GitHub user to server tokens can create issues in any public repository
🔹 Severity: Medium
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: GitHub
🔹 Reported By: ahacker1
🔹 State: 🟢 Resolved
🔹 Disclosed: July 22, 2026, 7:39pm (UTC)
🐞 Source: HackerOne
A vulnerability was identified in GitHub Enterprise Server that allowed a user-to-server token scoped to a GitHub App installation to perform certain write operations on public repositories outside the token's intended scope. The authorization check only verified that the installation had read permissions on the target repository rather than verifying that the token's installation was explicitly granted access to…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: GitHub
🔹 Reported By: ahacker1
🔹 State: 🟢 Resolved
🔹 Disclosed: July 22, 2026, 7:39pm (UTC)
🐞 Source: HackerOne
A vulnerability was identified in GitHub Enterprise Server that allowed a user-to-server token scoped to a GitHub App installation to perform certain write operations on public repositories outside the token's intended scope. The authorization check only verified that the installation had read permissions on the target repository rather than verifying that the token's installation was explicitly granted access to…
👉 Read full report
AWS *.a2z.com | Unauthenticated Clickhouse UI : Database access + SSRF
🔹 Severity: High
🔹 Weakness: Authentication Bypass
🔹 Reported To: AWS VDP
🔹 Reported By: notnotnotveg
🔹 State: 🟢 Resolved
🔹 Disclosed: July 22, 2026, 7:53pm (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: High
🔹 Weakness: Authentication Bypass
🔹 Reported To: AWS VDP
🔹 Reported By: notnotnotveg
🔹 State: 🟢 Resolved
🔹 Disclosed: July 22, 2026, 7:53pm (UTC)
🐞 Source: HackerOne
👉 Read full report
Identity Theft via Broken Link Hijacking on NASA Astronaut News Release Page
🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: muhammadabdillah64edc3
🔹 State: 🟢 Resolved
🔹 Disclosed: July 22, 2026
🐞 Source: Bugcrowd
👉 Read full report
🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: muhammadabdillah64edc3
🔹 State: 🟢 Resolved
🔹 Disclosed: July 22, 2026
🐞 Source: Bugcrowd
👉 Read full report
Arbitrary External Redirect Through SAML RelayState After Successful Authentication
🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: 2yuk
🔹 State: 🟢 Resolved
🔹 Disclosed: July 22, 2026
🐞 Source: Bugcrowd
👉 Read full report
🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: 2yuk
🔹 State: 🟢 Resolved
🔹 Disclosed: July 22, 2026
🐞 Source: Bugcrowd
👉 Read full report
Blind SQL Injection in Search Functionality Leads to Full Database Extraction
🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: molany
🔹 State: 🟢 Resolved
🔹 Disclosed: July 22, 2026
🐞 Source: Bugcrowd
👉 Read full report
🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: molany
🔹 State: 🟢 Resolved
🔹 Disclosed: July 22, 2026
🐞 Source: Bugcrowd
👉 Read full report
Exposed Credentials in Public .env File on NASA Git Repository
🔹 Severity: Medium
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: Hunt3rboy
🔹 State: 🟢 Resolved
🔹 Disclosed: July 22, 2026
🐞 Source: Bugcrowd
👉 Read full report
🔹 Severity: Medium
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: Hunt3rboy
🔹 State: 🟢 Resolved
🔹 Disclosed: July 22, 2026
🐞 Source: Bugcrowd
👉 Read full report
Critical Authentication Bypass via Path Normalization (Double Slash) on Live NASA MODAPS OKAPI Production Instance
🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: marcelojr
🔹 State: 🟢 Resolved
🔹 Disclosed: July 22, 2026
🐞 Source: Bugcrowd
👉 Read full report
🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: marcelojr
🔹 State: 🟢 Resolved
🔹 Disclosed: July 22, 2026
🐞 Source: Bugcrowd
👉 Read full report
