Read/Write arbitrary (non-HttpOnly) cookies on checkout pages via GoogleAnalyticsAdditionalScripts postMessage handler

👉 https://hackerone.com/reports/1081167

🔹 Severity: Medium | 💰 1,600 USD
🔹 Reported To: Shopify
🔹 Reported By: #bored-engineer
🔹 State: 🟢 Resolved
🔹 Disclosed: December 1, 2022, 7:34pm (UTC)

Disconnecting an external login provider does not revoke session

👉 https://hackerone.com/reports/1547684

🔹 Severity: Medium | 💰 1,600 USD
🔹 Reported To: Shopify
🔹 Reported By: #attackerbhai
🔹 State: 🟢 Resolved
🔹 Disclosed: December 1, 2022, 7:50pm (UTC)

Stored XSS in /admin/product and /admin/collections

👉 https://hackerone.com/reports/1147433

🔹 Severity: Medium | 💰 5,300 USD
🔹 Reported To: Shopify
🔹 Reported By: #ashketchum
🔹 State: 🟢 Resolved
🔹 Disclosed: December 1, 2022, 10:44pm (UTC)

Authentication bypass in https://nin.mtn.ng

👉 https://hackerone.com/reports/1747146

🔹 Severity: Critical
🔹 Reported To: MTN Group
🔹 Reported By: #roland_hack
🔹 State: 🟢 Resolved
🔹 Disclosed: December 2, 2022, 1:00pm (UTC)

XSS in Acronis Cloud Manager Admin Portal

👉 https://hackerone.com/reports/1388788

🔹 Severity: Medium | 💰 100 USD
🔹 Reported To: Acronis
🔹 Reported By: #mooimacow
🔹 State: 🟢 Resolved
🔹 Disclosed: December 2, 2022, 7:48pm (UTC)

POST following PUT confusion

👉 https://hackerone.com/reports/1752146

🔹 Severity: Medium | 💰 2,400 USD
🔹 Reported To: Internet Bug Bounty
🔹 Reported By: #robbotic
🔹 State: 🟢 Resolved
🔹 Disclosed: December 2, 2022, 9:03pm (UTC)

Exposed Cortex API at https://cortex-ingest.shopifycloud.com/

👉 https://hackerone.com/reports/1258871

🔹 Severity: Medium | 💰 6,300 USD
🔹 Reported To: Shopify
🔹 Reported By: #ian
🔹 State: 🟢 Resolved
🔹 Disclosed: December 2, 2022, 10:25pm (UTC)

CVE-2022-35260: .netrc parser out-of-bounds access

👉 https://hackerone.com/reports/1753224

🔹 Severity: Low | 💰 480 USD
🔹 Reported To: Internet Bug Bounty
🔹 Reported By: #kurohiro
🔹 State: 🟢 Resolved
🔹 Disclosed: December 3, 2022, 12:20am (UTC)

IDOR in Stats API Endpoint Allows Viewing Equity or Net Profit of Any MT Account

👉 https://hackerone.com/reports/1644436

🔹 Severity: No Rating | 💰 1,000 USD
🔹 Reported To: EXNESS
🔹 Reported By: #ashwarya
🔹 State: 🟢 Resolved
🔹 Disclosed: December 5, 2022, 3:50pm (UTC)

[Splatoon 3] Kick other players with NplnLogin message

🔹 Severity: Medium
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Nintendo
🔹 Reported By: alzxk11
🔹 State: 🟢 Resolved
🔹 Disclosed: July 2, 2026, 1:25am (UTC)

A vulnerability was discovered that allowed players to kick other players from a Splatoon 3 game using an NplnLogin message.

👉 Read full report

admin.shopify.com: Shopify Flow continues sending internal emails to a configured recipient after the staff author is removed

🔹 Severity: None
🔹 Reported To: Shopify
🔹 Reported By: abahack
🔹 State: ⚪️ Informative
🔹 Disclosed: July 3, 2026, 6:50pm (UTC)

👉 Read full report

Any installed app can force immediate logout and persistent DOS of authenticated Basecamp sessions via unprotected exported StartActivity

🔹 Severity: Medium | 💰 287 USD
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Basecamp
🔹 Reported By: zerodaysec_xyz
🔹 State: 🟢 Resolved
🔹 Disclosed: July 4, 2026, 11:05am (UTC)

