The unofficial HackerOne disclosure Timeline

b'Nextcloud' disclosed a bug submitted by b'nishantbaswal1996'
b'Improper Input Validation and Integer Overflow in timeamount parameter of files_retention app'

05 Sep 2026 timeline

b'Nextcloud' disclosed a bug submitted by b'charankumar39'
b'Missing Duplicate Check allowing Multiple Retention Rules per System Tag'

05 Sep 2026 timeline

b'Nextcloud' disclosed a bug submitted by b'cyebrsunita'
b'Activity app does not verify federated file activity received from remote servers '

05 Sep 2026 timeline

b'Nextcloud' disclosed a bug submitted by b'njh215'
b'Mail contact autocomplete bypasses administrator-configured user enumeration restrictions and expose member information outside the intended scope'

04 Sep 2026 timeline

b'Weblate' disclosed a bug submitted by b'type5afe'
b'API token sent to URL dictated by an untrusted project .weblate file'

04 Sep 2026 timeline

b'Weblate' disclosed a bug submitted by b'type5afe'
b'Unauthenticated ?q= search query causes exponential pyparsing backtracking under a process-global lock in Weblate'

04 Sep 2026 timeline

b'curl' disclosed a bug submitted by b'giant_anteater'
b'18: Explicit IPv6 proxy zone ID silently ignored proxy credentials sent to wrong interface'

31 Aug 2026 timeline

b'curl' disclosed a bug submitted by b'giant_anteater'
b'33: CONNECT_ONLY raw I/O selects wrong connection after CURLOPT_SHARE detach (incomplete fix for CVE-2020-8231)'

31 Aug 2026 timeline

b'curl' disclosed a bug submitted by b'giant_anteater'
b'41: `main_checkfds()` pipe reuse leaks proxy credentials into HTTPS upload body'

31 Aug 2026 timeline

b'curl' disclosed a bug submitted by b'giant_anteater'
b'06: Incomplete fix for CVE-2026-7009: GCC/SecTrust builds silently discard stapled OCSP responses'

31 Aug 2026 timeline

b'Weblate' disclosed a bug submitted by b'visionx7'
b'**Unauthenticated IDOR allows modification of payment customer billing information**'

30 Aug 2026 timeline

b'curl' disclosed a bug submitted by b'giant_anteater'
b'50: CMake `HTTP_ONLY` does not disable SSH backends SCP and SFTP remain usable'

29 Aug 2026 timeline

b'curl' disclosed a bug submitted by b'giant_anteater'
b'42: `VMS_STS` macro typo (`< 3` vs `<< 3`) turns curl failures into successful OpenVMS conditions'

29 Aug 2026 timeline

b'IBM' disclosed a bug submitted by b'inventor0x01'
b'Unauthorized vertical privilege escalation vulnerability found on ibm.com endpoint'

28 Aug 2026 timeline

b'WordPress' disclosed a bug submitted by b'jakubk'
b'Author arbitrary file deletion anywhere on disk (site takeover) via `POST /wp/v2/media/<id>/finalize` poisoning `_wp_attachment_metadata`'

28 Aug 2026 timeline

b'WordPress' disclosed a bug submitted by b'jakubk'
b'Author stored XSS in wp-admin: unescaped sub-size filename from attachment metadata breaks out of the `src` attribute in `get_media_item()`'

28 Aug 2026 timeline

b'Node.js' disclosed a bug submitted by b'yushengchen'
b'HTTP Request Smuggling via Silent Header Truncation in Node.js HTTP Parser'

28 Aug 2026 timeline

b'Node.js' disclosed a bug submitted by b'byvini'
b'Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected)'

28 Aug 2026 timeline

b'Node.js' disclosed a bug submitted by b'cantina-security'
b'dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records'

28 Aug 2026 timeline

b'Node.js' disclosed a bug submitted by b'cantina-security'
b'node:sqlite SQLTagStore Iterator Replay Lets Attacker Re-Execute Victim-Bound Writes Indefinitely'

28 Aug 2026 timeline

1 2 3 4 ... 776

BY DENIS WERNER - @NOBBD - IMPRESSUM

the unofficial HackerOne disclosure timeline.