RE : Host Header Injection leads to Cookie Domain Manipulation on sealevel.nasa.gov
🔹 Severity: Informational
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: sanjay910
🔹 State: ⚪️ Informational
🔹 Disclosed: July 23, 2026
🐞 Source: Bugcrowd
👉 Read full report
🔹 Severity: Informational
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: sanjay910
🔹 State: ⚪️ Informational
🔹 Disclosed: July 23, 2026
🐞 Source: Bugcrowd
👉 Read full report
Reflected XSS and HTML Injection on cce-signin.gsfc.nasa.gov via 'popup_flag' parameter
🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: ItsS4LEH
🔹 State: 🟢 Resolved
🔹 Disclosed: July 23, 2026
🐞 Source: Bugcrowd
👉 Read full report
🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: ItsS4LEH
🔹 State: 🟢 Resolved
🔹 Disclosed: July 23, 2026
🐞 Source: Bugcrowd
👉 Read full report
Data-Sculptor CSV expression evaluation leads to backend RCE, Kubernetes serviceaccount token disclosure, and authenticated Kubernetes control-plane access
🔹 Severity: High
🔹 Reported To: Atlassian
🔹 Reported By: MononcleMich
🔹 State: 🟢 Resolved
🔹 Disclosed: July 23, 2026
🐞 Source: Bugcrowd
👉 Read full report
🔹 Severity: High
🔹 Reported To: Atlassian
🔹 Reported By: MononcleMich
🔹 State: 🟢 Resolved
🔹 Disclosed: July 23, 2026
🐞 Source: Bugcrowd
👉 Read full report
ZMQ RPC Log Injection and Untrusted Payload Persistence
🔹 Severity: Medium
🔹 Weakness: CRLF Injection
🔹 Reported To: Monero
🔹 Reported By: redlobsterzzz
🔹 State: 🟢 Resolved
🔹 Disclosed: July 24, 2026, 7:19pm (UTC)
🐞 Source: HackerOne
A vulnerability was reported in the Monero CLI daemon where the ZMQ RPC request path logs untrusted request content before semantic validation. This allowed a remote party with access to the ZMQ endpoint to inject newline and control-character content into daemon logs, enabling log forging. The vulnerability was introduced in commit 77986023c3 and affected releases from v0.12.0.0 through v0.18.4.6, as well as the…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: CRLF Injection
🔹 Reported To: Monero
🔹 Reported By: redlobsterzzz
🔹 State: 🟢 Resolved
🔹 Disclosed: July 24, 2026, 7:19pm (UTC)
🐞 Source: HackerOne
A vulnerability was reported in the Monero CLI daemon where the ZMQ RPC request path logs untrusted request content before semantic validation. This allowed a remote party with access to the ZMQ endpoint to inject newline and control-character content into daemon logs, enabling log forging. The vulnerability was introduced in commit 77986023c3 and affected releases from v0.12.0.0 through v0.18.4.6, as well as the…
👉 Read full report
Authentication Bypass via XML Signature Wrapping in SAML SSO
🔹 Severity: Critical
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: Rocket.Chat
🔹 Reported By: 0jayden
🔹 State: 🟢 Resolved
🔹 Disclosed: July 27, 2026, 4:37pm (UTC)
🐞 Source: HackerOne
The SAML SSO implementation in Rocket.Chat verified XML signatures but did not bind the validated signature to the `samlp:Response` or `saml:Assertion`. As a result, an attacker could submit a wrapped document carrying forged identity attributes alongside a valid signature made by the trusted IdP certificate, and gain unauthorized access to the system.
👉 Read full report
🔹 Severity: Critical
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: Rocket.Chat
🔹 Reported By: 0jayden
🔹 State: 🟢 Resolved
🔹 Disclosed: July 27, 2026, 4:37pm (UTC)
🐞 Source: HackerOne
The SAML SSO implementation in Rocket.Chat verified XML signatures but did not bind the validated signature to the `samlp:Response` or `saml:Assertion`. As a result, an attacker could submit a wrapped document carrying forged identity attributes alongside a valid signature made by the trusted IdP certificate, and gain unauthorized access to the system.