A vulnerability was discovered in the Basecamp Android app that allowed any installed app to force immediate logout and persistent denial-of-service of authenticated Basecamp sessions. The vulnerability was due to the `com.basecamp.bc4.app.main.start.StartActivity` being declared as exported without any permission guard. This allowed any app to launch it with an explicit intent, terminating the current session and…

👉 Read full report

OS Command Injection in `aws-cdk-lib` NodejsFunction via Unsanitized `OsCommand` Helper (Supply Chain RCE)

🔹 Severity: High
🔹 Weakness: OS Command Injection
🔹 Reported To: AWS VDP
🔹 Reported By: kaporia
🔹 State: 🟢 Resolved
🔹 Disclosed: July 6, 2026, 5:48pm (UTC)

A vulnerability was discovered in the "aws-cdk-lib" NodejsFunction that allowed for OS command injection through the unsanitized "OsCommand" helper. The vulnerability was caused by the lack of proper escaping of user-controlled data when constructing shell commands during Docker-based bundling. This could have potentially led to arbitrary code execution within the Docker container, which had access to the host…

👉 Read full report

Kiro IDE Stores Auth Tokens with World-Readable Permissions (0644)

🔹 Severity: Medium
🔹 Weakness: Incorrect Default Permissions
🔹 Reported To: AWS VDP
🔹 Reported By: mistercloudsec
🔹 State: 🟢 Resolved
🔹 Disclosed: July 9, 2026, 3:31pm (UTC)

The Kiro IDE (version 0.11.107) wrote authentication tokens (access token and refresh token) to a file with world-readable permissions (0644). The file contained sensitive information, including the access token, refresh token, and profile ARN. This exposed the credentials to potential unauthorized access by local processes or users.

👉 Read full report

Unauthenticated Access to MMGIS Webhooks

🔹 Severity: High
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: oversudo
🔹 State: 🟢 Resolved
🔹 Disclosed: July 7, 2026
🐞 Source: Bugcrowd

👉 Read full report

Unauthenticated Disclosure of NASA Organizer Email Addresses via The Events Calendar REST API (CVE-2025-9808)

🔹 Severity: Informational
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: ARTanvir76
🔹 State: ⚪️ Informational
🔹 Disclosed: July 9, 2026
🐞 Source: Bugcrowd

👉 Read full report

[Atlas Browser] Fullscreen Toast Can Be Hidden by Repeated Constraint Validation Popups

🔹 Severity: Low
🔹 Reported To: OpenAI
🔹 Reported By: jodyritonga
🔹 State: 🟢 Resolved
🔹 Disclosed: July 9, 2026
🐞 Source: Bugcrowd

👉 Read full report

👋 Hey hunters!

The channel just leveled up — disclosed reports now pull from two sources: HackerOne & Bugcrowd 🐞🔥

More features are on the way 🚀 And you get a say — which platform should we plug in next? React to vote 👇

🔥 — Immunefi (web3)
👍 — huntr (open source)
🤔 — something else (tell us in comments)

Unauthenticated Error-Based SQL Injection in HEASARC W3Browse w3hdprods.pl

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: Anon0x0
🔹 State: 🟢 Resolved
🔹 Disclosed: July 13, 2026
🐞 Source: Bugcrowd

👉 Read full report

SELECT ... INTO OUTFILE does not enforce the FILE WRITE privilege unprivileged arbitrary file write on the server

🔹 Severity: High
🔹 Weakness: Missing Authorization
🔹 Reported To: SingleStore
🔹 Reported By: bisht-ji
🔹 State: 🟢 Resolved
🔹 Disclosed: July 13, 2026, 7:35pm (UTC)
🐞 Source: HackerOne

A security vulnerability was reported in SingleStore's self-managed database server where the SELECT...INTO OUTFILE command did not properly enforce the FILE WRITE privilege. This allowed any authenticated user, including those with only USAGE privileges, to write arbitrary files to the aggregator host at any path, written as the engine OS user. The vulnerability affected default-configuration self-managed…

👉 Read full report

One-Click Data Exfiltration via rovoChatPrompt URL Parameter (Confluence / Rovo)

🔹 Severity: High
🔹 Reported To: Atlassian
🔹 Reported By: loacker
🔹 State: 🟢 Resolved
🔹 Disclosed: July 14, 2026
🐞 Source: Bugcrowd

👉 Read full report