Now on Twitter

the unofficial HackerOne disclosure timeline.

X

b'Node.js' disclosed a bug submitted by b'hahahkim' 
b'Re-entrant `nghttp2_session_mem_send()` during `nghttp2_session_mem_recv()` causes heap-use-after-free in Node.js HTTP/2'

28 Aug 2026

b'Node.js' disclosed a bug submitted by b'leduckhuong' 
b'HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion'

28 Aug 2026

b'curl' disclosed a bug submitted by b'giant_anteater' 
b'46: `--libcurl` output carries `--insecure` across `--next` boundaries'

28 Aug 2026

b'curl' disclosed a bug submitted by b'giant_anteater' 
b'28: HTTP/3 UDP path ignores CURL_SOCKOPT_ALREADY_CONNECTED, reconnects callback-provided socket'

28 Aug 2026

b'curl' disclosed a bug submitted by b'giant_anteater' 
b'34: `curl_mprintf` reads `double` for documented `long double` conversions uninitialized value disclosure'

28 Aug 2026

b'curl' disclosed a bug submitted by b'giant_anteater' 
b'--etag-save - truncates append-redirected stdout'

28 Aug 2026

b'curl' disclosed a bug submitted by b'giant_anteater' 
b'Stacked --proto modifiers leave denied protocol enabled'

28 Aug 2026

b'curl' disclosed a bug submitted by b'giant_anteater' 
b'Unbound cross-peer HTTP Digest challenge state'

27 Aug 2026

b'curl' disclosed a bug submitted by b'giant_anteater' 
b'ARG_CLEAR credential scrubbing wipes only UTF-8 copies on Windows Unicode builds'

27 Aug 2026

b'Essity' disclosed a bug submitted by b'matty69v' 
b'Pre-authentication Stored XSS in Essity Customer-Service Pipeline via ContactApi (reCAPTCHA bypass + no rate limit)'

27 Aug 2026

b'Essity' disclosed a bug submitted by b'matty69v' 
b'Critical SQL Injection WDM API ()'

27 Aug 2026

b'curl' disclosed a bug submitted by b'k4rasu_s4ma' 
b' curl_share TOCTOU > RCE via Curl_llist _dtor Function Pointer Hijack'

26 Aug 2026

b'Discourse' disclosed a bug submitted by b'ahpuh' 
b'Hidden/restricted tags can be mutated through synonym ID paths without per-tag authorization'

26 Aug 2026

b'GitHub' disclosed a bug submitted by b'ahacker1' 
b'Add labels to arbitrary issues/prs via Memex Bulk Update to compromise github actions label gating '

25 Aug 2026

b'curl' disclosed a bug submitted by b'1rhino2' 
b'TLS session cache case-folds CA paths and bypasses the active trust profile'

25 Aug 2026

b'curl' disclosed a bug submitted by b'subadevan' 
b'libcurl Digest/NTLM authentication ignores an explicit Authorization header'

25 Aug 2026

b'8x8' disclosed a bug submitted by b'a3z4km3' 
b'@jitsi/docker-jitsi-meet: `/colibri-relay-ws/` unsafe nginx regex (OCTO relay configuration)'

25 Aug 2026

b'curl' disclosed a bug submitted by b'subadevan' 
b'RTSP CRLF injection in libcurl allows CURLOPT_RTSP_* values to inject commands into independent sessions'

24 Aug 2026

b'curl' disclosed a bug submitted by b'subadevan' 
b'wolfSSL backend disables hostname verification when CURLOPT_SSL_VERIFYPEER is 0'

24 Aug 2026

b'Ruby on Rails' disclosed a bug submitted by b'offsetmd' 
b'URI scheme validation bypass in ActionText `to_markdown` via user-supplied `<action-text-markdown>` marker tag'

24 Aug 2026

1 2 3 4 5 ... 776

BY DENIS WERNER - @NOBBD - IMPRESSUM