The unofficial HackerOne disclosure Timeline

b'Sony' disclosed a bug submitted by b'resurrect20'
b'DLL side-loading vulnerability in Sony Music Center for PC Ver. 2.7.2 (Latest version)'

31 Mar 2026 timeline

b'Nextcloud' disclosed a bug submitted by b'eclipse07077'
b'Unauthenticated SSRF via Public Reference API -Sharing Token Bypass'

31 Mar 2026 timeline

b'curl' disclosed a bug submitted by b'ankitsingh131225'
b'HackerOne Vulnerability Report: libcurl SSL/TLS Identity Leakage via Insecure Connection Reuse'

31 Mar 2026 timeline

b'curl' disclosed a bug submitted by b'm42kl33'
b'HTTP/2 PUSH_PROMISE header loss on OOM bypasses scheme validation (regression of 2e8c922a89)'

31 Mar 2026 timeline

b'curl' disclosed a bug submitted by b'ok3y'
b'Unbounded GZIP Decompression Leading to Event-Loop Starvation'

31 Mar 2026 timeline

b'arkadiyt-projects' disclosed a bug submitted by b'tipsen'
b'SSRF Filter Bypass via Unblocked NAT64 Local-Use IPv6 Prefix (64:ff9b:1::/48)'

31 Mar 2026 timeline

b'arkadiyt-projects' disclosed a bug submitted by b'tipsen'
b'Path Traversal in writeFile via Unsafe Prefix Containment Check Allows Out-of-Directory Writes'

31 Mar 2026 timeline

b'Node.js' disclosed a bug submitted by b'sharp_edged'
b'HashDoS in V8'

30 Mar 2026 timeline

b'Node.js' disclosed a bug submitted by b'stif'
b'Permission Model Bypass in realpathSync.native Allows File Existence Disclosure'

30 Mar 2026 timeline

b'Node.js' disclosed a bug submitted by b'x_probe'
b'Timing side-channel in HMAC verification via memcmp() in crypto_hmac.cc leads to potential MAC forgery'

30 Mar 2026 timeline

b'Node.js' disclosed a bug submitted by b'xavlimsg'
b'Node.js Permission Model bypass: UDS server bind/listen works without `--allow-net`'

30 Mar 2026 timeline

b'Node.js' disclosed a bug submitted by b'yushengchen'
b'Denial of Service via `__proto__` header name in `req.headersDistinct` (Uncaught `TypeError` crashes Node.js process)'

30 Mar 2026 timeline

b'Node.js' disclosed a bug submitted by b'wooseokdotkim'
b'CVE-2024-36137 Patch Bypass - FileHandle.chmod/chown'

30 Mar 2026 timeline

b'Node.js' disclosed a bug submitted by b'galbarnahum'
b'Memory leak in Node.js HTTP/2 server via WINDOW_UPDATE on stream 0 leads to resource exhaustion'

30 Mar 2026 timeline

b'curl' disclosed a bug submitted by b'sakthi02_sk'
b'CRLF Injection in HAProxy PROXY Protocol via CURLOPT_HAPROXY_CLIENT_IP allows IP spoofing and protocol injection'

30 Mar 2026 timeline

b'curl' disclosed a bug submitted by b'xkiluar'
b'HTTP/2 server push accepts a non-authoritative :scheme=https over cleartext h2c, enabling HTTPS cache-key poisoning'

29 Mar 2026 timeline

b'Tucows (VDP)' disclosed a bug submitted by b'2026'
b'Password Strength Policy Bypass via Server-Side Validation Flaw'

27 Mar 2026 timeline

b'passhash' disclosed a bug submitted by b'sinic'
b'Potential DoS due to PasswordPoliciesNotMet in errors.go'

27 Mar 2026 timeline

b'passhash' disclosed a bug submitted by b'sinic'
b'Missing policies for password in password_policies.go'

27 Mar 2026 timeline

b'Node.js' disclosed a bug submitted by b'rafaelgss'
b'Assertion error in node_url.cc via malformed URL format leads to Node.js crash'

26 Mar 2026 timeline

1 ... 15 16 17 18 19 ... 772

BY DENIS WERNER - @NOBBD - IMPRESSUM

the unofficial HackerOne disclosure timeline.