Research
Find and validate vulnerabilities, coordinate disclosure, and document the public record.
Researcher’s ledger
Abdullah Kareem
known as CyberKareem
Security Researcher
and Penetration Tester
Public sources reviewed
11 Jul 2026
11 Jul 2026
I find security flaws, build practical tools, and explain how systems break.
I’m Abdullah Kareem—CyberKareem—a penetration tester and offensive security researcher working across web, mobile, infrastructure, and coordinated vulnerability disclosure.
Verified public record
- published Finder-credited advisories
- 14
- Including 6 public CVE assignments
- HTB XP · Level 105
- Grandmaster II
- Labs: Pro Hacker · global #371
Working method · 02
Research, assess, explain.
Assess
Conduct authorized testing across web, mobile, infrastructure, and Active Directory.
Explain
Turn technical impact into clear remediation, practical tools, and useful writing.
Available engagements · 03
Security assessments built around the system carrying the risk.
Defined-scope, authorized testing with reproducible evidence, prioritized reporting, and a clear remediation path.
- 01Web applications & APIs
- 02Mobile applications
- 03Network, identity & wireless
- 04Smart-contract scope review & specialist referral
- 05AppSec & security advisory
Public evidence · 04
Selected disclosures
CVE-2026-61448Low · 2.1
Parse Server
Malformed Content-Type values could bypass an upload-extension blocklist and create stored XSS on affected storage adapters.
CVE Program published25 Jun 2026
Opens the primary advisory in a new tabCVE-2026-59889Medium · 6.5
Jackson Databind
JsonView authorization rules could be bypassed for JsonUnwrapped properties during deserialization, enabling unauthorized writes.
CVE assigned — CVE.org record pending10 Jul 2026
Opens the primary advisory in a new tabCVE-2026-55675Critical · 10.0
saltyorg/docs
A privileged workflow_run chain could execute untrusted fork code in a secret-bearing deployment context.
CVE assigned — CVE.org record pending15 Jun 2026
Opens the primary advisory in a new tabFourteen published Finder credits, including six public CVE assignments.Open all 14 primary records
P—01
SurfaceLens
A local-first attack-surface intelligence workbench for engagement triage.
Opens the project on GitHub in a new tabP—02kamehandle
A dependency-free username and email-handle generator for authorized defensive workflows.
Opens the project on GitHub in a new tabAdditional repositories remain outside the featured set until their documentation, safety claims, and example data complete a public-readiness review.
Writing archive · 06
The archive is moving home.
The Medium archive is being recovered and reviewed before it becomes an owned library on cyberkareem.com. Only the audited migrated count will be published; new CVE writeups will join the approved labs, tooling, and security-engineering material.
- Vulnerability research
- Hands-on labs
- Tools and methods
Enterprise foundation · 07
Offensive research grounded in operational reality.
Before moving into dedicated penetration-testing and security research roles, I spent eight years working across enterprise IT, infrastructure, and security operations at UNAMI.
That foundation shapes the work today: validate impact carefully, communicate it clearly, and make remediation useful to the people responsible for fixing the system.
Read the full backgroundChoose the right path
Authorized assessment or coordinated disclosure.
Commercial enquiries begin with fit and scope. Vulnerability reports begin with a safe private channel. Neither path starts with sensitive detail in public.