Registry & coordination contributor

HackerOne

CNA assigner on 27 (independent) of 27 known-exploited records. Every aggregate on this page is recomputed from the records listed below — each one already cited to its public source.

No vendor advisory domain is cited for this contributor in the corpus — its credit here is as a CNA/finder. Home URL is a stated coverage gap.

Independent CNA

records cited in

deterministic count

finder / reporter credits

CVE.org credits

CVE records catalogued (CNA)

independent

65%

avg modeled exploit prob.

FIRST EPSS, 27/27

41%

ransomware-associated

11 of 27 · CISA flag

Known for

— recomputed from this contributor’s own records

SurfacesEdge / remote-access infra (20), Application / other (7)

WeaknessInjection (9), Path traversal / file (5), Authorization / access control (5), Authentication (5)

PortfolioIvanti (15), Citrix (4), Ubiquiti (3), Veeam (2), Rails (1), Pulse Secure (1)

Narrative reach

— how far this contributor’s records carry an attacker, front door → lights out

1Front door

24reach this stage

→

2Keys to the kingdom

24reach this stage

→

3Lateral reach

23reach this stage

→

4Data at risk

10reach this stage

→

5Lights out

2reach this stage

Furthest any of these records carries an attacker: 5 · Lights out. 10 of 24 narrative-framed records reach data-at-risk or lights-out. (furthest-position idiom, reused from the landing map; the stage mapping is a model output over cited evidence.)

Recent highlights

— this contributor’s newest known-exploited records

CVE-2026-34908Ubiquiti2%KEV CVE-2026-34909Ubiquiti2%KEV CVE-2026-34910Ubiquiti79%KEV CVE-2019-5418Rails99%KEV CVE-2024-40711Veeam88%RWKEV CVE-2024-29824Ivanti100%KEV

Every record they’re cited in

— all 27, each linked to its cited source

This is the evidence behind every number above. Sorted ransomware-first, then by modeled exploit probability.

Coverage & confidence

— what this profile claims, and what it does not

Established (cited)

Cited in 27 known-exploited records — the list below; every one links to its public source.

Catalogued 27 CVE record(s) as the CNA assigner (from CVE.org).

Coverage gaps — stated, not hidden

This profile is an aggregation: it asserts only what the listed records already cite — no new external claim about the contributor is made.

The TYPE badge and the narrative-stage mapping are editorial (our call), labeled as such, not a sourced fact.

No vendor advisory home domain is cited for this contributor in the corpus.