About MeCVEsAdvisoriesHall of FameProductsProjectsBlogContact
~/proof $ ls -la ./hall-of-fame

Don't take my word for it.
Take NASA's.

Public recognitions earned by Abhishek Bhaskar (Abhi HackZ) for responsibly disclosing real vulnerabilities in production systems — from NASA to six Bugcrowd VDP programs — plus 12 CVEs published and credited to Abhishek Nandkumar Bhaskar (Abhi-Hackz) by Progress Software, so it's never just one name.

PUBLIC · HOFNASA Hall of Fame recognition for Abhishek Bhaskar (Abhi HackZ)

NASA

Hall of Fame · 2026

Recognition for responsible vulnerability disclosure in a NASA production system.

PUBLIC · HOFNojoto Hall of Fame recognition for Abhishek Bhaskar (Abhi HackZ)

Nojoto

Hall of Fame

Recognition for responsible vulnerability disclosure.

⧉ view proof
PUBLIC · HOFRepAutomate Hall of Fame recognition for Abhishek Bhaskar (Abhi HackZ)

RepAutomate

Hall of Fame

Recognition for responsible vulnerability disclosure.

⧉ view proof
PRIVATE · VDPVero VDP recognition on Bugcrowd for Abhishek Bhaskar (Abhi HackZ)

Vero VDP

Bugcrowd · Private

Responsible disclosure recognition under the Vero VDP program.

⧉ view proof
PUBLIC · HOFProgress Sitefinity VDP Hall of Fame recognition on Bugcrowd for Abhishek Bhaskar (Abhi HackZ)

Progress Sitefinity VDP

Bugcrowd · Hall of Fame

Listed on the Sitefinity vulnerability disclosure program Hall of Fame on Bugcrowd — the same research that led to CVE-2026-92931.

⧉ view proof
PUBLIC · HOFChef VDP Hall of Fame recognition on Bugcrowd for Abhishek Bhaskar (Abhi HackZ)

Chef VDP

Bugcrowd · Hall of Fame

Recognised on the Progress Chef vulnerability disclosure program Hall of Fame on Bugcrowd for responsible disclosure.

⧉ view proof
PUBLIC · HOFDevTools VDP Hall of Fame recognition on Bugcrowd for Abhishek Bhaskar (Abhi HackZ)

DevTools VDP

Bugcrowd · Hall of Fame

Recognised on the Progress DevTools vulnerability disclosure program Hall of Fame on Bugcrowd for responsible disclosure.

⧉ view proof
PUBLIC · HOFProgress DataDirect VDP Hall of Fame recognition on Bugcrowd for Abhishek Bhaskar (Abhi HackZ)

Progress DataDirect VDP

Bugcrowd · Hall of Fame

Listed on the Progress DataDirect vulnerability disclosure program Hall of Fame on Bugcrowd — the research behind CVE-2026-91140.

⧉ view proof
PUBLIC · HOFProgress MarkLogic VDP Hall of Fame recognition on Bugcrowd for Abhishek Bhaskar (Abhi HackZ)

Progress MarkLogic VDP

Bugcrowd · Hall of Fame

Recognised on the Progress MarkLogic vulnerability disclosure program Hall of Fame on Bugcrowd for responsible disclosure.

⧉ view proof
~/cves $ cat ./disclosures

12 published CVEs

Abhishek Nandkumar Bhaskar (Abhi-Hackz) is the credited finder on 12 published CVE records, every one assigned by Progress Software acting as CVE Numbering Authority. Click a row for the full record, or open the vendor knowledge-base article.

