The unofficial HackerOne disclosure Timeline

b'Node.js' disclosed a bug submitted by b'yushengchen'
b'Denial of Service via `__proto__` header name in `req.headersDistinct` (Uncaught `TypeError` crashes Node.js process)'

30 Mar 2026 timeline

b'Node.js' disclosed a bug submitted by b'wooseokdotkim'
b'CVE-2024-36137 Patch Bypass - FileHandle.chmod/chown'

30 Mar 2026 timeline

b'Node.js' disclosed a bug submitted by b'galbarnahum'
b'Memory leak in Node.js HTTP/2 server via WINDOW_UPDATE on stream 0 leads to resource exhaustion'

30 Mar 2026 timeline

b'curl' disclosed a bug submitted by b'sakthi02_sk'
b'CRLF Injection in HAProxy PROXY Protocol via CURLOPT_HAPROXY_CLIENT_IP allows IP spoofing and protocol injection'

30 Mar 2026 timeline

b'curl' disclosed a bug submitted by b'xkiluar'
b'HTTP/2 server push accepts a non-authoritative :scheme=https over cleartext h2c, enabling HTTPS cache-key poisoning'

29 Mar 2026 timeline

b'Tucows (VDP)' disclosed a bug submitted by b'2026'
b'Password Strength Policy Bypass via Server-Side Validation Flaw'

27 Mar 2026 timeline

b'passhash' disclosed a bug submitted by b'sinic'
b'Potential DoS due to PasswordPoliciesNotMet in errors.go'

27 Mar 2026 timeline

b'passhash' disclosed a bug submitted by b'sinic'
b'Missing policies for password in password_policies.go'

27 Mar 2026 timeline

b'Node.js' disclosed a bug submitted by b'rafaelgss'
b'Assertion error in node_url.cc via malformed URL format leads to Node.js crash'

26 Mar 2026 timeline

b'RubyGems' disclosed a bug submitted by b'6b_jjj'
b'Server-side ReDoS via user-controlled regex in OIDC Access Policy'

26 Mar 2026 timeline

b'curl' disclosed a bug submitted by b'wizard021'
b'Bearer Token Leaked to Attacker via .netrc Despite CVE-2026-3783 Fix'

26 Mar 2026 timeline

b'curl' disclosed a bug submitted by b'ankitsingh_76'
b'Security Vulnerability Report: Protocol Injection via Programmatic Options'

26 Mar 2026 timeline

b'curl' disclosed a bug submitted by b'3lcarry'
b'HTTP/1.1 Response Desynchronization via conflicting CL/TE headers in Proxy CONNECT'

25 Mar 2026 timeline

b'curl' disclosed a bug submitted by b'tynus'
b'Function `do_pubkey()` can have out-of-bound read issue'

25 Mar 2026 timeline

b'IBM' disclosed a bug submitted by b'bugmithalchemist'
b'Potential Subdomain Takeover on IBM.com domain.'

24 Mar 2026 timeline

b'LinkedIn' disclosed a bug submitted by b'riadalrashed'
b'Access to Deactivated LinkedIn Company Pages via Competitor Analytics API'

24 Mar 2026 timeline

20 Mar 2026 timeline

b'Mozilla' disclosed a bug submitted by b'adilnbabras'
b'[Privilege Escalation] User can Pin|Unpin Any Comment on Any Project or Locale'

20 Mar 2026 timeline

b'curl' disclosed a bug submitted by b'zoroo2'
b'Exposed .git/config File Leading to Potential Sensitive Information Disclosure'

20 Mar 2026 timeline

b'GitHub' disclosed a bug submitted by b'ahacker1'
b'Add labels to arbitrary issues/prs & compromise github actions label checks'

19 Mar 2026 timeline

1 ... 19 20 21 22 23 ... 776

BY DENIS WERNER - @NOBBD - IMPRESSUM

the unofficial HackerOne disclosure timeline.