👉 Read full report
Non-Production API Endpoints for the Amazon Cloudwatch Fails to Log to CloudTrail Resulting in Silent Permission Enumeration
🔹 Severity: Medium
🔹 Weakness: Insufficient Logging
🔹 Reported To: AWS VDP
🔹 Reported By: nick_frichette_dd
🔹 State: 🟢 Resolved
🔹 Disclosed: July 27, 2026, 7:51pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the Amazon CloudWatch service, where certain non-production API endpoints could be used to perform permission enumeration without generating corresponding CloudTrail events. This allowed for silent testing of compromised IAM credentials. The vulnerability was reported to AWS, which acknowledged it as a security issue. Specific endpoints and operations that exhibited this behavior…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Insufficient Logging
🔹 Reported To: AWS VDP
🔹 Reported By: nick_frichette_dd
🔹 State: 🟢 Resolved
🔹 Disclosed: July 27, 2026, 7:51pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the Amazon CloudWatch service, where certain non-production API endpoints could be used to perform permission enumeration without generating corresponding CloudTrail events. This allowed for silent testing of compromised IAM credentials. The vulnerability was reported to AWS, which acknowledged it as a security issue. Specific endpoints and operations that exhibited this behavior…
👉 Read full report
Sandbox User Can Inject Rogue CA Certificate into OS Trust Store via Sudo-Allowed deploy-certificates.sh
🔹 Severity: Medium
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: AWS VDP
🔹 Reported By: mistercloudsec
🔹 State: 🟢 Resolved
🔹 Disclosed: July 28, 2026, 3:29pm (UTC)
🐞 Source: HackerOne
A vulnerability was found in the Bedrock AgentCore Code Interpreter sandbox. The sandbox granted a user passwordless sudo access to a script that deployed certificates to the OS trust store. An attacker could have generated a rogue CA certificate, placed it in a writable directory, and then used the sudo-allowed script to inject the rogue CA into the trust store. This could have been used to perform…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: AWS VDP
🔹 Reported By: mistercloudsec
🔹 State: 🟢 Resolved
🔹 Disclosed: July 28, 2026, 3:29pm (UTC)
🐞 Source: HackerOne
A vulnerability was found in the Bedrock AgentCore Code Interpreter sandbox. The sandbox granted a user passwordless sudo access to a script that deployed certificates to the OS trust store. An attacker could have generated a rogue CA certificate, placed it in a writable directory, and then used the sudo-allowed script to inject the rogue CA into the trust store. This could have been used to perform…
👉 Read full report
Unauthenticated SSRF in Voxtelesys integration ('checkUrlForSsrf' Bypass via DNS rebinding)
🔹 Severity: High
🔹 Weakness: Server-Side Request Forgery (SSRF)
🔹 Reported To: Rocket.Chat
🔹 Reported By: button142857
🔹 State: 🟢 Resolved
🔹 Disclosed: July 29, 2026, 1:48am (UTC)
🐞 Source: HackerOne
An SSRF vulnerability was discovered in Rocket.Chat version 7.13.2 that was caused by a DNS rebinding attack. The vulnerability allowed an attacker to bypass a security check and access internal hosts on the same network as the Rocket.Chat server. The vulnerability was present in the SMS integration feature that used the `checkUrlForSsrf` function, which was bypassed by the DNS rebinding attack.
👉 Read full report
🔹 Severity: High
🔹 Weakness: Server-Side Request Forgery (SSRF)
🔹 Reported To: Rocket.Chat
🔹 Reported By: button142857
🔹 State: 🟢 Resolved
🔹 Disclosed: July 29, 2026, 1:48am (UTC)
🐞 Source: HackerOne
An SSRF vulnerability was discovered in Rocket.Chat version 7.13.2 that was caused by a DNS rebinding attack. The vulnerability allowed an attacker to bypass a security check and access internal hosts on the same network as the Rocket.Chat server. The vulnerability was present in the SMS integration feature that used the `checkUrlForSsrf` function, which was bypassed by the DNS rebinding attack.
👉 Read full report
Permission Model Bypass: `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`
🔹 Severity: Low
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Node.js
🔹 Reported By: 0xoroot
🔹 State: 🟢 Resolved
🔹 Disclosed: July 29, 2026, 2:16pm (UTC)
🐞 Source: HackerOne
A flaw in Node.js Permission Model enforcement was discovered that allowed `trace_events.createTracing().enable()` to write trace logs outside of the `--allow-fs-write` setting. This vulnerability affected Node.js versions 22.x, 24.x, and 26.x.
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Node.js
🔹 Reported By: 0xoroot
🔹 State: 🟢 Resolved
🔹 Disclosed: July 29, 2026, 2:16pm (UTC)
🐞 Source: HackerOne
A flaw in Node.js Permission Model enforcement was discovered that allowed `trace_events.createTracing().enable()` to write trace logs outside of the `--allow-fs-write` setting. This vulnerability affected Node.js versions 22.x, 24.x, and 26.x.
👉 Read full report
HTTPS Agent PFX object-array key collision allows mTLS client identity reuse across different per-request certificates
🔹 Severity: Medium
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: Node.js
🔹 Reported By: yottt
🔹 State: 🟢 Resolved
🔹 Disclosed: July 29, 2026, 2:45pm (UTC)
🐞 Source: HackerOne
A flaw in Node.js HTTPS Agent connection reuse was discovered that could cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affected Node.js versions 26.x, 24.x, and 22.x.
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: Node.js
🔹 Reported By: yottt
🔹 State: 🟢 Resolved
🔹 Disclosed: July 29, 2026, 2:45pm (UTC)
🐞 Source: HackerOne
A flaw in Node.js HTTPS Agent connection reuse was discovered that could cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affected Node.js versions 26.x, 24.x, and 22.x.
