HACKRATIC

Capture The Flag Team

EAT CTF SLEEP REPEAT
Scroll
About Us

WE ARE
HACKRATIC

A university student CTF team born out of the CCS Club. We learn, compete, and grow together — one challenge at a time.

What started as a small group of curious students has grown into a team that shows up, puts in the work, and keeps pushing to get better at every competition we enter.

5
Rosters
18
Members
Team Rosters
ROSTER
01

HACKRATIC

#01 — LEADWeb / PWN
now.sh

now.sh

Member 01

#02Crypto / RE
just_silence

just_silence

Member 02

#03Web / RE
bg0d

bg0d

Member 03

#04PWN / Forensics
xaccefy

xaccefy

Member 04

ROSTER
02

C47

#01 — LEADRE / Web
Mundur

Mundur

Member 01

#02Forensics / PWN
ryu7ero

ryu7ero

Member 02

#03Web / Crypto
deprrous

deprrous

Member 03

#04OSINT / Misc
chtga

chtga

Member 04

Achievements
Overall Rating Place (2026)
—
0.000 PTS
Country Place — Mongolia 🇲🇳
—
— EVENTS IN 2026
Participated in CTF events — 2026
PlaceEventCTF PtsRating Pts
Security Research

CVE &
BOUNTY

Vulnerabilities our members found in real software, reported responsibly, and got credited and paid for — outside of competition.

Total CVEs
22
43 findings disclosed
Total Bounty
$38,424
Paid out to members
Researchers
6
Credited on an advisory
Peak CVSS
9.8
Highest severity: CRITICAL
Headline finding
PUBLISHED
CRITICALCVSS 9.8
CVE-2026-59152↗
GHSA-f4xh-w4cj-qxq8 · 2026.06.19

Arbitrary server-side file read in the LangSmith SDK TracingMiddleware — a path traversal and origin-validation flaw let a remote, unauthenticated attacker read arbitrary files off the server.

