The unofficial HackerOne disclosure Timeline

b'Monero' disclosed a bug submitted by b'qttps'
b'Windows installer grants low-privileged users write access to executable P2Pool directory, enabling local code execution'

20 Aug 2026 timeline

b'Monero' disclosed a bug submitted by b'qttps'
b'monero:// deeplink parsing accepts tx_amount=(all) and can trigger send-all transaction mode'

20 Aug 2026 timeline

b'Monero' disclosed a bug submitted by b'k-privacy-enjoyer'
b"Loss of multisig funds through single malicious participant's deliberate deception"

20 Aug 2026 timeline

b'Rocket.Chat' disclosed a bug submitted by b'iamaangx028'
b'DDP methods getThreadsList / getThreadMessages leaks private thread content to any authenticated low privilege user (unpatched sibling of #1446767)'

20 Aug 2026 timeline

b'Rocket.Chat' disclosed a bug submitted by b'hillng'
b'Stored HTML Injection (CWE-79) via Livechat Visitor Name'

20 Aug 2026 timeline

b'Monero' disclosed a bug submitted by b'usagirabbit'
b'Wallet RPC Restricted-Mode Policy Bypass'

17 Aug 2026 timeline

b'Monero' disclosed a bug submitted by b'usagirabbit'
b'Restricted RPC Policy Bypass on ZMQ JSON-RPC Allows Unauthenticated Remote Admin Actions'

17 Aug 2026 timeline

b'Nextcloud' disclosed a bug submitted by b'kuninogu'
b'TaskProcessing callback authorization bypass allows ex-members to post as Assistant Talk Bot'

14 Aug 2026 timeline

b'curl' disclosed a bug submitted by b'mr4bugs'
b'Windows SSPI connection-pool probe can reuse a connection under the wrong user'

14 Aug 2026 timeline

b'curl' disclosed a bug submitted by b'mr4bugs'
b'libcurl cache updates follow symlinks and truncate their targets'

14 Aug 2026 timeline

b'curl' disclosed a bug submitted by b'1rhino2'
b'Cookie jar load skips public suffix check on PSL builds'

14 Aug 2026 timeline

b'Yelp' disclosed a bug submitted by b'0xkarim_dix'
b'Debug Deep Link Abuse Allows Repeated Forced Logout and Application Disruption'

13 Aug 2026 timeline

b'8x8' disclosed a bug submitted by b'offseq'
b'JaaS: Unauthenticated, cross-tenant outbound SIP calling via JaaS SIP gateway (toll fraud + caller-ID spoofing)'

12 Aug 2026 timeline

b'Myndr' disclosed a bug submitted by b'hackwithshubh'
b' Myndr CORS Misconfiguration'

12 Aug 2026 timeline

b'CoinMate.io' disclosed a bug submitted by b'ganesh_reddy'
b'Adding phone number to profile By OTP brute forcing'

08 Aug 2026 timeline

b'curl' disclosed a bug submitted by b'thinhlx'
b'URL API: triple-slash parses path segment as hostname'

07 Aug 2026 timeline

b'Nintendo' disclosed a bug submitted by b'jonbarrow'
b'[Wii U/3DS/Switch] Improper bounds check in StationURL in all NEX clients leading to remote crash/RCE'

07 Aug 2026 timeline

b'Mozilla' disclosed a bug submitted by b'griffinf'
b'Unauthenticated RCE in Taskcluster web-server via GraphQL filter argument (sift $where)'

05 Aug 2026 timeline

b'curl' disclosed a bug submitted by b'kiyin'
b'curl Missing Sec-WebSocket-Accept Verification Enables MITM WebSocket Session Hijacking'

05 Aug 2026 timeline

b'Monero' disclosed a bug submitted by b'bebensap'
b'`check_reserve_proof` counts duplicate entries: one output can inflate `total`'

05 Aug 2026 timeline

1 2 3 4 5 ... 774

BY DENIS WERNER - @NOBBD - IMPRESSUM

the unofficial HackerOne disclosure timeline.