Now on Twitter

the unofficial HackerOne disclosure timeline.

X

b'curl' disclosed a bug submitted by b'sdjasj' 
b'curl --skip-existing has a TOCTOU race that lets a post-check symlink redirect the later download write'

20 May 2026

b'curl' disclosed a bug submitted by b'giant_anteater' 
b'Credentials forwarded to HTTP after HTTPSHTTP same-port redirect url_set_data_creds uses scheme-blind comparator'

20 May 2026

b'CoinMate.io' disclosed a bug submitted by b'glferreira-devsecops' 
b'POST /api/bitcoinWithdrawalFees returns financial data without authentication despite being documented as a USER OPERATION (private endpoint)'

20 May 2026

b'CoinMate.io' disclosed a bug submitted by b'glferreira-devsecops' 
b'HMAC signature verification omits endpoint and payload allowing request forgery on CoinMate API'

20 May 2026

b'curl' disclosed a bug submitted by b'giant_anteater' 
b'HTTP/3 paused transfer buffers incoming data without bound up to ~1 GiB'

19 May 2026

b'curl' disclosed a bug submitted by b'giant_anteater' 
b'Schannel custom-CA path skips Extended Key Usage enforcement'

19 May 2026

b'curl' disclosed a bug submitted by b'7omoo' 
b'Connection reuse ignores haproxyprotocol and HAPROXY_CLIENT_IP settings, allowing PROXY context to persist across transfers'

19 May 2026

b'curl' disclosed a bug submitted by b'hexproof' 
b"SSL session-cache peer key omits signature_algorithms: strict-sigalg handle silently resumes a permissive sibling's session"

19 May 2026

b'curl' disclosed a bug submitted by b'giant_anteater' 
b'CURLOPT_PROXY_CAINFO_BLOB silently activates native CA store on Apple builds'

19 May 2026

b'curl' disclosed a bug submitted by b'giant_anteater' 
b'TLS peer-verification bypass via mid-transfer ssl_config mutation'

19 May 2026

b'curl' disclosed a bug submitted by b'giant_anteater' 
b'TLS verifyhost bypass in rustls, mbedTLS, and wolfSSL when verifypeer=0'

19 May 2026

b'curl' disclosed a bug submitted by b'giant_anteater' 
b'HTTP/2 proxy CONNECT tunnel unbounded 1xx chain (missing Curl_bump_headersize cap in cf-h2-proxy.c)'

19 May 2026

b'GitHub' disclosed a bug submitted by b'ahacker1' 
b'Cross-repository IDOR in `/settings/security_analysis/bypass_reviewers` allows unauthorized delegated bypass reviewer modification'

19 May 2026

b'curl' disclosed a bug submitted by b'giant_anteater' 
b'CURLOPT_HSTS_CTRL disables shared HSTS without share guard use-after-free and double-free'

18 May 2026

b'curl' disclosed a bug submitted by b'giant_anteater' 
b'cookie: case-insensitive path comparison in replace_existing() allows cookie eviction across distinct paths'

18 May 2026

b'curl' disclosed a bug submitted by b'giant_anteater' 
b'libssh SFTP initialization ignores CURLOPT_TIMEOUT, hangs indefinitely'

18 May 2026

b'curl' disclosed a bug submitted by b'giant_anteater' 
b'rustls backend silently ignores CURLOPT_CRLFILE when native CA store is active'

18 May 2026

b'curl' disclosed a bug submitted by b'giant_anteater' 
b'HSTS multi-trailing-dot bypass-ish: possible incomplete fix for CVE-2022-30115'

18 May 2026

b'Enjin' disclosed a bug submitted by b'ph0r3nsic' 
b'Unauthenticated File Upload to CDN'

18 May 2026

b'Rocket.Chat' disclosed a bug submitted by b'josan_george' 
b'IDOR: autotranslate.translateMessage Full Message Content Leak'

18 May 2026

1 ... 9 10 11 12 13 ... 772

BY DENIS WERNER - @NOBBD - IMPRESSUM