TecSecurity Research Security Research & Consulting

Targeted research · Based in Australia

Security Research for widely used products

Disclosing zero-day vulnerabilities across software and critical systems. We prove real-world exploitability and work with affected vendors through coordinated disclosure.

Explore published CVEs Coordinating with vendors
Microsoft Security Response Center
2023

Top 3 Microsoft Office security researchers

Rocco CalviFounder, TecSecurity

Recognised for contributions to Office security.

16 Microsoft Office
CVEs published
View Microsoft’s recognition
ZDI Zero Day Initiative · Trend Micro
2025

Ranked 1st Most Prolific Researcher 2025 ZDI Vanguard Award

Rocco CalviFounder, TecSecurity

Recognised for the highest number of contracted vulnerability cases.

300+ RCE vulnerabilities
reported
Read about the Vanguard Award
358Published advisories 300+RCE vulnerabilities reported 18+Years publishing research 2025 ZDI Vanguard AwardMost Prolific Researcher Rocco Calvi · Founder, TecSecurity

The public record

Recent CVE disclosures

All 358 advisories
CVE-2026-19781

Ashlar-Vellum

Cobalt

Heap-based buffer overflow in VS file parsing.

CVSS 7.8Read advisory
CVE-2026-12921

AzeoTech

DAQFactory

Use-after-free in CTL file parsing.

CVSS 7.8Read advisory
CVE-2026-6071

Rockwell Automation

Arena Simulation

Out-of-bounds write in DOE file parsing.

CVSS 7.8Read advisory

A core research specialism

Deep experience in
Microsoft Office.

Research across Word, Excel and shared document-processing components. Our published findings cover memory corruption, remote code execution and information disclosure.

WordExcelOffice graphics
Read about our Office research

Selected Office disclosures

2022–2023
CVE-2023-35371

Microsoft Office

Remote code execution

CVE-2023-23399

Microsoft Excel

Remote code execution

CVE-2022-41031

Microsoft Word

Remote code execution

Disclosure record

CVEs across software and critical systems

  • Microsoft
  • Apple
  • Google
  • Meta
  • Adobe
  • Siemens
  • TP-Link
  • Autodesk
  • NVIDIA
  • Foxit
  • Schneider Electric
  • IBM
  • Rockwell Automation
  • Inductive Automation
  • NETGEAR
  • Mozilla
  • Trimble

Impact, proof & remediation

Research where exposure matters.

Disclosing zero-day vulnerabilities across software and critical systems.

Impactful primitives

Find the security boundary that matters.

We look for vulnerabilities with the potential for maximum impact across software and critical systems.

Proven exploitability

Show what an attacker can achieve.

We develop reliable proof-of-concept code, establish root cause and demonstrate the full security impact without relying on a crash alone.

Coordinated disclosure

Work with vendors to fix it.

We share actionable evidence with affected vendors, support remediation and publish technical details after fixes are available.

Published analysis

Selected technical research

All publications

DoubleTrouble: Pre‑Auth RCE in Inductive Automation Ignition via Deserialization

A deep dive into CVE-2023-39475 and CVE-2023-39476 — two critical (CVSS 9.8) deserialization vulnerabilities in Inductive Automation's Ignition SCADA platform that …

Read the analysis

Pwning the TP-Link AX1800 WiFi 6 Router: Uncovered and Exploited a Memory Corruption Vulnerability

How we discovered and exploited CVE-2023-28760, a stack-based buffer overflow in the MiniDLNA service on the TP-Link Archer AX20 router, during preparation for …

Read the analysis

Research enquiries

Work with us on security research.

For source code review, penetration testing, bug bounty research, coordinated disclosure and technical collaboration.

research@tecsecurity.io Download PGP public key
Verify key fingerprint

TEC Security Research · research@tecsecurity.io

44BE DC3A 43B1 F394 BA67 2327 AF4A A46E 5093 3325