👉 Read full report
`exportReportPdf` mutation shows internal Activity
🔹 Severity: High
🔹 Reported To: HackerOne
🔹 Reported By: 0v3rw4tch
🔹 State: 🟢 Resolved
🔹 Disclosed: July 29, 2026, 3:01pm (UTC)
🐞 Source: HackerOne
A vulnerability was identified in the PDF export path for disclosed reports. When a report was exported to PDF, the export pipeline did not apply the same visibility and authorization scoping that governs the normal report view. The root cause was that PDF generation assembled report content from the underlying timeline without re-checking each activity against the requester's permission level. The issue was…
👉 Read full report
🔹 Severity: High
🔹 Reported To: HackerOne
🔹 Reported By: 0v3rw4tch
🔹 State: 🟢 Resolved
🔹 Disclosed: July 29, 2026, 3:01pm (UTC)
🐞 Source: HackerOne
A vulnerability was identified in the PDF export path for disclosed reports. When a report was exported to PDF, the export pipeline did not apply the same visibility and authorization scoping that governs the normal report view. The root cause was that PDF generation assembled report content from the underlying timeline without re-checking each activity against the requester's permission level. The issue was…
👉 Read full report
Permission Model: --allow-fs-read/--allow-fs-write radix-tree prefix-boundary over-grant
🔹 Severity: High
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Node.js
🔹 Reported By: sy2n0
🔹 State: 🟢 Resolved
🔹 Disclosed: July 29, 2026, 11:00pm (UTC)
🐞 Source: HackerOne
A flaw was discovered in the Node.js Permission Model's enforcement of filesystem access control. The vulnerability could allow an attacker granted access to one path to read from or write to paths outside the intended filesystem allowlist, due to issues with the radix-tree prefix-boundary handling. This affected Node.js versions in the main, 22.x, 24.x, and 26.x branches.
👉 Read full report
🔹 Severity: High
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Node.js
🔹 Reported By: sy2n0
🔹 State: 🟢 Resolved
🔹 Disclosed: July 29, 2026, 11:00pm (UTC)
🐞 Source: HackerOne
A flaw was discovered in the Node.js Permission Model's enforcement of filesystem access control. The vulnerability could allow an attacker granted access to one path to read from or write to paths outside the intended filesystem allowlist, due to issues with the radix-tree prefix-boundary handling. This affected Node.js versions in the main, 22.x, 24.x, and 26.x branches.
👉 Read full report
GitHub scoped user to server tokens can escape their installation
🔹 Severity: High
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: GitHub
🔹 Reported By: ahacker1
🔹 State: 🟢 Resolved
🔹 Disclosed: July 29, 2026, 11:35pm (UTC)
🐞 Source: HackerOne
An improper authorization vulnerability in scoped user-to-server (ghu_) token authorization in GitHub Enterprise Server was discovered. The vulnerability allowed an authenticated attacker to access private repositories outside the intended installation scope, which could have included write operations, via an authorization fallback that treated a revoked/deleted installation as a global installation context. This…
👉 Read full report
🔹 Severity: High
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: GitHub
🔹 Reported By: ahacker1
🔹 State: 🟢 Resolved
🔹 Disclosed: July 29, 2026, 11:35pm (UTC)
🐞 Source: HackerOne
An improper authorization vulnerability in scoped user-to-server (ghu_) token authorization in GitHub Enterprise Server was discovered. The vulnerability allowed an authenticated attacker to access private repositories outside the intended installation scope, which could have included write operations, via an authorization fallback that treated a revoked/deleted installation as a global installation context. This…
👉 Read full report
HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934)
🔹 Severity: Medium
🔹 Weakness: Exploiting Incorrectly Configured SSL/TLS
🔹 Reported To: Node.js
🔹 Reported By: vnyuh
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2026, 2:09am (UTC)
🐞 Source: HackerOne
A vulnerability was identified in Node.js where HTTPS Agent TLS session reuse skipped hostname verification across identity policies, which was an incomplete fix for CVE-2026-48934. This affected Node.js versions 22.x, 24.x, and 26.x.
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Exploiting Incorrectly Configured SSL/TLS
🔹 Reported To: Node.js
🔹 Reported By: vnyuh
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2026, 2:09am (UTC)
🐞 Source: HackerOne
A vulnerability was identified in Node.js where HTTPS Agent TLS session reuse skipped hostname verification across identity policies, which was an incomplete fix for CVE-2026-48934. This affected Node.js versions 22.x, 24.x, and 26.x.
👉 Read full report