Now on Twitter

the unofficial HackerOne disclosure timeline.

X

b'curl' disclosed a bug submitted by b'giant_anteater' 
b'HTTP/2 proxy CONNECT tunnel unbounded 1xx chain (missing Curl_bump_headersize cap in cf-h2-proxy.c)'

19 May 2026

b'GitHub' disclosed a bug submitted by b'ahacker1' 
b'Cross-repository IDOR in `/settings/security_analysis/bypass_reviewers` allows unauthorized delegated bypass reviewer modification'

19 May 2026

b'curl' disclosed a bug submitted by b'giant_anteater' 
b'CURLOPT_HSTS_CTRL disables shared HSTS without share guard use-after-free and double-free'

18 May 2026

b'curl' disclosed a bug submitted by b'giant_anteater' 
b'cookie: case-insensitive path comparison in replace_existing() allows cookie eviction across distinct paths'

18 May 2026

b'curl' disclosed a bug submitted by b'giant_anteater' 
b'libssh SFTP initialization ignores CURLOPT_TIMEOUT, hangs indefinitely'

18 May 2026

b'curl' disclosed a bug submitted by b'giant_anteater' 
b'rustls backend silently ignores CURLOPT_CRLFILE when native CA store is active'

18 May 2026

b'curl' disclosed a bug submitted by b'giant_anteater' 
b'HSTS multi-trailing-dot bypass-ish: possible incomplete fix for CVE-2022-30115'

18 May 2026

b'Enjin' disclosed a bug submitted by b'ph0r3nsic' 
b'Unauthenticated File Upload to CDN'

18 May 2026

b'Rocket.Chat' disclosed a bug submitted by b'josan_george' 
b'IDOR: autotranslate.translateMessage Full Message Content Leak'

18 May 2026

b'curl' disclosed a bug submitted by b'giant_anteater' 
b'Trailing-dot IPv4 URL bypasses IP-address guard, allows wildcard DNS SAN match'

17 May 2026

b'curl' disclosed a bug submitted by b'mulan_dh' 
b'NULL pointer dereference in libcurl URL API redirect_url() with CURLU_DEFAULT_SCHEME'

17 May 2026

b'Nextcloud' disclosed a bug submitted by b'suul' 
b'SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution'

15 May 2026

b'Yuga Labs' disclosed a bug submitted by b'r00tsid' 
b'Origin IP Exposed waf bypass'

14 May 2026

b'curl' disclosed a bug submitted by b'rootofpi_ramesh' 
b'Kerberos/SPNEGO Connection Reuse Vulnerability'

14 May 2026

b'AWS VDP' disclosed a bug submitted by b'jcow' 
b'QuickSight Authorization Bypass: Chat Agents Accessible Despite Custom Permissions Denial'

12 May 2026

b'Liberapay' disclosed a bug submitted by b'rox-11' 
b'another liberapay member team twitter account broken Link Hijacking via Expired Twitter Account Link'

09 May 2026

b'Liberapay' disclosed a bug submitted by b'rox-11' 
b'Liberapay member team twitter account broken Link Hijacking via Expired Twitter Account Link'

09 May 2026

b'Nextcloud' disclosed a bug submitted by b'vidang04' 
b'Private circle can be added to another circle via API despite visibility restriction'

08 May 2026

b'Nextcloud' disclosed a bug submitted by b'0x0doteth' 
b'Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner '

08 May 2026

b'Nextcloud' disclosed a bug submitted by b'yoyomiski' 
b'View-only guests could see deleted Collectives pages in the trashbin'

08 May 2026

1 ... 13 14 15 16 17 ... 776

BY DENIS WERNER - @NOBBD - IMPRESSUM