Packagelangsmith (pip)
Affected< 0.8.18
Patched in0.8.18
ClassCWE-22, CWE-346, CWE-843 · Path Traversal / Origin Validation
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Reported by
ryu7ero
ryu7eroC47
Bounty
$1,500GitHub Advisory
VIEW ADVISORY↗
Hall of fame — who earned it
Select a name to filter the ledger
Disclosure ledger
43 entries
IDTargetSeverityResearcherBountyProgram
NO CVE2026.10 · REWARDED
web2py
S2
$2,000Google Patch Rewards Program
NO CVE2026.10 · REWARDED
web2py
S2
$2,000Google Patch Rewards Program
CVE-2026-728752026.07.21 · PUBLISHED
dokploy
HIGHCVSS 8.8
—GitHub Advisory
CVE-2026-734182026.07.20 · PUBLISHED
@auth/core / next-auth
HIGHCVSS 7.5
—Open source
CVE-2026-398222026.07 · PUBLISHED
Go os.Root
HIGHCVSS 7.8
$7,500Google OSS VRP
NO CVE2026.07 · REWARDED
Proton VPN GTK
—
$2,500Proton
NO CVE2026.07 · REWARDED
Proton Authenticator
HIGH
$150Proton
NO CVE2026.07 · CONFIRMED
@sveltejs/kit
MEDIUMCVSS 6.3
$500Vercel Open Source (HackerOne)
NO CVE2026.07 · CONFIRMED
Supabase
MEDIUMCVSS 4.3
—HackerOne
CVE-2026-591522026.06.19 · PUBLISHED
langsmith
CRITICALCVSS 9.8
$1,500GitHub Advisory
CVE-2026-554432026.06.12 · PUBLISHED
langchain / langchain-anthropic
MEDIUMCVSS 5.1
—Open source
NO CVE2026.06 · CONFIRMED
Livepeer
INFO
$250Immunefi
NO CVE2026.06 · REWARDED
Google Scholar PDF Reader
P3/S3
$500Google VRP
NO CVE2026.05.20 · PAID
Monday Trade Web
MEDIUM
$200HackenProof
NO CVE2026.05 · REWARDED
Gemini CLI
HIGH
$1,604.40Google Cloud VRP
NO CVE2026.05 · REWARDED
ClusterFuzz
—
$1,337Google OSS VRP
CVE-2026-425012026.05 · PUBLISHED
Go cmd/go
HIGHCVSS 7.5
—Google OSS VRP
CVE-2026-398262026.05 · PUBLISHED
Go html/template
MEDIUMCVSS 6.1
—Google OSS VRP
CVE-2026-449722026.05 · PUBLISHED
DataDog GuardDog
MEDIUMCVSS 5.0
—GitHub Security Advisory
CVE-2026-449712026.05 · PUBLISHED
DataDog GuardDog
HIGHCVSS 8.2
—GitHub Security Advisory
CVE-2026-329952026.05 · PUBLISHED
Rocket.Chat
HIGHCVSS 7.5
—HackerOne
NO CVE2026.04.21 · RESOLVED
Matomo
LOWCVSS 3.7
$333HackerOne
CVE-2026-414882026.04.16 · PUBLISHED
langchain-openai
LOWCVSS 3.1
—Open source
CVE-2026-411822026.04.14 · PUBLISHED
langsmith
MEDIUMCVSS 5.3
$500GitHub Advisory
CVE-2026-398592026.04.08 · PUBLISHED
liquidjs
MEDIUMCVSS 6.3
—GitHub Advisory
CVE-2026-322892026.04 · PUBLISHED
Go html/template
MEDIUMCVSS 6.1
$7,500Google OSS VRP
CVE-2026-339472026.04 · PUBLISHED
jq
MEDIUMCVSS 6.2
—GitHub Security Advisory
NO CVE2026.03.17 · PUBLISHED
@pdfme/schemas (SVG schema)
MEDIUMCVSS 6.1
—Open source
NO CVE2026.03.17 · PUBLISHED
@pdfme/schemas (Select schema)
MEDIUMCVSS 6.1
—Open source
CVE-2026-330362026.03.16 · PUBLISHED
fast-xml-parser
HIGHCVSS 7.5
—Open source
CVE-2026-333262026.03 · PUBLISHED
KeystoneJS@keystone-6/core (npm)
MEDIUMCVSS 4.3
—GitHub Advisory
NO CVE2026.03 · REWARDED
Optus ADFS
MEDIUM
$300Bugcrowd
CVE-2026-334772026.03 · PUBLISHED
FileRise
MEDIUMCVSS 4.3
—GitHub Security Advisory
CVE-2026-334692026.03 · PUBLISHED
Frigate
MEDIUMCVSS 6.5
—GitHub Security Advisory
CVE-2026-334702026.03 · PUBLISHED
Frigate
MEDIUMCVSS 6.5
—GitHub Security Advisory
CVE-2026-333302026.03 · PUBLISHED
FileRise
HIGHCVSS 7.1
—GitHub Security Advisory
CVE-2026-333542026 · PUBLISHED
avideo
MEDIUMCVSS 6.5
—TBD
NO CVECONFIRMED
Polygon
LOW
$500Immunefi
NO CVECONFIRMED
Livepeer
INFO
$250Immunefi
NO CVECONFIRMED
Ava Labs Avalanche
MEDIUM
$5,000Immunefi
NO CVECONFIRMED
Moonbeam Network
HIGH
$2,000Immunefi
NO CVECONFIRMED
ether.fi
LOW
$1,000Immunefi
NO CVECONFIRMED
NEO DLT
MEDIUM
$1,000Immunefi
04
RESULTS

EVENTS.

1ST PLACE
TOP 10 TEAMS

Харуул занги CTF 2026 Final

September 24, 2026
Ulaanbaatar, Mongolia
FINAL STANDINGS
TOP 10 TEAMS
R3inc4rnationchampions
1st
Mundur
Mundur
deprrous
deprrous
hackratictop 10 finish
8th
now.sh
now.sh
just_silence
just_silence
x4cc3
x4cc3

R3inc4rnation, hackratic members Mundur and deprrous, took 1st place at the Харуул занги CTF 2026 Final. hackratic (now.sh, just_silence and x4cc3) also made the top 10, finishing 8th.

01 / 02