The unofficial HackerOne disclosure Timeline

b'Ruby on Rails' disclosed a bug submitted by b'ooooooo_q'
b'Action Text ReDoS (Ruby 3.1 or lower)'

09 Jun 2026 timeline

b'curl' disclosed a bug submitted by b'torkd1'
b'libcurl: HTTP/1.x bare LF byte in response header value enables cookie jar pollution and POST body/credential exfiltration via redirect RC=0, curl 8'

08 Jun 2026 timeline

b'curl' disclosed a bug submitted by b'maxhearnden'
b'DNS domain search list followed for extant domain missing A or AAAA records'

08 Jun 2026 timeline

b'curl' disclosed a bug submitted by b'awofjawofjfawf'
b'OpenSSL TLS 1.2 session resumption accepts expired server certificates in libcurl'

07 Jun 2026 timeline

b'curl' disclosed a bug submitted by b'fanhua'
b'curl cross-origin HTTPS redirect reuses TLS client certificate for unintended second-origin mTLS authentication'

07 Jun 2026 timeline

b'curl' disclosed a bug submitted by b'alphalaab'
b'curl External-Controlled Filename in `--url @file` Leads to Arbitrary File Overwrite'

07 Jun 2026 timeline

b'Nextcloud' disclosed a bug submitted by b'pirikara'
b'Valid share tokens allow to access tempory upload files of share owner'

07 Jun 2026 timeline

b'Nextcloud' disclosed a bug submitted by b'priyanka010'
b'Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC'

07 Jun 2026 timeline

b'Nextcloud' disclosed a bug submitted by b'alper_ozturk'
b'PIN bypass in PassCodeActivity via back button'

07 Jun 2026 timeline

b'curl' disclosed a bug submitted by b'argus-systems'
b'GnuTLS OCSP stapling accepts unrelated SingleResponse (no cert-ID binding)'

05 Jun 2026 timeline

b'curl' disclosed a bug submitted by b'bagder'
b"CURLOPT_PROXY_CRLFILE / CURLOPT_PROXY_ISSUERCERT / CURLOPT_PROXY_ISSUERCERT_BLOB silently ignored on backends that don't support them"

05 Jun 2026 timeline

b'curl' disclosed a bug submitted by b'bagder'
b'Shared HSTS cache accessed without lock'

05 Jun 2026 timeline

b'curl' disclosed a bug submitted by b'hamaowo'
b'RTSP Digest auth state leaks across origins on reused libcurl easy handle'

05 Jun 2026 timeline

b'curl' disclosed a bug submitted by b'bowen111'
b'TFTP upload ignores --continue-at / CURLOPT_RESUME_FROM and leaks skipped local file prefix'

05 Jun 2026 timeline

b'curl' disclosed a bug submitted by b'skksndk'
b'libcurl 8.20.0 ignores HTTP Digest domain protection space and preemptively leaks Digest auth outside the declared scope'

05 Jun 2026 timeline

b'curl' disclosed a bug submitted by b'azraelxuemo'
b'CURLOPT_COOKIE leaked to cross-origin redirect target CURLOPT_UNRESTRICTED_AUTH bypass for the STRING_COOKIE path'

05 Jun 2026 timeline

b'Revive Adserver' disclosed a bug submitted by b'darky_os'
b'Missing access control when linking banners or campaigns to zones '

03 Jun 2026 timeline

b'Revive Adserver' disclosed a bug submitted by b'darky_os'
b'Missing access control when linking trackers to campaigns'

03 Jun 2026 timeline

b'Revive Adserver' disclosed a bug submitted by b'titanrain'
b'Blind SQL injection via clientid parameter in zoneinclude.php'

03 Jun 2026 timeline

b'Revive Adserver' disclosed a bug submitted by b'titanrain'
b'Reflected XSS via clientid parameter in zoneinclude.php'

03 Jun 2026 timeline

1 ... 10 11 12 13 14 ... 776

BY DENIS WERNER - @NOBBD - IMPRESSUM

the unofficial HackerOne disclosure timeline.