# TFSec

> TFSec is a team of Malaysian security researchers focused on vulnerability research, offensive security, and bug bounties. Members include bau1u (#1 HackerOne Malaysia, #1 Adobe 2026, #6 Adobe All Time, 41 Content Credentials SDK CVEs), e0x1337 (#2 Malaysia, #5 Stripe 2026, solo Adobe Commerce privilege escalation CVE-2026-76202 CVSS 8.2), and m411 (#6 Malaysia). 48+ CVEs assigned across Adobe Content Credentials SDK, Adobe Commerce, Sonatype Nexus, WooCommerce Stripe, and more. All vulnerabilities responsibly disclosed through HackerOne.

## Research Blog

- [16 More Adobe CVEs and e0x1337 Solo Adobe Commerce Privilege Escalation](https://tfsec.org/blog/16-more-adobe-cves-2026): 15 more Content Credentials SDK CVEs from bau1u across three bulletins plus e0x1337 solo Adobe Commerce privilege escalation CVE-2026-76202 CVSS 8.2.
- [SSRF Redirect Bypass in Sonatype Nexus (CVE-2026-14646)](https://tfsec.org/blog/cve-2026-14646-nexus-ssrf-redirect-bypass): Full technical breakdown of SSRF protection bypass in Sonatype Nexus Repository Manager. Cloud credential theft via HTTP redirect.
- [Cart Swap Attack on Stripe for WooCommerce](https://tfsec.org/blog/woocommerce-stripe-payment-validation): Payment bypass via Checkout Session hijack in Stripe for WooCommerce. CVSS 8.1. Full attack flow and root cause analysis.
- [31 CVEs in Adobe Content Credentials SDK and Adobe Commerce](https://tfsec.org/blog/adobe-cve-haul-2026): 31 vulnerabilities across four Adobe security bulletins. DoS, path traversal, file read/write in Content Credentials SDK and Commerce.
- [Welcome to TFSec](https://tfsec.org/blog/hello-world): Who we are and what we do.

## CVEs and Advisories

- [All CVEs and Advisories](https://tfsec.org/cves): Complete list of 48+ CVEs and security advisories with CVSS scores, CWE classifications, bulletin links, and NVD references.

## Team

- [Team Page](https://tfsec.org/team): Profiles of bau1u, e0x1337, and m411.

## Team Members

- bau1u: Security researcher. #1 HackerOne Malaysia (Q1 and Q2 2026). #1 Source Code scope globally (Q1 2026). #3 Source Code globally (Q2 2026). #1 Adobe 2026. #6 Adobe All Time. 41 CVEs in Adobe Content Credentials SDK. 4 CVEs in Adobe Commerce (with e0x1337). Specializes in C2PA manifest parsing, JUMBF box validation, integer overflow/underflow, resource consumption bugs.
- e0x1337: Security researcher. #2 HackerOne Malaysia (Q2 2026). #5 Stripe 2026. #14 Stripe All Time. #10 Adobe 2026. Solo Adobe Commerce privilege escalation CVE-2026-76202 CVSS 8.2. Sonatype Nexus SSRF CVE-2026-14646. WooCommerce Stripe payment bypass CVSS 8.1. Specializes in business logic, payment security, authorization bypasses, SSRF.
- m411: Security researcher. #6 HackerOne Malaysia (Q2 2026). #29 Adobe 2026. Path traversal CVE-2026-34657 in Content Credentials SDK.

## External Profiles

- [bau1u on HackerOne](https://hackerone.com/bau1u)
- [e0x1337 on HackerOne](https://hackerone.com/e0x1337)
- [m411 on HackerOne](https://hackerone.com/m411)
- [TFSec GitHub](https://github.com/harrizuan)

## Optional

- [RSS Feed](https://tfsec.org/feed.xml): All blog posts in RSS format.
- [Sitemap](https://tfsec.org/sitemap.xml): XML sitemap of all pages.