The unofficial HackerOne disclosure Timeline

b'curl' disclosed a bug submitted by b'giant_anteater'
b'CVE-2026-8932: incomplete mTLS config matching in conn reuse'

24 Jun 2026 timeline

b'curl' disclosed a bug submitted by b'adyej'
b'CVE-2026-8927: env-set cross-proxy Digest auth state leak'

24 Jun 2026 timeline

b'curl' disclosed a bug submitted by b'giant_anteater'
b'CVE-2026-8925: SASL double-free'

24 Jun 2026 timeline

b'curl' disclosed a bug submitted by b'giant_anteater'
b'CVE-2026-8926: password leak with netrc and user in URL'

24 Jun 2026 timeline

b'curl' disclosed a bug submitted by b'areksaxyz'
b'CVE-2026-8458: wrong reuse for different services'

24 Jun 2026 timeline

b'SingleStore' disclosed a bug submitted by b'axolot23'
b'Insufficient checks in the file path parameter allow writing to unauthorized directories'

24 Jun 2026 timeline

b'curl' disclosed a bug submitted by b'hahahkim'
b'CVE-2026-9545: exposing HTTP/3 early data'

24 Jun 2026 timeline

b'curl' disclosed a bug submitted by b'jjchuck'
b'CVE-2026-11856: cross-origin Digest auth state leak'

24 Jun 2026 timeline

b'Mozilla' disclosed a bug submitted by b'anshuman_bh'
b'Taskcluster web-server OAuth2 authorization codes are reusable and the exchange handler checks the wrong expiry column'

23 Jun 2026 timeline

b'Node.js' disclosed a bug submitted by b'yottt'
b'Node --run POSIX positional argument escaping allows shell command injection'

23 Jun 2026 timeline

b'Khan Academy' disclosed a bug submitted by b'farr'
b'1-Click Account Takeover via Open Redirect through Regex Bypass in Domain Validation'

20 Jun 2026 timeline

b'Node.js' disclosed a bug submitted by b'pimterry'
b'HTTP/2 sessions never clean up after GOAWAY on invalid protocol errors'

18 Jun 2026 timeline

b'Node.js' disclosed a bug submitted by b'suul'
b'Permission Model Bypass via `process.report.writeReport()` Path Misvalidation'

18 Jun 2026 timeline

b'Shopify' disclosed a bug submitted by b'saltymermaid'
b'Reflected XSS in AI Chat Bot Greetings at help.shopify.com via Markdown Image Rendering'

18 Jun 2026 timeline

b'HackerOne' disclosed a bug submitted by b'brumbelow'
b'Authenticated Elasticsearch Painless script execution via Query.search.sort_query on hackerone.com/graphql'

17 Jun 2026 timeline

b'curl' disclosed a bug submitted by b'argareksapatii'
b'verify-release rebuilds from the tarball under verification, enabling pre-check command execution and false OK for a malicious curl release tarball'

17 Jun 2026 timeline

b'curl' disclosed a bug submitted by b'newstuff321'
b'Vulnerability Report: Buffer Overflow in Path Sanitization'

16 Jun 2026 timeline

b'Rocket.Chat' disclosed a bug submitted by b'eldudareeno'
b'Unauthenticated file deletion via deleteFileMessage DDP method allows permanent destruction of any uploaded file'

16 Jun 2026 timeline

b'Tor' disclosed a bug submitted by b'aptupdate'
b'Malicious Conflux Endpoint Can Leave Stale Global OOO Queue Accounting After Teardown'

16 Jun 2026 timeline

b'Rocket.Chat' disclosed a bug submitted by b'aikido_security'
b'Unauthenticated reading of every file via livechat auth and predicting MongoDB ObjectId()'

15 Jun 2026 timeline

1 ... 8 9 10 11 12 ... 776

BY DENIS WERNER - @NOBBD - IMPRESSUM

the unofficial HackerOne disclosure timeline.