The unofficial HackerOne disclosure Timeline

b'Nextcloud' disclosed a bug submitted by b'kuninogu'
b'TaskProcessing callback authorization bypass allows ex-members to post as Assistant Talk Bot'

14 Aug 2026 timeline

b'curl' disclosed a bug submitted by b'mr4bugs'
b'Windows SSPI connection-pool probe can reuse a connection under the wrong user'

14 Aug 2026 timeline

b'curl' disclosed a bug submitted by b'mr4bugs'
b'libcurl cache updates follow symlinks and truncate their targets'

14 Aug 2026 timeline

b'curl' disclosed a bug submitted by b'1rhino2'
b'Cookie jar load skips public suffix check on PSL builds'

14 Aug 2026 timeline

b'Yelp' disclosed a bug submitted by b'0xkarim_dix'
b'Debug Deep Link Abuse Allows Repeated Forced Logout and Application Disruption'

13 Aug 2026 timeline

b'8x8' disclosed a bug submitted by b'offseq'
b'JaaS: Unauthenticated, cross-tenant outbound SIP calling via JaaS SIP gateway (toll fraud + caller-ID spoofing)'

12 Aug 2026 timeline

b'Myndr' disclosed a bug submitted by b'hackwithshubh'
b' Myndr CORS Misconfiguration'

12 Aug 2026 timeline

b'CoinMate.io' disclosed a bug submitted by b'ganesh_reddy'
b'Adding phone number to profile By OTP brute forcing'

08 Aug 2026 timeline

b'curl' disclosed a bug submitted by b'thinhlx'
b'URL API: triple-slash parses path segment as hostname'

07 Aug 2026 timeline

b'Nintendo' disclosed a bug submitted by b'jonbarrow'
b'[Wii U/3DS/Switch] Improper bounds check in StationURL in all NEX clients leading to remote crash/RCE'

07 Aug 2026 timeline

b'Mozilla' disclosed a bug submitted by b'griffinf'
b'Unauthenticated RCE in Taskcluster web-server via GraphQL filter argument (sift $where)'

05 Aug 2026 timeline

b'curl' disclosed a bug submitted by b'kiyin'
b'curl Missing Sec-WebSocket-Accept Verification Enables MITM WebSocket Session Hijacking'

05 Aug 2026 timeline

b'Monero' disclosed a bug submitted by b'bebensap'
b'`check_reserve_proof` counts duplicate entries: one output can inflate `total`'

05 Aug 2026 timeline

b'Monero' disclosed a bug submitted by b'bebensap'
b' `check_reserve_proof` sums RingCT ECDH amounts without checking the output commitment'

05 Aug 2026 timeline

b'Monero' disclosed a bug submitted by b'bebensap'
b'wallet-rpc crash via malformed /gettransactions response (empty txs vector::front() in check_tx_key / check_tx_proof)'

05 Aug 2026 timeline

b'Monero' disclosed a bug submitted by b'bebensap'
b'SpendProofV1 txid-substitution: get_spend_proof/check_spend_proof do not verify returned transaction hash'

05 Aug 2026 timeline

b'Monero' disclosed a bug submitted by b'bebensap'
b'wallet-rpc describe_transfer uses real_output_in_tx_index instead of real_output: cold-wallet pre-sign review shows wrong ring member'

05 Aug 2026 timeline

b'Monero' disclosed a bug submitted by b'benisprlh'
b' `relay_tx` wallet-rpc skips `--restricted-rpc` guard and lets any caller corrupt wallet state via attacker-controlled `pending_tx`'

05 Aug 2026 timeline

b'curl' disclosed a bug submitted by b'juthawong'
b'Heap use-after-free (write) in mev_forget_socket() via reentrant curl_easy_pause() incomplete fix for CVE-2026-9080'

04 Aug 2026 timeline

1 2 3 ... 772

BY DENIS WERNER - @NOBBD - IMPRESSUM

the unofficial HackerOne disclosure timeline.