Discoveries Timeline

2026

27 advisories , 3 awards
πŸ”’
VCSA-2026-Q2-01 SharePoint Server EditingPagePaser filter bypass to RCE
πŸ”’
VCSA-2026-Q2-02 Multiple Privilege Escalations in Dynamics 365 online (Sales, Customer Service, Customer Insight) (x5-10)
πŸ”’
VCSA-2026-Q2-03 Multiple possible Copilot Autonomous Sales agent information disclosure (x2)
πŸ”’
VCSA-2026-Q2-04 Multiple possible Copilot Autonomous Sales agent inference manipulation (x2)
πŸ”’
CVE-2026-55040 SharePoint Server Subscription Edition SPApplicationAuthenticationModuleV2 Improper Authentication
Jul 14 πŸ”’
CVE-2026-56645 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Jul 3 πŸ”’
CVE-2026-58531 Microsoft Windows SMB Server Elevation of Privilege Vulnerability
Jul 1 πŸ”’
CVE-2026-50491 Microsoft Windows AppLocker Elevation of Privilege Vulnerability
Jul 1 πŸ”’
CVE-2026-50420 Microsoft Windows HTTP Protocol Stack Information Disclosure Vulnerability
Jul 1 πŸ”’
CVE-2026-50670 Microsoft Windows Win32k Elevation of Privilege Vulnerability
Jul 1 πŸ”’
CVE-2026-50475 Microsoft Windows Network I/O System Information Disclosure Vulnerability
Jul 1 πŸ”’
CVE-2026-50372 Microsoft Windows Redirected Drive Buffering SubSystem Elevation of Privilege Vulnerability
Jul 1 πŸ”’
CVE-2026-50396 Microsoft Windows HTTP Protocol Stack Elevation of Privilege Vulnerability
Jul 1 πŸ”’
CVE-2026-50493 DirectX Graphics Kernel Elevation of Privilege Vulnerability
Jul 1 πŸ”’
CVE-2026-50521 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Jun 26 πŸ”’
CVE-2026-48566 Windows DWM Core Library Information Disclosure Vulnerability
Jun 1 πŸ†
Top 5 Pwn2Own Berlin 2026
May 15 πŸ”’
CVE-2026-33112 SharePoint XmlValidator bypass lead to ExcelDataSet insecure deserialization
May 12 πŸ”’
CVE-2026-42896 Microsoft Windows Microsoft DWM Core Library Elevation of Privilege Vulnerability
May 1 πŸ”’
CVE-2026-35419 Windows DWM Core Library Information Disclosure Vulnerability
May 1 πŸ”’
VCSA-2026-Q1-09 Microsoft Dynamics 365 Remote Code Execution
Mar 31 πŸ”’
VCSA-2026-Q1-10 Microsoft Dynamics 365 Remote Code Execution
Mar 31 πŸ”’
VCSA-2026-Q1-11 Microsoft Dynamics 365 Online Information Disclosure Vulnerability
Mar 31 πŸ”’
VCSA-2026-Q1-12 Microsoft Dynamics 365 (On-Premises) Elevation of Privilege
Mar 31 πŸ”’
VCSA-2026-Q1-13 Microsoft Dynamics 365 (On-Premises) Elevation of Privilege
Mar 31 πŸ”’
VCSA-2026-Q1-07 Microsoft Dynamics 365 Elevation of Privilege
Feb 24 πŸ”’
VCSA-2026-Q1-08 Microsoft Dynamics 365 Elevation of Privilege
Jan 23 πŸ”’
CVE-2026-20831 CVE-2026-20831
Jan 13 πŸ†
Top 100 MSRC Microsoft 2026
Jul 1 πŸ†
Top 1 MSRC Technical Leaderboard (Edge) 2026
Jul 1

