Authentication Bypass via XML Signature Wrapping in SAML SSO
🔹 Severity: Critical
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: Rocket.Chat
🔹 Reported By: 0jayden
🔹 State: 🟢 Resolved
🔹 Disclosed: July 27, 2026, 4:37pm (UTC)
🐞 Source: HackerOne
The SAML SSO implementation in Rocket.Chat verified XML signatures but did not bind the validated signature to the `samlp:Response` or `saml:Assertion`. As a result, an attacker could submit a wrapped document carrying forged identity attributes alongside a valid signature made by the trusted IdP certificate, and gain unauthorized access to the system.
👉 Read full report
🔹 Severity: Critical
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: Rocket.Chat
🔹 Reported By: 0jayden
🔹 State: 🟢 Resolved
🔹 Disclosed: July 27, 2026, 4:37pm (UTC)
🐞 Source: HackerOne
The SAML SSO implementation in Rocket.Chat verified XML signatures but did not bind the validated signature to the `samlp:Response` or `saml:Assertion`. As a result, an attacker could submit a wrapped document carrying forged identity attributes alongside a valid signature made by the trusted IdP certificate, and gain unauthorized access to the system.
👉 Read full report
Non-Production API Endpoints for the Amazon Cloudwatch Fails to Log to CloudTrail Resulting in Silent Permission Enumeration
🔹 Severity: Medium
🔹 Weakness: Insufficient Logging
🔹 Reported To: AWS VDP
🔹 Reported By: nick_frichette_dd
🔹 State: 🟢 Resolved
🔹 Disclosed: July 27, 2026, 7:51pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the Amazon CloudWatch service, where certain non-production API endpoints could be used to perform permission enumeration without generating corresponding CloudTrail events. This allowed for silent testing of compromised IAM credentials. The vulnerability was reported to AWS, which acknowledged it as a security issue. Specific endpoints and operations that exhibited this behavior…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Insufficient Logging
🔹 Reported To: AWS VDP
🔹 Reported By: nick_frichette_dd
🔹 State: 🟢 Resolved
🔹 Disclosed: July 27, 2026, 7:51pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the Amazon CloudWatch service, where certain non-production API endpoints could be used to perform permission enumeration without generating corresponding CloudTrail events. This allowed for silent testing of compromised IAM credentials. The vulnerability was reported to AWS, which acknowledged it as a security issue. Specific endpoints and operations that exhibited this behavior…
👉 Read full report
Sandbox User Can Inject Rogue CA Certificate into OS Trust Store via Sudo-Allowed deploy-certificates.sh
🔹 Severity: Medium
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: AWS VDP
🔹 Reported By: mistercloudsec
🔹 State: 🟢 Resolved
🔹 Disclosed: July 28, 2026, 3:29pm (UTC)
🐞 Source: HackerOne
A vulnerability was found in the Bedrock AgentCore Code Interpreter sandbox. The sandbox granted a user passwordless sudo access to a script that deployed certificates to the OS trust store. An attacker could have generated a rogue CA certificate, placed it in a writable directory, and then used the sudo-allowed script to inject the rogue CA into the trust store. This could have been used to perform…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: AWS VDP
🔹 Reported By: mistercloudsec
🔹 State: 🟢 Resolved
🔹 Disclosed: July 28, 2026, 3:29pm (UTC)
🐞 Source: HackerOne
A vulnerability was found in the Bedrock AgentCore Code Interpreter sandbox. The sandbox granted a user passwordless sudo access to a script that deployed certificates to the OS trust store. An attacker could have generated a rogue CA certificate, placed it in a writable directory, and then used the sudo-allowed script to inject the rogue CA into the trust store. This could have been used to perform…
👉 Read full report
Unauthenticated SSRF in Voxtelesys integration ('checkUrlForSsrf' Bypass via DNS rebinding)
🔹 Severity: High
🔹 Weakness: Server-Side Request Forgery (SSRF)
🔹 Reported To: Rocket.Chat
🔹 Reported By: button142857
🔹 State: 🟢 Resolved
🔹 Disclosed: July 29, 2026, 1:48am (UTC)
🐞 Source: HackerOne
An SSRF vulnerability was discovered in Rocket.Chat version 7.13.2 that was caused by a DNS rebinding attack. The vulnerability allowed an attacker to bypass a security check and access internal hosts on the same network as the Rocket.Chat server. The vulnerability was present in the SMS integration feature that used the `checkUrlForSsrf` function, which was bypassed by the DNS rebinding attack.
👉 Read full report
🔹 Severity: High
🔹 Weakness: Server-Side Request Forgery (SSRF)
🔹 Reported To: Rocket.Chat
🔹 Reported By: button142857
🔹 State: 🟢 Resolved
🔹 Disclosed: July 29, 2026, 1:48am (UTC)
🐞 Source: HackerOne
An SSRF vulnerability was discovered in Rocket.Chat version 7.13.2 that was caused by a DNS rebinding attack. The vulnerability allowed an attacker to bypass a security check and access internal hosts on the same network as the Rocket.Chat server. The vulnerability was present in the SMS integration feature that used the `checkUrlForSsrf` function, which was bypassed by the DNS rebinding attack.
