// kathmandu · founder · researcher

Manish (Mausam) Rijal

aka Mausam Rijal·Vulnerability Researcher

Entrepreneur and full-stack developer building security tooling and systems software. Owner and lead developer at C.T. Tech Nepal Pvt. Ltd., and a vulnerability researcher across HackerOne, Bugcrowd, and Immunefi.

  • Founder
  • Full-stack
  • Vulnerability research
  • CVE credited
  • Systems
identity.jsononline
Name
Manish (Mausam) Rijal
Known as
Mausam Rijal
Role
Owner / Lead Developer
Company
C.T. Tech Nepal Pvt. Ltd.
Based in
Kathmandu, Nepal

27.7172° N, 85.3240° E

HackerOne · Bugcrowd · Immunefi

probe82%
daemon64%
dashboard91%

// what I do

Three disciplines, one operating system.

Security Engineering

Kernel and userland telemetry, detection engineering, and disciplined disclosure work. Every claim is source-verified and severity is calibrated honestly rather than inflated.

Systems & Infrastructure

eBPF probes, KVM/QEMU virtualization, and production Nginx infrastructure. I run and harden servers end to end for travel-sector clients.

Full-stack Development

Laravel and Next.js/React products backed by Node, Python, and Go services. I take a product from schema and API through to a polished, responsive interface.

// featured work

Systems I have designed, built, and shipped.

NetSentinel

FlagshipeBPFGoNext.js

Endpoint detection and security monitoring platform.

A kernel-level eBPF probe engine feeding a Go control daemon, with a real-time Next.js dashboard for triage. Built as a full pipeline: collect at the kernel boundary, correlate in the daemon, and surface signal without drowning the operator.

netsentinel@probe: ~

pipeline

  1. Kernel probe

    eBPF / kprobe

  2. Control daemon

    Go

  3. Dashboard

    Next.js

collect at the kernel boundary · correlate in the daemon · surface in the dashboard

mausamrijall/hypervisor

Hypercore

Custom KVM/QEMU-based Type-1 hypervisor.

A hypervisor built from the ground up on KVM/QEMU and shipped as a bootable ISO, taken across six development phases from boot firmware to a dedicated security-hardening pass.

  1. 01 Boot firmware
  2. 02 KVM/QEMU core
  3. 03 Memory & CPU virt
  4. 04 Device model
  5. 05 Bootable ISO
  6. 06 Security hardening
KVM/QEMUCLinuxISO

We Travel

Nepal-based adventure travel marketplace.

A discovery and booking platform pairing TikTok-style short video with itinerary negotiation between travelers and operators. I worked full-stack across the platform and produced the investor-facing materials that helped position the startup.

Next.jsLaravelMarketplaceVideo

// technical arsenal

The stack I reach for.

Languages

  • PHP
  • JavaScript
  • TypeScript
  • Python
  • Go

Frameworks

  • Laravel
  • Next.js
  • React
  • Node.js

Systems

  • Nginx
  • eBPF
  • KVM/QEMU
  • Linux

Practice

  • Server infrastructure
  • Vulnerability research

// security research

Findings that survived review.

Source-verified findings across public bug bounty programs and coordinated disclosures. Each entry is backed by an independently validated proof of concept and an honest severity call — no inflated CVSS, no unverifiable claims, no client names.

published CVE credit
CVE-2026-92942Credited reporterCVSS 8.7CWE-400

vm2 before 3.11.7 — timeout bypass via FinalizationRegistry

VulnCheck · published 2026-09-17

public programs only · no client names · no exploit payloads

VulnCheck

vm2 (npm)

CVSS 8.7

Timeout bypass via FinalizationRegistry: sandboxed cleanup callbacks execute outside vm2 timeout accounting, letting a busy loop block the host event loop (denial of service).

CVE-2026-92942CWE-400Credited reporter

ByteDance

UI-TARS-desktop

High

Path traversal reachable through the desktop agent, demonstrated with a live proof of concept.

CWE-22

Worldcoin

orb-core

CVSS 8.4

Unauthenticated D-Bus endpoint exposing authentication tokens to any local caller.

Auth exposure

GitLab

Runner

Critical

Zip Slip archive extraction combined with a symlink write to escape the job workspace.

Path / archive

Espressif

esp-lwip

Confirmed

Two IPv6 fragmentation bugs, verified directly against lwIP’s own test harness.

IPv6 fragmentation

Anthropic

claude-agent-sdk-python

High

Multiple independently validated HIGH-severity findings in the agent SDK.

Agent SDK

// contact

Let's build something worth defending.

Open to security engineering, systems work, and product builds. If you are working on something close to the kernel or close to the customer, I would like to hear about it.

Open to security engineering, systems, and product work