The unofficial HackerOne disclosure Timeline

b'curl' disclosed a bug submitted by b'xkernel'
b'Double-free vulnerability in libcurl with rustls via NoServerCertVerifier condition leads to application crash'

16 Nov 2025 timeline

b'curl' disclosed a bug submitted by b'pelioro'
b'Incorrect sizeof() in Rustls Backend Memory Allocation'

15 Nov 2025 timeline

b'curl' disclosed a bug submitted by b'pelioro'
b'Off-by-One Buffer Overflow in SMB Path Handler'

15 Nov 2025 timeline

b'curl' disclosed a bug submitted by b'djogho'
b'Malicious server forces .curlrc creation via curl -OJ leading to local file exfiltration'

15 Nov 2025 timeline

b'AWS VDP' disclosed a bug submitted by b'xtawb'
b'Responsible disclosure - public S3 bucket exposing JSON/config files'

14 Nov 2025 timeline

b'lemlist' disclosed a bug submitted by b'sle3pyhead'
b' Authentication Token Theft via Open Redirect in Callback URL Parameter'

14 Nov 2025 timeline

b'curl' disclosed a bug submitted by b'ahn0x'
b'libcurl FTP path normalization flaw allows decoded %2e%2e CWD .. and directory escape (Path Traversal, CWE-22)'

11 Nov 2025 timeline

b'curl' disclosed a bug submitted by b'skymander'
b'Hash exposed in public repository'

11 Nov 2025 timeline

b'Basecamp' disclosed a bug submitted by b'fr4via'
b'Two click Account Takeover '

11 Nov 2025 timeline

b'curl' disclosed a bug submitted by b'tomar-re'
b'Command Injection - CRITICISM'

11 Nov 2025 timeline

b'curl' disclosed a bug submitted by b'rootsecret3'
b'Silent TLS Trust Model Hijacking via `CURL_CA_BUNDLE` Environment Variable Leads to MITM'

11 Nov 2025 timeline

b'curl' disclosed a bug submitted by b'rootsecret3'
b'Arbitrary Configuration File Inclusion: via External Control of File Name or Path'

10 Nov 2025 timeline

b'curl' disclosed a bug submitted by b'haider790h'
b'SMTP CRLF Injection in curl/libcurl via MAIL FROM/RCPT TO parameters'

10 Nov 2025 timeline

b'curl' disclosed a bug submitted by b'jiyong'
b'libcurl MQTT `CURLOPT_POSTFIELDSIZE_LARGE` overflow leads to immediate DoS'

10 Nov 2025 timeline

b'curl' disclosed a bug submitted by b'biswarup_das'
b'Unsafe use of strcpy in Curl_ldap_err2string (packages/OS400/os400sys.c) stack-buffer-overflow (PoC + ASan)'

10 Nov 2025 timeline

b'curl' disclosed a bug submitted by b'bau1u'
b'SMTP CRLF Command Injection in CURLOPT_MAIL_FROM and CURLOPT_MAIL_RCPT'

10 Nov 2025 timeline

b'lemlist' disclosed a bug submitted by b'mcdave'
b'Unauthorized Password Reset Allows Account Takeover Across Tenant Boundaries'

07 Nov 2025 timeline

b'Lovable VDP' disclosed a bug submitted by b'anxioussick'
b'Low-privileged user can enable or disable Lovable AI for new projects in workspace'

07 Nov 2025 timeline

b'Django' disclosed a bug submitted by b'cyberstan'
b'SQL Injection in Django ORM via Unvalidated `_connector` in Q Objects'

06 Nov 2025 timeline

b'curl' disclosed a bug submitted by b'giant_anteater'
b'CVE-2025-10966: missing SFTP host verification with wolfSSH'

05 Nov 2025 timeline

1 ... 31 32 33 34 35 ... 774

BY DENIS WERNER - @NOBBD - IMPRESSUM

the unofficial HackerOne disclosure timeline.