The unofficial HackerOne disclosure Timeline

b'AWS VDP' disclosed a bug submitted by b'notnotnotveg'
b'AWS *.a2z.com | Unauthenticated Clickhouse UI : Database access + SSRF'

22 Jul 2026 timeline

b'GitHub' disclosed a bug submitted by b'ahacker1'
b'GitHub user to server tokens can create issues in any public repository'

22 Jul 2026 timeline

b'8x8' disclosed a bug submitted by b'kyotozzx'
b'connect.8x8.com/api/v1: JWT Algorithm Confusion Vulnerability'

22 Jul 2026 timeline

b'GitHub' disclosed a bug submitted by b'ahacker1'
b'OAuth redirect uri validation bypass for :proxima_first_party_sync apps'

21 Jul 2026 timeline

b'Monero' disclosed a bug submitted by b'int0ha_'
b'Restricted RPC leaks alternative block hashes via /get_alt_blocks_hashes'

20 Jul 2026 timeline

b'Rocket.Chat' disclosed a bug submitted by b'olidayw'
b'Stored XSS in Rocket.Chat HTML File Export Unauthenticated Entry via LiveChat'

16 Jul 2026 timeline

b'GitHub' disclosed a bug submitted by b'vaib25vicky'
b'Able to bypass authorization logic and gain more access then intended'

15 Jul 2026 timeline

b'AWS VDP' disclosed a bug submitted by b'mistercloudsec'
b'Bedrock AgentCore Starter Toolkit Creates Gateway IAM Roles Without Confused Deputy Protections'

15 Jul 2026 timeline

b'Basecamp' disclosed a bug submitted by b'newbiefromcoma'
b'Stored XSS on Trix Editor version latest (2.1.16) - Sanitizer Bypass '

14 Jul 2026 timeline

b'AWS VDP' disclosed a bug submitted by b'mistercloudsec'
b'bedrock-mantle.api.aws accepts Bedrock API keys outside the IAM Deny, CloudTrail signal, and invocation logging AWS publishes for Bedrock keys'

14 Jul 2026 timeline

b'SingleStore' disclosed a bug submitted by b'bisht-ji'
b'SELECT ... INTO OUTFILE does not enforce the FILE WRITE privilege unprivileged arbitrary file write on the server'

13 Jul 2026 timeline

b'AWS VDP' disclosed a bug submitted by b'mistercloudsec'
b'Kiro IDE Stores Auth Tokens with World-Readable Permissions (0644)'

09 Jul 2026 timeline

b'AWS VDP' disclosed a bug submitted by b'kaporia'
b'OS Command Injection in `aws-cdk-lib` NodejsFunction via Unsanitized `OsCommand` Helper (Supply Chain RCE)'

06 Jul 2026 timeline

b'Basecamp' disclosed a bug submitted by b'zerodaysec_xyz'
b'Any installed app can force immediate logout and persistent DOS of authenticated Basecamp sessions via unprotected exported StartActivity'

04 Jul 2026 timeline

b'Shopify' disclosed a bug submitted by b'abahack'
b'admin.shopify.com: Shopify Flow continues sending internal emails to a configured recipient after the staff author is removed'

03 Jul 2026 timeline

b'AWS VDP' disclosed a bug submitted by b'nick_frichette_dd'
b'Non-Production API Endpoints for the Amazon S3 Tables Service Fails to Log to CloudTrail Resulting in Silent Permission Enumeration'

02 Jul 2026 timeline

b'8x8' disclosed a bug submitted by b'pmgjoe'
b'jitsi-meet: Prosody/Jigasi missing header whitelist in mod_filter_iq_rayo allows arbitrary SIP header injection and Caller ID spoofing'

02 Jul 2026 timeline

b'8x8' disclosed a bug submitted by b'r1skr1der'
b'jitsi-call-analytics: Unauthenticated arbitrary file write via path traversal in `/api/v1/uploads/analyze`'

02 Jul 2026 timeline

b'Yelp' disclosed a bug submitted by b'0xmanticore'
b'Yelp for Business: locked Email field silently editable via API'

02 Jul 2026 timeline

b'Nintendo' disclosed a bug submitted by b'hana2736'
b'Splatoon 3 In-Match Integrity Bypass via Consensus Reflection Attack on Unordered Peer Submission'

02 Jul 2026 timeline

1 2 3 4 5 ... 772

BY DENIS WERNER - @NOBBD - IMPRESSUM

the unofficial HackerOne disclosure timeline.