Ruikai Peng

I do security research (bug-hunting) on projects I think is fun.
things i found when i was 16:

things i found when i was 15:

Llama.cpp RPC Heap-overflow Remote-Code Execution (Dec 2024 - Feb 2025)
Evernote Remote-Code Execution (Jul 2024)
Tenda AC8 Router Remote-Code Execution (Jun 2024)
Llama-cpp-python Remote-Code Execution (May 2024)
Youdao Note Remote-Code Execution (Apr 2024)
Google Tensorflow Remote-Code Executions (Aug 2024)
Microsoft Semantic Kernel Remote-Code Execution (May 2024)
Intel Neural Compressor Remote-Code Execution (Jun 2024)
Governmental Education System Privilege Escalation (CNVD-2024-15472)
REACH XSS (Feb 2025)

things i found when i was 14:

Transformers tools Remote-Code Execution (Mar 2024)
Transformers checkpoint Remote-Code Execution (Feb 2024)
PrivateGPT sagemaker Remote-Code Execution (Feb 2024)
LoLLMs 11 Remote-Code Executions, 5 LFIs (Mar 2024)
Managebac XSS (Feb 2024)
Youdao Note XSS (Oct 2023)
AutoGDB: Recursive Agency with GDB (Dec 2023 - Mar 2024)
BinaryChat: Chat to your binary (Jan 2023 - Apr 2023)

things when i was younger:

Webloom Examination System Remote-Code Execution (Jan 2022) (12)
Information Leakage of My Middle School (Sep 2021) (11)
PwnBERT: Semantic based vuln detector (Mar 2023 - Apr 2023)
...

*25 CVEs, $20,000 in bounty