The unofficial HackerOne disclosure Timeline

b'curl' disclosed a bug submitted by b'giant_anteater'
b'Trailing-dot IPv4 URL bypasses IP-address guard, allows wildcard DNS SAN match'

17 May 2026 timeline

b'curl' disclosed a bug submitted by b'mulan_dh'
b'NULL pointer dereference in libcurl URL API redirect_url() with CURLU_DEFAULT_SCHEME'

17 May 2026 timeline

b'Nextcloud' disclosed a bug submitted by b'suul'
b'SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution'

15 May 2026 timeline

b'Yuga Labs' disclosed a bug submitted by b'r00tsid'
b'Origin IP Exposed waf bypass'

14 May 2026 timeline

b'curl' disclosed a bug submitted by b'rootofpi_ramesh'
b'Kerberos/SPNEGO Connection Reuse Vulnerability'

14 May 2026 timeline

b'AWS VDP' disclosed a bug submitted by b'jcow'
b'QuickSight Authorization Bypass: Chat Agents Accessible Despite Custom Permissions Denial'

12 May 2026 timeline

b'Liberapay' disclosed a bug submitted by b'rox-11'
b'another liberapay member team twitter account broken Link Hijacking via Expired Twitter Account Link'

09 May 2026 timeline

b'Liberapay' disclosed a bug submitted by b'rox-11'
b'Liberapay member team twitter account broken Link Hijacking via Expired Twitter Account Link'

09 May 2026 timeline

b'Nextcloud' disclosed a bug submitted by b'vidang04'
b'Private circle can be added to another circle via API despite visibility restriction'

08 May 2026 timeline

b'Nextcloud' disclosed a bug submitted by b'0x0doteth'
b'Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner '

08 May 2026 timeline

b'Nextcloud' disclosed a bug submitted by b'yoyomiski'
b'View-only guests could see deleted Collectives pages in the trashbin'

08 May 2026 timeline

b'curl' disclosed a bug submitted by b'shecantcode2'
b'mbedTLS private-key blob null-termination asymmetry in lib/vtls/mbedtls.c (mbed_load_privkey)'

07 May 2026 timeline

b'Ruby on Rails' disclosed a bug submitted by b'ksw9722'
b'ActiveStorage Disk Service Path Traversal via Custom Blob Key Injection'

07 May 2026 timeline

b'Monero' disclosed a bug submitted by b'rorkh'
b'Critical Deadlock Vulnerability in Monero RPC Leading to Complete Node Paralysis'

06 May 2026 timeline

b'Monero' disclosed a bug submitted by b'yulge'
b'Connection Count Bug in Monero Node Enables Outbound Peer Reset Attack'

06 May 2026 timeline

b'curl' disclosed a bug submitted by b'p4p3r_hak'
b'wcurl treats some URL operands after -- as curl options'

06 May 2026 timeline

05 May 2026 timeline

b'curl' disclosed a bug submitted by b'ravindrasl2026'
b'Potential Resource Leak in tool_parsecfg.c at line 279 during fileerror'

05 May 2026 timeline

b'curl' disclosed a bug submitted by b'codexxxx'
b'libcurl 8.20.0 incomplete fix for CVE-2026-7168: changing only CURLOPT_PROXYPORT leaks stale Proxy Digest auth to a different proxy'

05 May 2026 timeline

b'curl' disclosed a bug submitted by b'orelbn7'
b'MQTT CONNACK Packet Type Bypass leads to RCE via Malicious Broker'

05 May 2026 timeline

1 ... 10 11 12 13 14 ... 772

BY DENIS WERNER - @NOBBD - IMPRESSUM

the unofficial HackerOne disclosure timeline.