Now on Twitter

the unofficial HackerOne disclosure timeline.

X

b'WakaTime' disclosed a bug submitted by b'ctrl_cipher' 
b'Unauthorized Disclosure of Private Emails via WakaTime Private Leaderboards'

03 Aug 2025

b'curl' disclosed a bug submitted by b'kakorrhaphiophobia' 
b'Integer Overflow in schannel.c TLS Data Transmission'

02 Aug 2025

b'MetaMask' disclosed a bug submitted by b'bug_vs_me' 
b'total Failure of password protection while extracting seed phrase! increases attack surface area for scammers'

31 Jul 2025

b'curl' disclosed a bug submitted by b'geeknik' 
b'Stack use-after-scope in HTTP/3 POST request processing via CURLOPT_POSTFIELDS'

31 Jul 2025

b'Mozilla' disclosed a bug submitted by b'yoyomiski' 
b'Bypass "No Links" Restriction in Biography via Protocol-Relative URL (//)'

29 Jul 2025

b'Mozilla' disclosed a bug submitted by b'trein' 
b'Mozilla VPN Clients: RCE via file write and path traversal'

29 Jul 2025

b'curl' disclosed a bug submitted by b'nyymi' 
b'OpenSSL HTTP/3 bogus CURLINFO_TLS_SSL_PTR'

28 Jul 2025

b'Mars' disclosed a bug submitted by b'0xun7h1nk4ble' 
b'RXSS on via customerId parameter'

28 Jul 2025

b'Node.js' disclosed a bug submitted by b'oblivionsage' 
b'Windows Device Names Still Allow Path Traversal in UNC Paths After CVE-2025-27210 Fix'

28 Jul 2025

b'curl' disclosed a bug submitted by b'cyph3r_nitro' 
b'Vulnerability Report: Public Exposure of Security Audit File'

27 Jul 2025

b'curl' disclosed a bug submitted by b'ejejohn' 
b'Security check up'

24 Jul 2025

b'curl' disclosed a bug submitted by b'catenacyber' 
b'Use after free (or assert triggered) with failed allocations in openssl'

24 Jul 2025

b'curl' disclosed a bug submitted by b'yousesf' 
b'Exposure of Private RSA Private Key in curl GitHub Repository'

23 Jul 2025

b'curl' disclosed a bug submitted by b'nyymi' 
b'GnuTLS CURLINFO_TLS_SESSION / CURLINFO_TLS_SSL_PTR type confusion'

23 Jul 2025

b'GitLab' disclosed a bug submitted by b'timothyleung' 
b'Mint Oauth2 access token for targeted user'

23 Jul 2025

b'curl' disclosed a bug submitted by b'lyb_unaffiliated' 
b'on the implications of permitting procedural culling'

22 Jul 2025

b'curl' disclosed a bug submitted by b'cmeister2' 
b'curl ASSERTs when accessing an LDAP URL'

22 Jul 2025

b'AWS VDP' disclosed a bug submitted by b'muhammad_kasim' 
b'XSS on Amazon Aquisition: elemental'

22 Jul 2025

b'Remitly' disclosed a bug submitted by b'db3wy' 
b'[CRITICAL] 0-Click Account Takeover via Password Reset [AUTH-3243] /orchestrator/v1/password_reset/start'

21 Jul 2025

1 2 3 ... 735

BY DENIS WERNER - @NOBBD - IMPRESSUM