Now on Twitter

the unofficial HackerOne disclosure timeline.

X

b'Nextcloud' disclosed a bug submitted by b'nilsding' 
b'Information disclosure via Desktop client when attempting to lock a file inside a end-to-end encrypted directory '

04 Jan 2026

b'Nextcloud' disclosed a bug submitted by b'updatelap' 
b'Stored XSS in contacts app via organisation and title field'

04 Jan 2026

b'curl' disclosed a bug submitted by b'huntsd' 
b'PROTOCOL-LEVEL: Persistent UDP Amplification and Cache Poisoning via Alt-Svc Logic Flaw'

02 Jan 2026

b'curl' disclosed a bug submitted by b'n12d11n' 
b'HTTP Request Smuggling and SSRF via CRLF Injection in Curl_add_custom_headers'

02 Jan 2026

b'curl' disclosed a bug submitted by b'gaurav0212' 
b'CRLF Injection in Gopher Protocol (`lib/gopher.c`)'

02 Jan 2026

b'PortSwigger Web Security' disclosed a bug submitted by b'osama-hamad' 
b'The role "CI-driven scan initiator" provides excessive read access'

02 Jan 2026

b'curl' disclosed a bug submitted by b'ssyyaa' 
b'MQTT Protocol Violation & Integer Overflow in libcurl'

01 Jan 2026

b'curl' disclosed a bug submitted by b'ltl_professor' 
b'A quiet New Year wish for security researchers'

01 Jan 2026

b'IBM' disclosed a bug submitted by b'dara_7979' 
b'Remote Code Execution identified on IBM endpoint.'

31 Dec 2025

b'curl' disclosed a bug submitted by b'cyberguardianrd' 
b'HTTP/2 and HTTP/3 Header Injection in curl'

30 Dec 2025

b'curl' disclosed a bug submitted by b'yupiy' 
b'Proxy-Authorization header is leaked to origin server after redirect from proxied to direct connection'

30 Dec 2025

b'curl' disclosed a bug submitted by b'ltl_professor' 
b'SMTP CRLF Injection & Protocol Desynchronization in libcurl'

29 Dec 2025

b'curl' disclosed a bug submitted by b'stif' 
b'Telnet Suboption Buffer Pointer Underflow in lib/telnet.c leads to Out-of-Bounds Read'

29 Dec 2025

b'curl' disclosed a bug submitted by b'onevone' 
b'CrossLayer State Confusion in libcurl: Credential & KeyMaterial Persistence Across Redirect / Connection Reuse Boundaries'

28 Dec 2025

b'curl' disclosed a bug submitted by b'efrsxcv' 
b'WebSocket Logic Error: Control Frame (PING/PONG) Starvation causes Connection Drop (DoS) during large transfers'

28 Dec 2025

b'curl' disclosed a bug submitted by b'efrsxcv' 
b'Heap Buffer Over-read in lib/http2.c (on_header) handling PUSH_PROMISE frames'

28 Dec 2025

b'curl' disclosed a bug submitted by b'efrsxcv' 
b'CRLF Injection / Protocol Smuggling in libcurl via CURLOPT_USERNAME (IMAP)'

28 Dec 2025

b'curl' disclosed a bug submitted by b'0x0000nosfu' 
b'HTTP/3 Protocol Smuggling and Header Injection via CRLF in QPACK value conversion'

27 Dec 2025

b'curl' disclosed a bug submitted by b'y_security' 
b'Security hardening: missing integer overflow check in curl_load_library()'

27 Dec 2025

b'curl' disclosed a bug submitted by b'0x0000nosfu' 
b'Protocol Smuggling / CRLF Injection via Gopher Protocol allows Arbitrary Command Injection'

25 Dec 2025

1 ... 24 25 26 27 28 ... 772

BY DENIS WERNER - @NOBBD - IMPRESSUM