┌──(christbowel㉿kali)-[~]
└─$ cat about.txt
Name : Christ Bowel Bouchuen
Age : xx
Location : Darmstadt, Germany
Uni : TU Darmstadt — B.Sc. Computer Science
Focus : Offensive Security | Vulnerability Research | Bug Bounty
CVEs Discovered : 7
Hall of Fames : 5 (🇺🇸 State of California · 🇩🇪 Deutsche Telekom · 🌍 Mars VDP · 🇦🇺 RMIT · 🇺🇸 BIA)
CTF Best Rank : Top 15/454 — Bugcrowd Black Hat USA CTF 2024 && Top 1 - USD Hacking Night
Status : Software Security @ PAYONE GmbH
Six highlights below. Thirteen CVEs assigned in total.
- CVE-2026-56111 · Marlin firmware. Out-of-bounds write; memory corruption validated on real STM32 hardware.
- CVE-2026-49143 · browserstack-runner. Node VM sandbox escape to unauthenticated RCE. CVSS 8.7.
- CVE-2026-49144 · browserstack-runner. Path traversal to unauthenticated file read; full host compromise when chained.
- CVE-2026-67195 · FINOS Perspective. eval injection in PolarsVirtualServer; unauthenticated RCE.
- CVE-2026-39911 · Hashgraph Guardian. Unsandboxed
Function()to authenticated RCE, credential leak, and auth token forgery. - CVE-2024-29643 · Croogo CMS. Host Header Injection to RCE.
Seven more across Guardian, Perspective, and other targets.
Vulnerabilities disclosed and patched by maintainers, no CVE assigned.
- OWASP Dependency-Track · IDOR, confused deputy, and multi-team permission union across v4.14 and v5 (Hyades). Coordinated with maintainers and VulnCheck.
- Symfony · Deserialization trampoline through nested
unserialize(), bypassingallowed_classes. Coordinated with a core maintainer.
- OSDC (Open Source Daily Catch) · Automated silent-patch detection. Scrapes the GitHub Advisory Database and diffs quiet fixes to surface n-days before they go public. The pipeline behind much of the CVE output above.
- Diffuse · Decentralized AI inference protocol in Rust. TEE, Shamir secret sharing for prompt fragmentation, and ZK execution proofs, so inference runs without any single party ever seeing plaintext. Architecture and specification stage.
1st place, usd Hacking Night CTF. Halls of Fame across public and federal disclosure programs. Coordinated Vulnerability Disclosure through VulnCheck.