CVE-2026-91140 Progress DataDirect — Shell-based temporary-file cleanup instructions in ARCGenAI-Generator 2.0 contain an OS command injection flaw. An attacker who supplies a crafted Swagger/OpenAPI document can run arbitrary commands on a developer’s machine when a user invokes the generator. CVSS 9.6 · fixed in 2.1. details →·CVE record ↗·vendor KB ↗ CRITICAL
CVE-2026-92931 Progress Sitefinity — Server-side request forgery in the Progress @progress/sitefinity-nextjs-sdk npm package. Remote attackers may be able to make server-side requests to attacker-controlled hosts, potentially exposing sensitive information. CVSS 8.8 · fixed in 15.4.8638. details →·CVE record ↗·vendor KB ↗ HIGH
CVE-2026-106138 Progress KendoReact — The default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and shared tooltip. A low-privileged attacker who can influence a string value bound to the chart can supply HTML with event handlers that run JavaScript in a user’s browser when the user hovers over the affected data point. CVSS 5.4 · fixed in 16.2.0. details →·CVE record ↗·Telerik KB ↗ MEDIUM
CVE-2026-106139 Progress Kendo UI for Vue — The default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and shared tooltips. A low-privileged attacker who can influence a string value bound to the chart can supply HTML with event handlers that run JavaScript in a user’s browser when the user hovers over the affected data point. CVSS 5.4 · fixed in 10.1.0. details →·CVE record ↗·Telerik KB ↗ MEDIUM
CVE-2026-106147 Progress Kendo UI for jQuery — The ListBox default item template renders the bound dataTextField value as raw HTML without encoding. Anyone able to modify that bound data can inject HTML with event handlers that run JavaScript in a user’s browser when the list item renders. CVSS 5.4 · fixed in 2026.3.1015. details →·CVE record ↗·Telerik KB ↗ MEDIUM
CVE-2026-106148 Progress Kendo UI for jQuery — The TabStrip, Menu and PanelBar components insert data source imageUrl values into single-quoted image src attributes without proper escaping. An attacker who can modify an image URL can inject extra HTML attributes, including event handlers, and run JavaScript when the component renders the image. CVSS 5.4 · fixed in 2026.3.1015. Co-credited with komyeonghane320f9, HanTul. details →·CVE record ↗·Telerik KB ↗ MEDIUM
CVE-2026-106149 Progress Kendo UI for jQuery — The Menu component builds HTML attributes from bound dataSource fields by string concatenation without neutralization. A low-privileged attacker who controls those fields can inject event-handler attributes that run JavaScript when a user interacts with the Menu. CVSS 5.4 · fixed in 2026.3.1015. details →·CVE record ↗·Telerik KB ↗ MEDIUM
CVE-2026-106150 Progress Kendo UI for jQuery — The Splitter, Window and Tooltip components build iframe markup without sanitizing URL values or encoding the Window iframe title. A low-privileged attacker controlling those values can inject HTML attributes, including JavaScript event handlers, via an apostrophe in an iframe URL or a crafted title. CVSS 5.4 · fixed in 2026.3.1015. details →·CVE record ↗·Telerik KB ↗ MEDIUM
CVE-2026-106151 Progress Kendo UI for jQuery — The Validator decodes validation messages from data-msg-* attributes and parses the result as HTML. An attacker who can modify a validation message can make HTML that was escaped in the page become active, including event handlers, when a user triggers validation. CVSS 5.4 · fixed in 2026.3.1015. details →·CVE record ↗·Telerik KB ↗ MEDIUM
CVE-2026-106153 Progress Kendo UI for jQuery — The month content templates for Calendar and MultiViewCalendar output data.url and data.title without URL sanitization or HTML attribute encoding. A low-privileged attacker controlling the URL option or the culture-derived title can supply a javascript: URL or inject event-handler attributes. CVSS 5.4 · fixed in 2026.3.1015. details →·CVE record ↗·Telerik KB ↗ MEDIUM
CVE-2026-106160 Progress Kendo UI for jQuery — Model.accept passes server-response keys to kendo.setter without blocking unsafe paths such as __proto__, constructor or prototype. An attacker who can supply data to an affected model can modify object prototype attributes, which may affect application behaviour and data integrity, including in server-side JavaScript. CVSS 5.4 · fixed in 2026.3.1015. details →·CVE record ↗·Telerik KB ↗ MEDIUM
CVE-2026-106161 Progress Kendo UI for jQuery — The Badge text method renders string values as raw HTML without encoding, including values supplied through text binding. An attacker who can modify Badge-bound data can inject HTML with event handlers that run JavaScript in a user’s browser. CVSS 5.4 · fixed in 2026.3.1015. details →·CVE record ↗·Telerik KB ↗ MEDIUM

Full CVE index with affected versions and fixes →

Platform profiles: HackerOne · HackerOne Hacktivity · Bugcrowd

What these recognitions mean

Every entry above came from finding a genuine security issue in a live system and reporting it through the right channel so it could be fixed before anyone abused it. A Hall of Fame listing is a vendor's public acknowledgement of that work. The same reasoning-first approach behind these disclosures is written up in detail across my security writeups — from the four Progress Software CVEs to how a VDP report becomes a published CVE.

Explore more

// product

SentryScan

My proof-based web vulnerability scanner and VAPT platform.

 // open source

Projects & Tools

The recon and automation tooling behind my workflow.

 // research

Blog & Writeups

Bug-bounty writeups and VAPT methodology deep-dives.

Want this kind of finding on your product?

The recognitions above came from the same testing I do for founders and startups.

Book a free 30-min scoping call →