Sebastián Alba Vives

Organizations where I reported vulnerabilities or contributed fixes

• Microsoft MSRC Special Mention

  Acknowledged for valid vulnerability reports submitted during the 2025-26 recognition period, including a command injection in Microsoft Muzic and memory-safety findings in ONNX Runtime Extensions.

  Open MSRC page View mention

• Harvard University Letter of Appreciation

  Eight reports to the Vulnerability Disclosure Program, three critical, including a confirmed RCE on FAS Research Computing. Five remediated.

  Open letter (PDF)

• CERN Computer Security Kudos

  Listed on the Computer Security Team’s public Kudos page for findings in ROOT and Geant4, the frameworks behind Large Hadron Collider data analysis.

  Open Kudos page

• U.S. Department of Defense VDP recognition

  Report triaged and resolved by the DoD security team through the Defense Cyber Crime Center programme on HackerOne.

  View resolution

• Palo Alto Networks Researcher Acknowledgement

  XML injection in the pan-os-python SDK. Confirmed by PSIRT, fixed, rewarded through the bug bounty programme, and credited on the public acknowledgement page.

  Open acknowledgement View fix

• GOVCERT.LU Hall of Fame · Luxembourg

  Four vulnerabilities in eml_parser, the email parsing library the Government of Luxembourg’s CERT maintains for SOC pipelines. All patched in v3.0.2.

  Open Hall of Fame

• Universiteit Utrecht Hall of Fame · Netherlands

  Listed for responsible disclosure of security vulnerabilities reported to the university’s IT services team.

  Open Hall of Fame

• PAX Technology Letter of Appreciation

  Four findings in the PAXSTORE SDKs used by point-of-sale terminals. Fixed in v11.0.1 and v10.2.1, with a formal letter and a hand-carved sandalwood fan inscribed “PAX Security Contributor”.

  Open letter (PDF) Release notes

• National Instruments Security advisory credit

  Credited by name in the official advisory for seven vulnerabilities in the gRPC Device Server, two of them critical. All patched in v2.18.0.

  Open advisory

• Bitdefender Bug Bounty Hall of Fame

  Two out-of-bounds writes in Napoca, their bare-metal hypervisor, both reachable from a guest virtual machine.

  Open Hall of Fame

• Kaspersky PSIRT acknowledgements

  Memory-safety issues in the Neuromorphic Platform, their framework for running spiking neural networks on specialised inference hardware.

  Open acknowledgements

• OWASP Two Letters of Recognition

  A stored XSS and a server-side template injection in OWASP Cervantes. Both acknowledged with individual letters signed by the project leader.

  Letter, XSS (PDF) Letter, SSTI (PDF)

• DSCI Letter of Appreciation · India

  Three vulnerabilities in the national Threat Intelligence Platform, including unauthenticated access to configuration data. Letter issued by the CEO.

  Open letter (PDF)

Reports the vendor accepted and patched where no identifier was issued either the project is not a CNA, or it was handled as a hardening fix.

• RCE · CVSS 9.8 · LoA Harvard University Vulnerability Disclosure Program

  Unauthenticated Ray Dashboard on FAS Research Computing, an open eXist-db REST API serving 624 documents, and a switch management interface reachable from the internet with no password. Eight reports, five remediated.

  Open letter (PDF)

• CWE-91 · bounty paid Palo Alto Networks pan-os-python SDK

  XML injection in the HA configuration sync path: unescaped user values let an attacker smuggle sibling elements into the request sent to the firewall. Fixed in PR #614.

  View fix (PR #614)

• CWE-125 · fix merged Cisco Talos ClamAV

  The HFS+ attribute parser validated a name length as a UTF-16 character count, then used the same field as a byte offset. Fix merged with credit in PR #1708.

  View fix (PR #1708)

• 4 findings · LoA PAX Technology PAXSTORE SDKs

  Zip Slip during terminal parameter extraction, XXE chained onto it, a shared key hardcoded in the public repository behind ten PBKDF2 iterations, and a TrustManager that accepted every certificate.

  Open letter (PDF)Release notes

• Kudos page CERN ROOT, Geant4 & Delphes

  Memory-safety issues in the data-analysis framework used across high-energy physics, plus the first CVE ever assigned in Geant4's history.

  Open Kudos page

• pre-auth OOB write hostapd EHT/MLO, Wi-Fi 7

  Out-of-bounds write reachable before authentication in the multi-link element handling.

  Aviso de seguridad

• PSIRT bulletin Kaspersky Neuromorphic Platform

  Memory-safety issues in the FlatBuffers and ZMQ communication layer of their spiking neural network framework.

  Open acknowledgements

• triaged · resolved U.S. Department of Defense DC3 VDP

  Report accepted and resolved through the Defense Cyber Crime Center programme on HackerOne.

  View resolution

• first CVE in the project CERN Geant4 & Delphes

  Geant4 simulates how particles travel through matter. It is used at the Large Hadron Collider, in NASA and ESA mission planning, and to plan radiotherapy doses in hospitals. The finding became the first CVE ever assigned in the project's history.

  Open Kudos page

• backported to 5 stable trees Linux Kernel drivers/fpga

  Memory-safety fixes in the FPGA manager subsystem, accepted upstream and backported by the stable maintainers to five kernel branches.

  lore.kernel.org

• reported upstream Raspberry Pi Linux kernel fork

  Driver issue in the kernel tree that ships on the single-board computers used across education, hobby projects and industrial deployments.

  PR #7327

• Valve · Proton vkd3d-proton DirectX 12 to Vulkan

  Overflow in graphics resource allocation. This is the translation layer that lets Windows games run on Linux and on the Steam Deck.

  PR #2926

• CWE-787 Ghostscript XPS parser

  Memory-safety issue in the document parser. Ghostscript is the PostScript and PDF engine behind most printing on Linux and in print servers.

  Bug #709292

• boot path U-Boot NFS boot

  Issue in the network boot path of the bootloader that starts most embedded Linux devices, from home routers to industrial equipment.

  Patches

• RISC-V target QEMU RISC-V emulation

  Issue in the RISC-V target of the emulator that underpins most Linux virtualisation, including cloud infrastructure.

  Commit b2e874b

• 3 findings · LoA DSCI national Threat Intelligence Platform

  India's national cybersecurity council, founded by NASSCOM. Three vulnerabilities in the platform used to monitor threats against national infrastructure, including unauthenticated access to configuration data and source code exposure. All patched.

  Open letter (PDF)

• 2 findings · 2 LoR OWASP Cervantes

  A stored cross-site scripting flaw and a server-side template injection in the vulnerability management project. Both acknowledged with individual Letters of Recognition signed by the project leader.

  Letter, XSS (PDF) Letter, SSTI (PDF)

• La Republica · Costa Rica Students create a tape that promises to end short-circuit fires

  National coverage of the patented conductive tape, back when it was still a student project.

  Read article

• La Republica · Costa Rica Top 5 in the World Photographic Cup

  Costa Rica's national team placed in the top five worldwide in the Commercial and Illustration categories.

  Read article

• TEC · Costa Rica Institute of Technology "My passion is engineering, but photography is inside me"

  Interview about balancing engineering and photography.

  Read interview

• JPGBOOK · 2020 edition Featured artist

  Photographic work selected for the 2020 edition.