Now on Twitter

the unofficial HackerOne disclosure timeline.

X

b'Nextcloud' disclosed a bug submitted by b'daroo' 
b'Path Traversal Vulnerability in Nextcloud Tables Enables Arbitrary File Exfiltration of Any Files Supported by PhpSpreadsheet Library'

16 Oct 2025

b'Dynatrace' disclosed a bug submitted by b'remiec' 
b'OneAgent Unprivileged NTLM User Coercion'

15 Oct 2025

b'Brave Software' disclosed a bug submitted by b'mingijung' 
b'SameSite restrictions are lifted, and SameSite:Strict cookie are being sent.'

15 Oct 2025

b'Tucows (VDP)' disclosed a bug submitted by b'1prince1' 
b'Unauthenticated Access Control Bypass Private WordPress Post Disclosure (Outdated WordPress 4.9.40)'

14 Oct 2025

b'Tucows (VDP)' disclosed a bug submitted by b'1prince1' 
b'Information Disclosure via Accessible debug.log on ExactHosting'

14 Oct 2025

b'curl' disclosed a bug submitted by b'nyymi' 
b'Missing enforcement of SFTP quote syntax can lead to operation on wrong object'

12 Oct 2025

b'Tucows (VDP)' disclosed a bug submitted by b'kanon4' 
b'CSRF allowing unauthorized modification of user Notes on '

10 Oct 2025

b'Tucows (VDP)' disclosed a bug submitted by b'emad2466' 
b'Vulnerability: XML-RPC Interface Enabled and Accessible'

10 Oct 2025

b'curl' disclosed a bug submitted by b'giant_anteater' 
b'Apple SecTrust legacy path accepts untrusted certificates on pre-10.14 macOS/iOS when built with USE_APPLE_SECTRUST'

09 Oct 2025

b'PortSwigger Web Security' disclosed a bug submitted by b'farmer' 
b'DNS Rebinding SSRF in Burp Suite MCP Server Enables Internal Network Access via send_http1_request Tool'

08 Oct 2025

b'curl' disclosed a bug submitted by b'giant_anteater' 
b'OpenSSL backend: X509 peer certificate not freed in ossl_get_channel_binding causes per-request memory leak (DoS risk for long-lived clients)'

08 Oct 2025

b'Omise' disclosed a bug submitted by b'mantu1738' 
b'Pending invites remain valid even after the inviter is removed.'

08 Oct 2025

b'SingleStore' disclosed a bug submitted by b'4x4' 
b'Exceeding the limit of Workspaces via Race Condition'

06 Oct 2025

b'curl' disclosed a bug submitted by b'donutshunter' 
b'Unsanitized IPFS CID Allows SSRF Against Configured Gateway'

03 Oct 2025

b'Rockstar Games' disclosed a bug submitted by b'gavinmartinwv' 
b'Access to the personal emails of Rockstar Support agents through the support platform'

02 Oct 2025

b'curl' disclosed a bug submitted by b'leftyha' 
b'AWS SigV4 Signature Disclosure via Verbose Logging in libcurl'

01 Oct 2025

b'Cloudflare Public Bug Bounty' disclosed a bug submitted by b'null_smashmaster0045' 
b"`use-mcp`'s oauth2 process uses a window.open call with untrusted mcp server provided data allowing for code execution under the page using it"

30 Sep 2025

b'Nextcloud' disclosed a bug submitted by b'farhad0x1' 
b'Information Exposure Through Directory Listing'

29 Sep 2025

b'Nextcloud' disclosed a bug submitted by b'farhad0x1' 
b'Email not verified when changing afterwards on apps.nextcloud.com'

29 Sep 2025

b'Nextcloud' disclosed a bug submitted by b'farhad0x1' 
b' Exposing debug.log file leads to server full path disclosure'

29 Sep 2025

1 ... 35 36 37 38 39 ... 776

BY DENIS WERNER - @NOBBD - IMPRESSUM