yuznumara

Selected work

LiveSecurity SaaS

VulnTracker

SaaS
Security

Vulnerability intelligence for the software you actually run. Pick your vendors and products; new CVEs are matched against them and you are told what to patch, in what order, and how.

Role: Founder, VulnTracker LLC
Does: Alerts over email, Telegram or Slack · Kanban triage board · watchlists · exports
Data: NVD · CISA KEV · EPSS · SSVC · vendor advisories
Open: Public CVE catalog, no account needed

vulntracker.io ↗

LaunchingMac app · by DAKCYBER

Bowerbird

Mac native
Productivity

A private, visual companion to Finder. Shelves you can see, plain-English search, and on-device OCR for text inside images and PDFs. It remembers where every download came from.

Role: Built at DAKCYBER
Platform: Native macOS app
Privacy: Runs on your Mac. No account, nothing uploaded
Model: Pay once, no subscription

getbowerbird.app ↗

Coming soonMac app · by DAKCYBER

Warden

Mac native
Security
AI agents

A menu-bar checkpoint between AI coding agents and your Mac. Routine work goes straight through; reading your keys, wiping folders or piping a script into a shell is stopped. The grey areas come to you.

Role: Built at DAKCYBER
Works with: Claude Code, Codex, Cursor and others
Keeps: A local evidence log of every allowed and blocked action

not public yet

In developmentMac app · by DAKCYBER

Agent command center (working title)

Mac native
AI agents
Dev tools

A native macOS command center that finds every AI coding-agent session on your Mac and shows what each is doing, its subagents and tasks, and what needs you. All local.

Role: Built at DAKCYBER
Sees: Sessions, subagents, tasks and anything waiting on you
Data: Stays on your Mac

not public yet

LiveCompany · Teknopark İstanbul

DAKCYBER

Consulting
Pentest

The cybersecurity company I founded. Offensive security work for clients, plus the research and products on this page.

Role: Founder
Pentest: Web · API · mobile · Active Directory · internal networks
Also: Vulnerability research · secure software development · custom security labs

dakcyber.com ↗

Retiredlandingvideo.comLanding page to promo video in 30 seconds. Shipped, then shut down. The lessons stayed, the domain didn’t.

OffSec Proving Grounds

53 vulnerable machines built for OffSec Proving Grounds: attack scenarios that chain a real CVE from foothold to root, and Defend variants that teach the patch.

Latest ten

Defend · Aug 2026Live
CVE-2026-72603WireGuard VPN tunnelHarden against arbitrary command execution.
Defend · Aug 2026Live
CVE-2026-72875DokployHarden a self-hosted deployment platform against arbitrary command execution.
Attack · Aug 2026Releasing
CVE-2026-72864 / 72875 / 72876Redacted until releaseNew CVE attack scenario.
Grimoire · Aug 2026Releasing
CVE-2026-15734Redacted until releaseNew Grimoire content.
Defend · Aug 2026Live
CVE-2026-69083SiYuanHarden a knowledge platform against arbitrary SQL execution.
Defend · Aug 2026Releasing
CVE-2026-7818Redacted until releaseNew Defend (patching) scenario.
Defend · Aug 2026Live
CVE-2026-68771ComfyUIHarden against arbitrary command execution.
Defend · Aug 2026Live
CVE-2026-41167JellyStatHarden against a SQL injection that lets attackers run arbitrary queries.
Defend · Aug 2026Live
CVE-2026-52680Apache Kyuubi SQL gatewayHarden against arbitrary file write.
Defend · Aug 2026Releasing
CVE-2026-59243Redacted until releaseNew Defend (patching) scenario.

View all 53 machines →

Public CVE exploits

16 proof-of-concept exploits for recent CVEs, each with a write-up of the bug in its README. Python and Bash.

CVE-2026-9198pyLangflow OSSUnauthenticated RCE (chained)
CVE-2026-59243pyApache Airflow FABOAuth auth bypass → DAG RCE
CVE-2026-56121pyFeast registryUnauthenticated RCE (dill.loads)
CVE-2026-69098pykotaemonUnauthenticated deserialization RCE
CVE-2026-44024pyFluentd out_filePath traversal → arbitrary file write
CVE-2025-32463pysudo “chwoot”chroot local privilege escalation
CVE-2026-14483pyRealtyna WPL (WordPress)Unauthenticated file upload → RCE
CVE-2026-67340pyArcadeDBJavaScript trigger RCE (post-auth)
CVE-2026-52680pyApache KyuubiREST path traversal → file write
CVE-2026-69083pySiYuanUnauthenticated SQL injection
CVE-2026-68771pyComfyUIUnauthenticated pickle RCE
CVE-2025-71389pyCal.comUnauthenticated RCE (react2shell)
CVE-2026-63766pyGPT-SoVITSUnauthenticated command injection
CVE-2026-53595shFreeScoutAnonymous account takeover → RCE
CVE-2026-44881shPortainerGit symlink → host file read
CVE-2026-32136pyAdGuard Homeh2c upgrade auth bypass

Other projects

loupeSingle-binary intercepting HTTP(S) proxy with a Burp-style web UI. Go standard library only.Go
autowsdlAutomates pentesting of SOAP/XML web services and routes the traffic through Burp.Python
go-fuzzerWeb fuzzer with wordlists and templates.Go
muhIDSPyQt5 visualisation of a simple signature-based network IDS.Python
webcheckTakes a list of domains and checks for working HTTP and HTTPS servers.Go
ethernaut-challengesSolutions to the Ethernaut smart-contract security wargame.Solidity
tr-keymapKeymap JSON for the Turkish (TRQ) keyboard layout.