Now on Twitter

the unofficial HackerOne disclosure timeline.

X

b'Nextcloud' disclosed a bug submitted by b'mirachael' 
b'Path Traversal in Nextcloud Talk Android Exposes User Credentials and Private Data via FileProvider'

24 Aug 2026

b'curl' disclosed a bug submitted by b'accl' 
b'Domainless COOKIEFILE cookie leaks to unrelated IP-literal hosts'

21 Aug 2026

b'Monero' disclosed a bug submitted by b'lilpeko' 
b'Monero GUI OpenAlias DNSSEC-invalid resolution still writes spoofable address into recipient field'

20 Aug 2026

b'Monero' disclosed a bug submitted by b'qttps' 
b'View-only offline transaction creation bypasses the long-payment-ID privacy block'

20 Aug 2026

b'Monero' disclosed a bug submitted by b'fg0x0' 
b'HTML Injection in Transaction Confirmation Dialog via Address Book Description Enables UI Spoofing Before Fund Transfer'

20 Aug 2026

b'Monero' disclosed a bug submitted by b'qttps' 
b'Windows installer grants low-privileged users write access to executable P2Pool directory, enabling local code execution'

20 Aug 2026

b'Monero' disclosed a bug submitted by b'qttps' 
b'monero:// deeplink parsing accepts tx_amount=(all) and can trigger send-all transaction mode'

20 Aug 2026

b'Monero' disclosed a bug submitted by b'k-privacy-enjoyer' 
b"Loss of multisig funds through single malicious participant's deliberate deception"

20 Aug 2026

b'Rocket.Chat' disclosed a bug submitted by b'iamaangx028' 
b'DDP methods getThreadsList / getThreadMessages leaks private thread content to any authenticated low privilege user (unpatched sibling of #1446767)'

20 Aug 2026

b'Rocket.Chat' disclosed a bug submitted by b'hillng' 
b'Stored HTML Injection (CWE-79) via Livechat Visitor Name'

20 Aug 2026

b'Monero' disclosed a bug submitted by b'usagirabbit' 
b'Wallet RPC Restricted-Mode Policy Bypass'

17 Aug 2026

b'Monero' disclosed a bug submitted by b'usagirabbit' 
b'Restricted RPC Policy Bypass on ZMQ JSON-RPC Allows Unauthenticated Remote Admin Actions'

17 Aug 2026

b'Nextcloud' disclosed a bug submitted by b'kuninogu' 
b'TaskProcessing callback authorization bypass allows ex-members to post as Assistant Talk Bot'

14 Aug 2026

b'curl' disclosed a bug submitted by b'mr4bugs' 
b'Windows SSPI connection-pool probe can reuse a connection under the wrong user'

14 Aug 2026

b'curl' disclosed a bug submitted by b'mr4bugs' 
b'libcurl cache updates follow symlinks and truncate their targets'

14 Aug 2026

b'curl' disclosed a bug submitted by b'1rhino2' 
b'Cookie jar load skips public suffix check on PSL builds'

14 Aug 2026

b'Yelp' disclosed a bug submitted by b'0xkarim_dix' 
b'Debug Deep Link Abuse Allows Repeated Forced Logout and Application Disruption'

13 Aug 2026

b'8x8' disclosed a bug submitted by b'offseq' 
b'JaaS: Unauthenticated, cross-tenant outbound SIP calling via JaaS SIP gateway (toll fraud + caller-ID spoofing)'

12 Aug 2026

b'Myndr' disclosed a bug submitted by b'hackwithshubh' 
b' Myndr CORS Misconfiguration'

12 Aug 2026

b'CoinMate.io' disclosed a bug submitted by b'ganesh_reddy' 
b'Adding phone number to profile By OTP brute forcing'

08 Aug 2026

1 2 3 4 5 6 ... 776

BY DENIS WERNER - @NOBBD - IMPRESSUM