The unofficial HackerOne disclosure Timeline

b'AWS VDP' disclosed a bug submitted by b'mistercloudsec'
b'Kiro IDE Stores Auth Tokens with World-Readable Permissions (0644)'

09 Jul 2026 timeline

b'AWS VDP' disclosed a bug submitted by b'kaporia'
b'OS Command Injection in `aws-cdk-lib` NodejsFunction via Unsanitized `OsCommand` Helper (Supply Chain RCE)'

06 Jul 2026 timeline

b'Basecamp' disclosed a bug submitted by b'zerodaysec_xyz'
b'Any installed app can force immediate logout and persistent DOS of authenticated Basecamp sessions via unprotected exported StartActivity'

04 Jul 2026 timeline

b'Shopify' disclosed a bug submitted by b'abahack'
b'admin.shopify.com: Shopify Flow continues sending internal emails to a configured recipient after the staff author is removed'

03 Jul 2026 timeline

b'AWS VDP' disclosed a bug submitted by b'nick_frichette_dd'
b'Non-Production API Endpoints for the Amazon S3 Tables Service Fails to Log to CloudTrail Resulting in Silent Permission Enumeration'

02 Jul 2026 timeline

b'8x8' disclosed a bug submitted by b'pmgjoe'
b'jitsi-meet: Prosody/Jigasi missing header whitelist in mod_filter_iq_rayo allows arbitrary SIP header injection and Caller ID spoofing'

02 Jul 2026 timeline

b'8x8' disclosed a bug submitted by b'r1skr1der'
b'jitsi-call-analytics: Unauthenticated arbitrary file write via path traversal in `/api/v1/uploads/analyze`'

02 Jul 2026 timeline

b'Yelp' disclosed a bug submitted by b'0xmanticore'
b'Yelp for Business: locked Email field silently editable via API'

02 Jul 2026 timeline

b'Nintendo' disclosed a bug submitted by b'hana2736'
b'Splatoon 3 In-Match Integrity Bypass via Consensus Reflection Attack on Unordered Peer Submission'

02 Jul 2026 timeline

b'Nintendo' disclosed a bug submitted by b'alzxk11'
b'[Splatoon 3] Kick other players with NplnLogin message'

02 Jul 2026 timeline

b'SingleStore' disclosed a bug submitted by b'bl4ck-'
b'Exceeding the maximum number of spaces allowed by exploiting a Race Condition in the Workspace creation process'

01 Jul 2026 timeline

b'SingleStore' disclosed a bug submitted by b'bl4ck-'
b'Insecure Direct Object Reference (IDOR) allows creating folders.'

01 Jul 2026 timeline

b'SingleStore' disclosed a bug submitted by b'bl4ck-'
b'Delete any folder for any user within the organization'

01 Jul 2026 timeline

b'SingleStore' disclosed a bug submitted by b'bl4ck-'
b'Privilege Escalation Access to the Alert Subscribers page for users with low privileges'

01 Jul 2026 timeline

b'Node.js' disclosed a bug submitted by b'saif-01'
b'Improper Input Validation HTTP Response Parser Unconditionally Accepts Bare CR in Status Line'

01 Jul 2026 timeline

b'curl' disclosed a bug submitted by b'carehi1324'
b'heap-use-after-free in curl_easy_cleanup() called from callback'

30 Jun 2026 timeline

b'curl' disclosed a bug submitted by b'a6b30108'
b'setopt(VERIFYPEER) from callback bypasses TLS verify on connection reuse'

30 Jun 2026 timeline

b'curl' disclosed a bug submitted by b'bigtang'
b'ssh_config_matches is dead code: unauthorized SSH key reuse'

30 Jun 2026 timeline

b'curl' disclosed a bug submitted by b'smaeljaish771'
b'CURLSHOPT_UNSHARE race can cause UAF in shared SSL session cache during HTTPS transfer'

30 Jun 2026 timeline

1 2 3 ... 770

BY DENIS WERNER - @NOBBD - IMPRESSUM

the unofficial HackerOne disclosure timeline.