HACKRATIC

Capture The Flag Team

EAT CTF SLEEP REPEAT
Scroll
About Us

WE ARE
HACKRATIC

A university student CTF team born out of the CCS Club. We learn, compete, and grow together — one challenge at a time.

What started as a small group of curious students has grown into a team that shows up, puts in the work, and keeps pushing to get better at every competition we enter.

5
Rosters
18
Members
Team Rosters
ROSTER
01

HACKRATIC

#01 — LEADWeb / PWN
now.sh

now.sh

Member 01

#02Crypto / RE
just_silence

just_silence

Member 02

#03Web / RE
bg0d

bg0d

Member 03

#04PWN / Forensics
xaccefy

xaccefy

Member 04

ROSTER
02

C47

#01 — LEADRE / Web
Mundur

Mundur

Member 01

#02Forensics / PWN
ryu7ero

ryu7ero

Member 02

#03Web / Crypto
deprrous

deprrous

Member 03

#04OSINT / Misc
chtga

chtga

Member 04

Achievements
Overall Rating Place (2026)
—
0.000 PTS
Country Place — Mongolia 🇲🇳
—
— EVENTS IN 2026
Participated in CTF events — 2026
PlaceEventCTF PtsRating Pts
Security Research

CVE &
BOUNTY

Vulnerabilities our members found in real software, reported responsibly, and got credited and paid for — outside of competition.

Total CVEs
17
30 findings disclosed
Total Bounty
$31,924
Paid out to members
Researchers
5
Credited on an advisory
Peak CVSS
9.8
Highest severity: CRITICAL
Headline finding
PUBLISHED
CRITICALCVSS 9.8
CVE-2026-59152↗
GHSA-f4xh-w4cj-qxq8 · 2026.06.19

Arbitrary server-side file read in the LangSmith SDK TracingMiddleware — a path traversal and origin-validation flaw let a remote, unauthenticated attacker read arbitrary files off the server.

Packagelangsmith (pip)
Affected< 0.8.18
Patched in0.8.18
ClassCWE-22, CWE-346, CWE-843 · Path Traversal / Origin Validation
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Reported by
ryu7ero
ryu7eroC47
Bounty
$1,500GitHub Advisory
VIEW ADVISORY↗
Hall of fame — who earned it
Select a name to filter the ledger
Disclosure ledger
30 entries
IDTargetSeverityResearcherBountyProgram
CVE-2026-728752026.07.21 · PUBLISHED
dokploy
HIGHCVSS 8.8
—GitHub Advisory
CVE-2026-398222026.07 · PUBLISHED
Go os.Root
HIGHCVSS 7.8
$7,500Google OSS VRP
NO CVE2026.07 · REWARDED
Proton VPN GTK
—
$2,500Proton
NO CVE2026.07 · REWARDED
Proton Authenticator
HIGH
$150Proton
CVE-2026-591522026.06.19 · PUBLISHED
langsmith
CRITICALCVSS 9.8
$1,500GitHub Advisory
NO CVE2026.06 · CONFIRMED
Livepeer
INFO
$250Immunefi
NO CVE2026.06 · REWARDED
Google Scholar PDF Reader
P3/S3
$500Google VRP
NO CVE2026.05.20 · PAID
Monday Trade Web
MEDIUM
$200HackenProof
NO CVE2026.05 · REWARDED
Gemini CLI
HIGH
$1,604.40Google Cloud VRP
NO CVE2026.05 · REWARDED
ClusterFuzz
—
$1,337Google OSS VRP
CVE-2026-425012026.05 · PUBLISHED
Go cmd/go
HIGHCVSS 7.5
—Google OSS VRP
CVE-2026-398262026.05 · PUBLISHED
Go html/template
MEDIUMCVSS 6.1
—Google OSS VRP
CVE-2026-449722026.05 · PUBLISHED
DataDog GuardDog
MEDIUMCVSS 5.0
—GitHub Security Advisory
CVE-2026-449712026.05 · PUBLISHED
DataDog GuardDog
HIGHCVSS 8.2
—GitHub Security Advisory
NO CVE2026.04.21 · RESOLVED
Matomo
LOWCVSS 3.7
$333HackerOne
CVE-2026-411822026.04.14 · PUBLISHED
langsmith
MEDIUMCVSS 5.3
$500GitHub Advisory
CVE-2026-398592026.04.08 · PUBLISHED
liquidjs
MEDIUMCVSS 6.3
—GitHub Advisory
CVE-2026-322892026.04 · PUBLISHED
Go html/template
MEDIUMCVSS 6.1
$7,500Google OSS VRP
CVE-2026-339472026.04 · PUBLISHED
jq
MEDIUMCVSS 6.2
—GitHub Security Advisory
CVE-2026-333262026.03 · PUBLISHED
KeystoneJS@keystone-6/core (npm)
MEDIUMCVSS 4.3
—GitHub Advisory
NO CVE2026.03 · REWARDED
Optus ADFS
MEDIUM
$300Bugcrowd
CVE-2026-334772026.03 · PUBLISHED
FileRise
MEDIUMCVSS 4.3
—GitHub Security Advisory
CVE-2026-334692026.03 · PUBLISHED
Frigate
MEDIUMCVSS 6.5
—GitHub Security Advisory
CVE-2026-334702026.03 · PUBLISHED
Frigate
MEDIUMCVSS 6.5
—GitHub Security Advisory
CVE-2026-333302026.03 · PUBLISHED
FileRise
HIGHCVSS 7.1
—GitHub Security Advisory
CVE-2026-333542026 · PUBLISHED
avideo
MEDIUMCVSS 6.5
—TBD
NO CVECONFIRMED
Polygon
LOW
$500Immunefi
NO CVECONFIRMED
Livepeer
INFO
$250Immunefi
NO CVECONFIRMED
Ava Labs Avalanche
MEDIUM
$5,000Immunefi
NO CVECONFIRMED
Moonbeam Network
HIGH
$2,000Immunefi
04
RESULTS

EVENTS.

FINAL RESULT
20 TEAM FINAL

AITU CTF 2026 Final

April 24–25, 2026
Astana, Kazakhstan
FINAL STANDINGS
FINAL 20 TEAMS
hackraticof 20 finalist teams
7th
now.sh
now.sh
just_silence
just_silence
bg0d
bg0d
x4cc3
x4cc3
C47of 20 finalist teams
10th
Mundur
Mundur
ryu7ero
ryu7ero
deprrous
deprrous
chtga
chtga
n
n0rv

hackratic and C47 competed in the AITU CTF 2026 Final after qualifying from the preliminary round. In a final field of 20 teams, hackratic finished 7th and C47 finished 10th.

VIEW SCOREBOARD↗