2025

21 advisories , 1 publication , 2 awards
πŸ”’
CVE-2025-64679 CVE-2025-64679
Dec 1 πŸ”’
CVE-2025-64680 CVE-2025-64680
Dec 1 πŸ”’
VCSA-2026-Q1-06 Microsoft Dynamics 365 Spoofing
Nov 13 πŸ”’
CVE-2025-62206 Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
Nov 11 πŸ”’
CVE-2025-59254 CVE-2025-59254
Oct 1 πŸ”’
CVE-2025-59255 CVE-2025-59255
Oct 1 πŸ”’
CVE-2025-53801 CVE-2025-53801
Sep 1 πŸ”’
CVE-2025-8298 Realtek Wi-Fi Windows USB Driver Vulnerability Elevation of Privilege Vulnerability
Sep 1 πŸ”’
CVE-2025-8299 Realtek Wi-Fi Windows USB Driver Vulnerability Elevation of Privilege Vulnerability
Sep 1 πŸ”’
CVE-2025-8300 Realtek Wi-Fi Windows USB Driver Vulnerability Elevation of Privilege Vulnerability
Sep 1 πŸ”’
CVE-2025-8301 Realtek Wi-Fi Windows USB Driver Vulnerability Elevation of Privilege Vulnerability
Sep 1 πŸ”’
CVE-2025-8302 Realtek Wi-Fi Windows USB Driver Vulnerability Elevation of Privilege Vulnerability
Sep 1 πŸ†
Top 100 MSRC Microsoft 2025
Aug 25 πŸ”’
CVE-2025-53728 Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
Aug 12 πŸ”’
CVE-2025-53792 Azure Portal Elevation of Privilege Vulnerability
Aug 1 πŸ”’
CVE-2025-53718 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Aug 1 πŸ”’
CVE-2025-53154 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Aug 1 πŸ”’
CVE-2025-49706 Microsoft SharePoint authentication bypass
Jul 8 πŸ”’
CVE-2025-49704 Microsoft SharePoint insecure deserialization
Jul 8 πŸ”’
CVE-2025-53771 Microsoft SharePoint authentication bypass
Jul 8 πŸ”’
CVE-2025-53770 Microsoft SharePoint insecure deserialization
Jul 8 πŸ”’
CVE-2025-53793 Azure Stack Hub Information Disclosure Vulnerability
Jul 1 πŸ“š
Red teaming with an underhyped SSRF: case study and new tool release
May 22 πŸ†
Top 2 Pwn2Own Berlin 2025
May 20

2024

3 advisories , 1 award
πŸ†
Top 100 MSRC Microsoft 2024
Oct 25 πŸ”’
CVE-2024-32987 CVE-2024-32987
Jun 1 πŸ”’
CVE-2024-38041 CVE-2024-38041
Jun 1 πŸ”’
CVE-2024-43944 CVE-2024-43944
Jun 1

2023

4 advisories , 2 awards
πŸ†
MSRC 2023 Most Valuable Security Researchers
Aug 8 πŸ”’
CVE-2023-21740 CVE-2023-21740
Jun 1 πŸ”’
CVE-2023-36702 CVE-2023-36702
Jun 1 πŸ”’
CVE-2023-36713 CVE-2023-36713
Jun 1 πŸ”’
CVE-2023-36900 CVE-2023-36900
Jun 1 πŸ†
Top 3 Master of Pwn at Pwn2Own Vancouver 2023
Mar 19

2022

15 advisories , 3 awards
πŸ†
MSRC 2022 Most Valuable Security Researchers
Aug 8 πŸ”’
CVE-2022-29108 CVE-2022-29108
Jun 1 πŸ”’
CVE-2022-37970 CVE-2022-37970
Jun 1 πŸ”’
CVE-2022-41076 CVE-2022-41076
Jun 1 πŸ”’
CVE-2022-41080 CVE-2022-41080
Jun 1 πŸ”’
CVE-2022-41092 CVE-2022-41092
Jun 1 πŸ”’
CVE-2022-44693 CVE-2022-44693
Jun 1 πŸ†
Winners of Pwn2Own Vancouver 2022
May 21 πŸ”’
CVE-2022-30158 CVE-2022-30158
May 9 πŸ”’
CVE-2022-23273 CVE-2022-23273
Apr 6 πŸ”’
CVE-2022-26910 CVE-2022-26910
Mar 21 πŸ”’
CVE-2022-26911 CVE-2022-26911
Mar 21 πŸ”’
CVE-2022-26920 CVE-2022-26920
Mar 1 πŸ”’
CVE-2022-23274 CVE-2022-23274
Feb 26 πŸ”’
CVE-2022-23272 CVE-2022-23272
Feb 26 πŸ”’
CVE-2022-23271 CVE-2022-23271
Feb 26 πŸ†
MSRC 2021 Q4 Most Valuable Security Researchers
Feb 1 πŸ”’
CVE-2022-21876 CVE-2022-21876
Jan 12

