Welcome! 👋 View my resume ↗
I'm an Ethical Hacker & Penetration Tester passionate about Cloud, Web App & Application Security. I focus on offensive security and actively contribute to open-source projects.
- HackPaper - My personal blog where I share deep dives into cloud security, research, and technical articles.
- s3finder - A tool for discovering and analyzing open S3 buckets
- Temodar Agent - AI-powered WordPress plugin/theme security analysis platform with Semgrep-based static analysis and agent-assisted investigation workflows
- aws-clf-c02-notlari - AWS Certified Cloud Practitioner study notes
More projects coming soon! 🛠️
- Amazon Web Services (HackerOne) - Hall of Fame
- Razorpay (HackerOne) - Listed on public Hacktivity as xeloxa
| Repository | Stars | Fix |
|---|---|---|
| gofiber/fiber |  |
Reported cache middleware query-string key collision / response mix-up (GHSA-35hp-hqmv-8qg8, CVE-2026-30246) · ↗ Advisory |
| NousResearch/hermes-agent |  |
Reported ACP auth / approval hardening issues and fixes · ↗ #13468 · ↗ #13471 · ↗ #13525 |
| EvoMap/evolver |  |
Reported RCE, arbitrary file write, and prototype pollution issues · ↗ GHSA-j5w5-568x-rq53 · ↗ GHSA-r466-rxw4-3j9j · ↗ GHSA-2cjr-5v3h-v2w4 |
| lukilabs/craft-agents-oss |  |
Fixed path traversal in STORE_ATTACHMENT IPC handler (v0.3.2) · ↗ Advisories |
| NoeFabris/opencode-antigravity-auth |  |
Set 0600 permissions for credential storage · ↗ #353 |
More contributions coming soon! 🔜
| CVE ID | Status | CVSS | Description |
|---|---|---|---|
| CVE-2026-42076 | ✅ Published | 9.8 | Remote Code Execution in EvoMap Evolver < 1.69.3 |
| CVE-2026-1993 | ✅ Published | 8.8 | Privilege escalation in ExactMetrics <= 9.0.2 |
| CVE-2026-1992 | ✅ Published | 8.8 | Arbitrary plugin installation in ExactMetrics <= 9.0.2 |
| CVE-2026-42075 | ✅ Published | 8.1 | Arbitrary file write in EvoMap Evolver < 1.69.3 |
| CVE-2026-30246 | ✅ Published | 6.5 | Cache response mix-up in gofiber/fiber < 3.2.0 |
| CVE-2026-42077 | ✅ Published | 5.2 | Prototype pollution in EvoMap Evolver < 1.69.3 |
| CVE-2026-1857 | ✅ Published | 4.3 | SSRF vulnerability in Kadence Blocks <= 3.6.1 |
| CVE-2026-2633 | ✅ Published | 4.3 | Unauthorized media upload in Kadence Blocks <= 3.6.1 |
More coming soon! 🔜
| CVE ID | Exploit | Exploit-DB | Description |
|---|---|---|---|
| CVE-2024-28397 | ↗ GitHub | ↗ 52532 | Remote Code Execution in Js2Py |
| CVE-2026-31431 | ↗ GitHub | ↗ Vulners | Copy Fail - Local Privilege Escalation |
| CVE-2026-23918 | ↗ GitHub | ↗ 52577 | Apache HTTP Server - HTTP/2 Double Free |
 |
 |