The unofficial HackerOne disclosure Timeline

b'RubyGems' disclosed a bug submitted by b'6b_jjj'
b'Server-side ReDoS via user-controlled regex in OIDC Access Policy'

26 Mar 2026 timeline

b'curl' disclosed a bug submitted by b'wizard021'
b'Bearer Token Leaked to Attacker via .netrc Despite CVE-2026-3783 Fix'

26 Mar 2026 timeline

b'curl' disclosed a bug submitted by b'ankitsingh_76'
b'Security Vulnerability Report: Protocol Injection via Programmatic Options'

26 Mar 2026 timeline

b'curl' disclosed a bug submitted by b'3lcarry'
b'HTTP/1.1 Response Desynchronization via conflicting CL/TE headers in Proxy CONNECT'

25 Mar 2026 timeline

b'curl' disclosed a bug submitted by b'tynus'
b'Function `do_pubkey()` can have out-of-bound read issue'

25 Mar 2026 timeline

b'IBM' disclosed a bug submitted by b'bugmithalchemist'
b'Potential Subdomain Takeover on IBM.com domain.'

24 Mar 2026 timeline

b'LinkedIn' disclosed a bug submitted by b'riadalrashed'
b'Access to Deactivated LinkedIn Company Pages via Competitor Analytics API'

24 Mar 2026 timeline

20 Mar 2026 timeline

b'Mozilla' disclosed a bug submitted by b'adilnbabras'
b'[Privilege Escalation] User can Pin|Unpin Any Comment on Any Project or Locale'

20 Mar 2026 timeline

b'curl' disclosed a bug submitted by b'zoroo2'
b'Exposed .git/config File Leading to Potential Sensitive Information Disclosure'

20 Mar 2026 timeline

b'GitHub' disclosed a bug submitted by b'ahacker1'
b'Add labels to arbitrary issues/prs & compromise github actions label checks'

19 Mar 2026 timeline

b'GitHub' disclosed a bug submitted by b's3rdz0'
b'PATs without the required scope can leak issues'

19 Mar 2026 timeline

b'HackerOne' disclosed a bug submitted by b'theokeen'
b'Lack of Validation in Reward Redemption Allows Unlimited Burp Suite License Abuse'

18 Mar 2026 timeline

b'curl' disclosed a bug submitted by b'lg_oled77c5pua'
b'HSTS accepted from HTTP origin behind HTTPS proxy'

17 Mar 2026 timeline

b'curl' disclosed a bug submitted by b'am-perip'
b'Unescaped username in SASL DIGEST-MD5 response allows injection'

17 Mar 2026 timeline

b'LinkedIn' disclosed a bug submitted by b'dphoeniixx'
b'Session Cookie Leakage via Static Header Field in WebViewerFragment'

17 Mar 2026 timeline

b'Lovable VDP' disclosed a bug submitted by b'ziadmomen'
b'Business Logic Bypass Allows Setting Read Access Role Without Pro Plan Subscription'

16 Mar 2026 timeline

b'curl' disclosed a bug submitted by b'tavro'
b'SMB READ_ANDX DataOffset not validated'

16 Mar 2026 timeline

b'Basecamp' disclosed a bug submitted by b'perxibes'
b'Unauthenticated access to private files on app.fizzy.do via Active Storage URLs leads to information disclosure'

16 Mar 2026 timeline

b'Consensys' disclosed a bug submitted by b'aszx87410'
b'Authorization Bypass in Starknet Snap via enableAuthorize parameter leads to unauthorized transaction signing'

13 Mar 2026 timeline

1 ... 16 17 18 19 20 ... 772

BY DENIS WERNER - @NOBBD - IMPRESSUM

the unofficial HackerOne disclosure timeline.