Publicly verifiable vulnerability research by Tae-Hoon Ha (hataehoon). My GitHub handle in the public records is dpfkdlemtp.
| CVE / case page | Project | Attribution | Official CVE record |
|---|---|---|---|
| CVE-2026-116192 | rclone | Reporter (dpfkdlemtp) |
CVE record |
| CVE-2026-110860 | GitPython | Reporter (dpfkdlemtp) |
CVE record |
| CVE-2026-100633 | SiYuan | Reporter (dpfkdlemtp) |
CVE record |
| CVE-2021-43716 | Epson EH-TW5350 | B-BEAM-BOB team research | CVE record |
| CVE-2021-43717 | Epson EH-TW5350 | B-BEAM-BOB team research | CVE record |
| CVE-2021-43718 | Epson EH-TW5350 | B-BEAM-BOB team research | CVE record |
The three Epson CVEs came from one team research project, not three independent solo discoveries. The original team advisory collection is the canonical reference linked by the CVE records and lists Tae-Hoon Ha among the researchers. The SiYuan GitHub security advisory lists dpfkdlemtp as reporter.
For SiYuan, GitHub declined a second CVE assignment because CVE-2026-100633 already exists. The official CVE record is published and references that GHSA; the GHSA CVE field has not yet been linked to it.
These published advisories credit dpfkdlemtp as Reporter and identify patched versions.
| Project | Published advisory | Severity | Patched versions |
|---|---|---|---|
| dbt Core | Arbitrary file overwrite during dependency resolution | High | 1.12.6 / 1.11.16 |
| Datasette | Table permission bypass | High | 0.65.5 / 1.0a40 |
| TwelveMonkeys | Excessive memory allocation in the PICT image reader | High | 3.15.1 |
| Kaneo | Outbound destination validation bypass | High | 2.47.1 |
| Project | Published advisory | Severity | Patched versions |
|---|---|---|---|
| GitPython | Symlink-based path traversal in Submodule.move() | Moderate | >= 3.2.0 |
| rclone | Server-side request forgery in named remote roots | Moderate | 1.74.2 |
| AngleSharp | SVG serialization mutation XSS | Moderate | >= 1.8.2 |
| Sonos tract (ONNX inference) | Symlink traversal in ONNX external data loading | Moderate | 0.21.19 / 0.22.5 / 0.23.9 |
Advisory links, reporter credit, and patched versions verified on 2026-10-27. Severities follow the project advisories. Published CVE records are listed above; an advisory's CVE field may not yet reflect an existing CVE record.
Only publicly disclosed, verifiable work is listed here.