The unofficial HackerOne disclosure Timeline

b'Lovable VDP' disclosed a bug submitted by b'hossam25'
b'Users can change project visibility which requires high subscription by just changing request body'

09 Mar 2026 timeline

b'curl' disclosed a bug submitted by b'brewm4ster'
b'LM Challenge-Response Hash Always Sent in SMB Authentication'

09 Mar 2026 timeline

b'curl' disclosed a bug submitted by b'y_security'
b"In curl's SASL OAUTHBEARER authentication, including the SOH character (0x01) in the username corrupts the message structure."

08 Mar 2026 timeline

b'Kubernetes' disclosed a bug submitted by b'fisjkars'
b'Injection in path parameter of Ingress-nginx'

07 Mar 2026 timeline

b'LinkedIn' disclosed a bug submitted by b'safehacker_2715'
b'IDOR to make someone attend or leave an event'

06 Mar 2026 timeline

b'LinkedIn' disclosed a bug submitted by b'riadalrashed'
b'Blocking a company page admin prevents him from delete paid media admin or edit his roles'

05 Mar 2026 timeline

b'Lovable VDP' disclosed a bug submitted by b'jdc94'
b'Open Redirect on lovable.dev via redirect parameter leads to phishing attacks'

05 Mar 2026 timeline

b'Fastify' disclosed a bug submitted by b'onlybugs05'
b'DoS via Unbounded Memory Allocation in sendWebStream on Fastify v5.7.0+ leads to OOM crash when backpressure is ignored'

05 Mar 2026 timeline

b'GitHub' disclosed a bug submitted by b'ahacker1'
b'Missing Access Control in MigrationFile allows attacker to upload files to any Migration'

05 Mar 2026 timeline

b'curl' disclosed a bug submitted by b'errorbehavior200'
b'SSTI leads to Command injection'

04 Mar 2026 timeline

b'curl' disclosed a bug submitted by b'deepbluev7'
b'Use after free in hyperfifo example'

03 Mar 2026 timeline

b'Omise' disclosed a bug submitted by b'0x7ashish'
b'2FA requirement bypass when inviting team members'

28 Feb 2026 timeline

b'AWS VDP' disclosed a bug submitted by b'h0ne_analyst_94cm4n1'
b'Password Reuse Vulnerability on AWS Sign-in Page via Password Reset Flow leads to Security Policy Violation'

26 Feb 2026 timeline

b'curl' disclosed a bug submitted by b'knickers'
b'Integer Overflow in curl_multi_get_handles() Leading to Heap Buffer Overflow'

26 Feb 2026 timeline

b'curl' disclosed a bug submitted by b'davkor'
b'RTSP RTP Interleaved Parser Assertion Failure (Zero-Length RTP Payload)'

26 Feb 2026 timeline

b'Cloudflare Public Bug Bounty' disclosed a bug submitted by b'matured_kazama'
b'AI Playground XSS to steal user-chat messages and access to connected MCP Server'

26 Feb 2026 timeline

b'curl' disclosed a bug submitted by b'shan_nandi'
b'Able to bypass HSTS using trailing dot'

26 Feb 2026 timeline

b'curl' disclosed a bug submitted by b'pelioro'
b'Curl Telnet Handler Buffer Overflow'

26 Feb 2026 timeline

b'PortSwigger Web Security' disclosed a bug submitted by b'zorixu'
b'HTML Injection in DAST Trial Request Form Confirmation Email PortSwigger'

26 Feb 2026 timeline

b'Mars' disclosed a bug submitted by b'xgoon'
b'Publicly accessible `` endpoint exposing internal user identifiers and email addresses'

24 Feb 2026 timeline

1 ... 21 22 23 24 25 ... 776

BY DENIS WERNER - @NOBBD - IMPRESSUM

the unofficial HackerOne disclosure timeline.