The unofficial HackerOne disclosure Timeline

b'Monero' disclosed a bug submitted by b'bebensap'
b' `check_reserve_proof` sums RingCT ECDH amounts without checking the output commitment'

05 Aug 2026 timeline

b'Monero' disclosed a bug submitted by b'bebensap'
b'wallet-rpc crash via malformed /gettransactions response (empty txs vector::front() in check_tx_key / check_tx_proof)'

05 Aug 2026 timeline

b'Monero' disclosed a bug submitted by b'bebensap'
b'SpendProofV1 txid-substitution: get_spend_proof/check_spend_proof do not verify returned transaction hash'

05 Aug 2026 timeline

b'Monero' disclosed a bug submitted by b'bebensap'
b'wallet-rpc describe_transfer uses real_output_in_tx_index instead of real_output: cold-wallet pre-sign review shows wrong ring member'

05 Aug 2026 timeline

b'Monero' disclosed a bug submitted by b'benisprlh'
b'`set_daemon` wallet-rpc silently ignores `ssl_allowed_fingerprints` pinning bypassed, walletdaemon MITM'

05 Aug 2026 timeline

b'Monero' disclosed a bug submitted by b'benisprlh'
b' `relay_tx` wallet-rpc skips `--restricted-rpc` guard and lets any caller corrupt wallet state via attacker-controlled `pending_tx`'

05 Aug 2026 timeline

b'curl' disclosed a bug submitted by b'juthawong'
b'Heap use-after-free (write) in mev_forget_socket() via reentrant curl_easy_pause() incomplete fix for CVE-2026-9080'

04 Aug 2026 timeline

b'AWS VDP' disclosed a bug submitted by b'sh3d0w'
b'GitHub Retired UsernameTakeover From [aws/]'

03 Aug 2026 timeline

b'Rocket.Chat' disclosed a bug submitted by b'howtoplay'
b'Unauthenticated Path Traversal (LFI) via /custom-sounds/ when CustomSounds uses FileSystem storage'

03 Aug 2026 timeline

b'curl' disclosed a bug submitted by b'dark_river'
b'SMTP CRLF injection in custom SMTP recipient operand allows additional SMTP commands after authentication'

03 Aug 2026 timeline

b'Liberapay' disclosed a bug submitted by b'its9me'
b'Unauthenticated team "income/payments" export ignores donor privacy settings (hide_giving, hide_from_lists) and uses frozen visibility, exposing donat'

01 Aug 2026 timeline

b'Node.js' disclosed a bug submitted by b'nadav0077'
b'HTTP Request Smuggling via Connection: close<TAB> in Node.js llhttp parser'

31 Jul 2026 timeline

b'Tucows (VDP)' disclosed a bug submitted by b'axolot23'
b'Stored XSS in nameserver field on account settings page'

31 Jul 2026 timeline

b'phpBB' disclosed a bug submitted by b'a7mmr'
b'Stored XSS via SVG Upload check_content() Blocklist Bypass & 256-Byte Scan Limit (Self-Propagating Worm)'

30 Jul 2026 timeline

b'Node.js' disclosed a bug submitted by b'sinan-polat'
b'Permission Model bypass: process.report writes (and overwrites) files outside --allow-fs-write paths'

30 Jul 2026 timeline

b'Ruby on Rails' disclosed a bug submitted by b'friedchicken112211'
b'Active Storage Vips Transformer Missing validate_transformation CVE-2025-24293 Incomplete Fix'

30 Jul 2026 timeline

b'Node.js' disclosed a bug submitted by b'vnyuh'
b'HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934)'

30 Jul 2026 timeline

b'GitHub' disclosed a bug submitted by b'ahacker1'
b'GitHub scoped user to server tokens can escape their installation'

29 Jul 2026 timeline

b'Node.js' disclosed a bug submitted by b'sy2n0'
b'Permission Model: --allow-fs-read/--allow-fs-write radix-tree prefix-boundary over-grant'

29 Jul 2026 timeline

b'HackerOne' disclosed a bug submitted by b'0v3rw4tch'
b'`exportReportPdf` mutation shows internal Activity'

29 Jul 2026 timeline

1 2 3 4 5 6 ... 774

BY DENIS WERNER - @NOBBD - IMPRESSUM

the unofficial HackerOne disclosure timeline.