16635No exploit	Pronamic Pay <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' Fieldpronamic · pronamic pay · CWE-269	High8.8	—	0.5%	Aug 1, 2026
35Monitor	CVE-2026-59541No exploit	WordPress WP BASE Booking plugin <= 6.3.1 - Privilege Escalation vulnerabilityhakan ozevin · wp base booking · CWE-266	High8.8	—	0.4%	Jul 23, 2026

CVE-2026-110955
39Monitor
Wurdey <= 1.0.0 - Unauthenticated Administrator Authentication Bypass
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
unknown · wurdey1 day ago
CVE-2026-100109
39Monitor
Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_user
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
unknown · security for woocommerce2 days ago
CVE-2026-14873
32Monitor
Bulk Password Reset <= 1.3.3 - Authenticated (Subscriber+) Arbitrary Password Reset
HighCVSS 8.0No exploitEPSS 0%
- Broken access control (IDOR)
rubenw · bulk password resetSep 10, 2026
CVE-2026-15341
39Monitor
User Session Synchronizer <= 1.4.0 - Unauthenticated Authentication Bypass to Account Takeover via 'ussync-key', 'ussync-token', and 'ussync-ref' Parameters
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
rafasashi · user session synchronizerAug 14, 2026
CVE-2026-15303
39Monitor
6Storage Rentals <= 2.27.0 - Unauthenticated Account Takeover via 'email' Parameter
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
sixstorage · 6storage rentalsAug 14, 2026
CVE-2026-16635
35Monitor
Pronamic Pay <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' Field
HighCVSS 8.8No exploitEPSS 0%
pronamic · pronamic payAug 1, 2026
CVE-2026-59541
35Monitor
WordPress WP BASE Booking plugin <= 6.3.1 - Privilege Escalation vulnerability
HighCVSS 8.8No exploitEPSS 0%
hakan ozevin · wp base bookingJul 23, 2026