2021

22 advisories , 2 awards
πŸ”’
CVE-2021-26880 CVE-2021-26880
Dec 20 πŸ”’
CVE-2021-28443 CVE-2021-28443
Dec 20 πŸ”’
CVE-2021-34510 CVE-2021-34510
Dec 20 πŸ”’
CVE-2021-34513 CVE-2021-34513
Dec 20 πŸ”’
CVE-2021-34493 CVE-2021-34493
Dec 20 πŸ”’
CVE-2021-34512 CVE-2021-34512
Dec 20 πŸ”’
CVE-2021-34536 CVE-2021-34536
Dec 20 πŸ”’
CVE-2021-31198 CVE-2021-31198
Oct 22 πŸ”’
CVE-2021-41345 CVE-2021-41345
Oct 1 πŸ”’
CVE-2021-40488 CVE-2021-40488
Oct 1 πŸ”’
CVE-2021-40478 CVE-2021-40478
Oct 1 πŸ”’
CVE-2021-40489 CVE-2021-40489
Oct 1 πŸ”’
CVE-2021-26441 CVE-2021-26441
Oct 1 πŸ”’
CVE-2021-36975 CVE-2021-36975
Oct 1 πŸ†
MSRC 2021 Most Valuable Security Researchers
Aug 4 πŸ†
Winners of Pwn2Own Vancouver 2021
Apr 8 πŸ”’
CVE-2019-1136 CVE-2019-1136
Jan 1 πŸ”’
CVE-2020-0903 CVE-2020-0903
Jan 1 πŸ”’
CVE-2020-1476 CVE-2020-1476
Jan 1 πŸ”’
CVE-2020-1450 CVE-2020-1450
Jan 1 πŸ”’
CVE-2020-17142 CVE-2020-17142
Jan 1 πŸ”’
CVE-2020-17135 CVE-2020-17135
Jan 1 πŸ”’
CVE-2020-0933 CVE-2020-0933
Jan 1 πŸ”’
CVE-2019-1373 CVE-2019-1373
Jan 1

2020

8 advisories , 2 awards
πŸ”’
CVE-2020-17011 CVE-2020-17011
Nov 10 πŸ”’
CVE-2020-17045 CVE-2020-17045
Nov 6 πŸ”’
CVE-2020-16889 CVE-2020-16889
Oct 13 πŸ”’
CVE-2020-0998 CVE-2020-0998
Sep 8 πŸ†
MSRC 2020 Most Valuable Security Researchers
Aug 5 πŸ”’
CVE-2020-1022 CVE-2020-1022
Jun 1 πŸ”’
CVE-2020-0905 CVE-2020-0905
Jun 1 πŸ”’
CVE-2020-17152 CVE-2020-17152
Jun 1 πŸ”’
CVE-2020-17158 CVE-2020-17158
Jun 1 πŸ“š
ZDI-CAN-14002
Jun 1 πŸ“š
ZDI-CAN-14003
Jun 1 πŸ“š
ZDI-CAN-14004
Jun 1 πŸ“š
ZDI-CAN-14005
Jun 1 πŸ“š
ZDI-CAN-14006
Jun 1 πŸ“š
ZDI-CAN-15188
Jun 1 πŸ†
BugCrowd 2019 MVP Researchers
Jan 30

2019

1 award
πŸ†
MSRC 2019 Most Valuable Security Researchers
Aug 7

2018

1 award
πŸ†
BugCrowd 2018 MVP Researchers
Aug 10