Security researcher and penetration tester. I find and responsibly disclose vulnerabilities in commercial and open-source software. M.S. Cybersecurity, and CTF web-challenge author at the ISC2 New Jersey Chapter.
Two places to go deeper: Pavan Nallamothu's vulnerability research and coordinated-disclosure record and the offensive security tooling and exploit lab.
- 🛡️ 14 published CVEs (MITRE), credited by Apple, CISA, the NSA, and NASA
- 🎯 Active on HackerOne, Bugcrowd, Google VRP, Apple Security Bounty, and Meta
- 🔎 Focus areas: SSRF, broken access control, IDOR, path traversal, source-code auditing
- 📍 Jersey City, NJ
| CVE | Target | Class | Severity |
|---|---|---|---|
CVE-2026-43763 |
Apple macOS (ATS) | Sandbox file-read | 🟠 Medium |
CVE-2026-65412 |
Apple (CoreText) | Web-content memory safety | 🟠 Medium |
CVE-2026-63013 |
NSA skills-service | Privilege escalation | 🔴 High 8.8 |
CVE-2026-63014 |
NSA skills-service | Cross-project IDOR | 🟠 Medium |
CVE-2026-63177 |
CISA Malcolm | RBAC bypass | 🔴 High |
CVE-2026-63134 / 63133 |
CISA Malcolm | Path traversal, DoS | 🟠 Medium |
CVE-2026-33234 |
AutoGPT | SSRF via SMTP | 🟠 Medium |
CVE-2026-50023 |
yt-dlp | Dangerous file creation | 🔴 High 8.3 |
CVE-2026-40585 to 40588 |
BlueprintUE | Account-takeover chain | 🔴 High |
| Paper | Venue | Link |
|---|---|---|
| SSRF Beyond HTTP: Egress-Path-Incomplete Guards in AI Agent Platforms | Zenodo | doi:10.5281/zenodo.22075469 |
| Trusting the Filename: File-Write Attacks from Untrusted Archive and Download Metadata | Zenodo · Preprints.org | doi:10.5281/zenodo.22075439 |
| Dominating the Deputy: Toward Positional Permission Completeness in Agentic Workflows | Preprints.org | Under review · DOI on approval |
| Composable Seeding of ML-KEM from Certified Bell Randomness in the QROM | IACR ePrint | Under review · link on approval |
Systems tools written from scratch, each its own repo with a live page. Full set at pavanchow.github.io.
| Build | What it is |
|---|---|
| Oracle | A query language whose result is an attack path across identity and network graphs |
| Lint-Owl | A static analyzer that returns the data-flow path from source to sink |
| Unweave | An EVM bytecode disassembler that reconstructs intent and flags dangerous opcodes |
| Cipherlock | From-scratch ChaCha20-Poly1305 AEAD, proven against the RFC 8439 vectors |
| Timelace | A content-addressed version-control core, the git idea made readable |
| Trailhead | A full-text search engine with an inverted index and TF-IDF ranking |
