The unofficial HackerOne disclosure Timeline

b'Nextcloud' disclosed a bug submitted by b'yoyomiski'
b'View-only guests could see deleted Collectives pages in the trashbin'

08 May 2026 timeline

b'curl' disclosed a bug submitted by b'shecantcode2'
b'mbedTLS private-key blob null-termination asymmetry in lib/vtls/mbedtls.c (mbed_load_privkey)'

07 May 2026 timeline

b'Ruby on Rails' disclosed a bug submitted by b'ksw9722'
b'ActiveStorage Disk Service Path Traversal via Custom Blob Key Injection'

07 May 2026 timeline

b'Monero' disclosed a bug submitted by b'rorkh'
b'Critical Deadlock Vulnerability in Monero RPC Leading to Complete Node Paralysis'

06 May 2026 timeline

b'Monero' disclosed a bug submitted by b'yulge'
b'Connection Count Bug in Monero Node Enables Outbound Peer Reset Attack'

06 May 2026 timeline

b'curl' disclosed a bug submitted by b'p4p3r_hak'
b'wcurl treats some URL operands after -- as curl options'

06 May 2026 timeline

05 May 2026 timeline

b'curl' disclosed a bug submitted by b'ravindrasl2026'
b'Potential Resource Leak in tool_parsecfg.c at line 279 during fileerror'

05 May 2026 timeline

b'curl' disclosed a bug submitted by b'codexxxx'
b'libcurl 8.20.0 incomplete fix for CVE-2026-7168: changing only CURLOPT_PROXYPORT leaks stale Proxy Digest auth to a different proxy'

05 May 2026 timeline

b'curl' disclosed a bug submitted by b'orelbn7'
b'MQTT CONNACK Packet Type Bypass leads to RCE via Malicious Broker'

05 May 2026 timeline

b'Nextcloud' disclosed a bug submitted by b'khoof'
b'Improper input validation On Exported deep-link handler crashes `FileDisplayActivity` on crafted external URL Denial-of-Service'

01 May 2026 timeline

b'PlayStation' disclosed a bug submitted by b'slidybat'
b'Double fdrop on a socket through sys_netcontrol'

01 May 2026 timeline

b'curl' disclosed a bug submitted by b'fxv_ray_st'
b'MQTT state machine confusion: PINGRESP/DISCONNECT with non-zero remaining_length dispatches to stale nextstate'

29 Apr 2026 timeline

b'curl' disclosed a bug submitted by b'nadsec42'
b'Use-After-Free in SMB connection reuse (req->path dangling pointer after needle destruction)'

29 Apr 2026 timeline

b'curl' disclosed a bug submitted by b'anonymous_237'
b'Negotiate connection reuse with wrong credentials when using CURLAUTH_ANY '

29 Apr 2026 timeline

b'curl' disclosed a bug submitted by b'sdainard'
b'Negotiate Authentication Premature on Connection Reuse'

29 Apr 2026 timeline

b'curl' disclosed a bug submitted by b'xkilua'
b'CVE-2026-7168: cross-proxy Digest auth state leak'

29 Apr 2026 timeline

b'curl' disclosed a bug submitted by b'3lcarry'
b'CVE-2026-7009: OCSP stapling bypass with Apple SecTrust'

29 Apr 2026 timeline

b'curl' disclosed a bug submitted by b'joesephdiver'
b'CVE-2026-6253: proxy credentials leak over redirect-to proxy'

29 Apr 2026 timeline

b'curl' disclosed a bug submitted by b'quaccws'
b'CVE-2026-5545: wrong reuse of HTTP Negotiate connection'

29 Apr 2026 timeline

1 ... 11 12 13 14 15 ... 773

BY DENIS WERNER - @NOBBD - IMPRESSUM

the unofficial HackerOne disclosure timeline.