the unofficial HackerOne disclosure timeline.

X
b'IBM' disclosed a bug submitted by b'entrovyx' 
b'Reflected Cross-Site Scripting (XSS) found on IBM.com domain'
15 Jun 2026 timeline
b'curl' disclosed a bug submitted by b'unknowperson0212' 
b'Incomplete Suppression of Transfer-Encoding: chunked Header in HTTP/2 After Redirect From HTTP/1.1'
15 Jun 2026 timeline
b'curl' disclosed a bug submitted by b'daviey' 
b' Secure cookies leaked to HTTP origins through HTTPS forwarding proxy'
15 Jun 2026 timeline
b'PortSwigger Web Security' disclosed a bug submitted by b'hacker-kartel' 
b'UI Consent Bypass via Comma Injection in `addAutoApproveTarget` User-Approval Dialog and Persistence Layer Disagree on Target Scope, Yielding Authen'
15 Jun 2026 timeline
b'PortSwigger Web Security' disclosed a bug submitted by b'kawakatz' 
b'Burp Suite Professional: browser-powered crawl can write attacker-controlled files through file input handling'
14 Jun 2026 timeline
b'curl' disclosed a bug submitted by b'violet12331' 
b'Duplicate chunked Transfer-Encoding lets a malicious origin smuggle a response across reused HTTP proxy connections'
13 Jun 2026 timeline
b'Node.js' disclosed a bug submitted by b'shinchan_69' 
b' Incomplete Fix for CVE-2026-21637: OCSPRequest and resumeSession Events Crash Node.js TLS Server via Unhandled Synchronous Exceptions'
12 Jun 2026 timeline
b'AWS VDP' disclosed a bug submitted by b'inkerton' 
b'Command Injection via Unsanitized Bundling Options in `aws-cdk-lib/aws-lambda-nodejs`'
11 Jun 2026 timeline
b'AWS VDP' disclosed a bug submitted by b'terrynini38514' 
b' Firecracker Out-of-bounds Read/Write Local Privilege Escalation Vulnerability'
11 Jun 2026 timeline
b'curl' disclosed a bug submitted by b'bugthiru' 
b'CRLF Injection via Custom HTTP Headers'
11 Jun 2026 timeline
b'curl' disclosed a bug submitted by b'fg0x0' 
b'heap-use-after-free in state.referer when CURLOPT_REFERER replaced or cleared after perform'
11 Jun 2026 timeline
b'DuckDuckGo' disclosed a bug submitted by b'6r1ff1n' 
b'RCE + PAT Exfiltration via pull_request_target in privacy-configuration/auto-respond-pr.yml Direct Supply Chain to All DDG Browsers'
11 Jun 2026 timeline
b'DuckDuckGo' disclosed a bug submitted by b'6r1ff1n' 
b'RCE + Supply Chain Attack via pull_request_target in content-scope-scripts/semver-label.yml Affects All DuckDuckGo Browsers'
11 Jun 2026 timeline
b'Rocket.Chat' disclosed a bug submitted by b'button142857' 
b'SSRF via Improper Redirect Validation in Rocket.Chat oEmbed Function'
11 Jun 2026 timeline
b'Rocket.Chat' disclosed a bug submitted by b'button142857' 
b'SSRF via improper validation after DNS name resolution in the link-preview feature'
11 Jun 2026 timeline
b'curl' disclosed a bug submitted by b'monk17' 
b'curl-ipv4-percent-normalization-SSRF'
10 Jun 2026 timeline
b'curl' disclosed a bug submitted by b'azraelxuemo' 
b'Trailing-Dot Hostname in Redirect Silently Strips Client Certificate and Auth Credentials'
10 Jun 2026 timeline
b'curl' disclosed a bug submitted by b'nyymi' 
b'curl/libcurl vulnerable to TLS truncation attacks'
10 Jun 2026 timeline
b'curl' disclosed a bug submitted by b'byteray_ltd' 
b'SSH/SFTP connection reuse can bypass SSH key identity after ssh_config_matches removal'
09 Jun 2026 timeline
b'curl' disclosed a bug submitted by b'kalfkinen' 
b'SOCKS5 no-auth accepted despite username/password-only authentication'
09 Jun 2026 timeline
1 ... 9 10 11 12 13 ... 776
Follow @disclosedh1 on twitter to receive updates when a new bug is disclosed!
Twitter
BY DENIS WERNER - @NOBBD - IMPRESSUM