👉 Read full report
Permission Model Bypass: `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`
🔹 Severity: Low
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Node.js
🔹 Reported By: 0xoroot
🔹 State: 🟢 Resolved
🔹 Disclosed: July 29, 2026, 2:16pm (UTC)
🐞 Source: HackerOne
A flaw in Node.js Permission Model enforcement was discovered that allowed `trace_events.createTracing().enable()` to write trace logs outside of the `--allow-fs-write` setting. This vulnerability affected Node.js versions 22.x, 24.x, and 26.x.
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Node.js
🔹 Reported By: 0xoroot
🔹 State: 🟢 Resolved
🔹 Disclosed: July 29, 2026, 2:16pm (UTC)
🐞 Source: HackerOne
A flaw in Node.js Permission Model enforcement was discovered that allowed `trace_events.createTracing().enable()` to write trace logs outside of the `--allow-fs-write` setting. This vulnerability affected Node.js versions 22.x, 24.x, and 26.x.
👉 Read full report
HTTPS Agent PFX object-array key collision allows mTLS client identity reuse across different per-request certificates
🔹 Severity: Medium
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: Node.js
🔹 Reported By: yottt
🔹 State: 🟢 Resolved
🔹 Disclosed: July 29, 2026, 2:45pm (UTC)
🐞 Source: HackerOne
A flaw in Node.js HTTPS Agent connection reuse was discovered that could cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affected Node.js versions 26.x, 24.x, and 22.x.
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: Node.js
🔹 Reported By: yottt
🔹 State: 🟢 Resolved
🔹 Disclosed: July 29, 2026, 2:45pm (UTC)
🐞 Source: HackerOne
A flaw in Node.js HTTPS Agent connection reuse was discovered that could cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affected Node.js versions 26.x, 24.x, and 22.x.
👉 Read full report
`exportReportPdf` mutation shows internal Activity
🔹 Severity: High
🔹 Reported To: HackerOne
🔹 Reported By: 0v3rw4tch
🔹 State: 🟢 Resolved
🔹 Disclosed: July 29, 2026, 3:01pm (UTC)
🐞 Source: HackerOne
A vulnerability was identified in the PDF export path for disclosed reports. When a report was exported to PDF, the export pipeline did not apply the same visibility and authorization scoping that governs the normal report view. The root cause was that PDF generation assembled report content from the underlying timeline without re-checking each activity against the requester's permission level. The issue was…
👉 Read full report
🔹 Severity: High
🔹 Reported To: HackerOne
🔹 Reported By: 0v3rw4tch
🔹 State: 🟢 Resolved
🔹 Disclosed: July 29, 2026, 3:01pm (UTC)
🐞 Source: HackerOne
A vulnerability was identified in the PDF export path for disclosed reports. When a report was exported to PDF, the export pipeline did not apply the same visibility and authorization scoping that governs the normal report view. The root cause was that PDF generation assembled report content from the underlying timeline without re-checking each activity against the requester's permission level. The issue was…
👉 Read full report
Permission Model: --allow-fs-read/--allow-fs-write radix-tree prefix-boundary over-grant
🔹 Severity: High
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Node.js
🔹 Reported By: sy2n0
🔹 State: 🟢 Resolved
🔹 Disclosed: July 29, 2026, 11:00pm (UTC)
🐞 Source: HackerOne
A flaw was discovered in the Node.js Permission Model's enforcement of filesystem access control. The vulnerability could allow an attacker granted access to one path to read from or write to paths outside the intended filesystem allowlist, due to issues with the radix-tree prefix-boundary handling. This affected Node.js versions in the main, 22.x, 24.x, and 26.x branches.
👉 Read full report
🔹 Severity: High
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Node.js
🔹 Reported By: sy2n0
🔹 State: 🟢 Resolved
🔹 Disclosed: July 29, 2026, 11:00pm (UTC)
🐞 Source: HackerOne
A flaw was discovered in the Node.js Permission Model's enforcement of filesystem access control. The vulnerability could allow an attacker granted access to one path to read from or write to paths outside the intended filesystem allowlist, due to issues with the radix-tree prefix-boundary handling. This affected Node.js versions in the main, 22.x, 24.x, and 26.x branches.
👉 Read full report
GitHub scoped user to server tokens can escape their installation
🔹 Severity: High
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: GitHub
🔹 Reported By: ahacker1
🔹 State: 🟢 Resolved
🔹 Disclosed: July 29, 2026, 11:35pm (UTC)
🐞 Source: HackerOne
An improper authorization vulnerability in scoped user-to-server (ghu_) token authorization in GitHub Enterprise Server was discovered. The vulnerability allowed an authenticated attacker to access private repositories outside the intended installation scope, which could have included write operations, via an authorization fallback that treated a revoked/deleted installation as a global installation context. This…
👉 Read full report
🔹 Severity: High
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: GitHub
🔹 Reported By: ahacker1
🔹 State: 🟢 Resolved
🔹 Disclosed: July 29, 2026, 11:35pm (UTC)
🐞 Source: HackerOne
An improper authorization vulnerability in scoped user-to-server (ghu_) token authorization in GitHub Enterprise Server was discovered. The vulnerability allowed an authenticated attacker to access private repositories outside the intended installation scope, which could have included write operations, via an authorization fallback that treated a revoked/deleted installation as a global installation context. This…
👉 Read full report
HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934)
🔹 Severity: Medium
🔹 Weakness: Exploiting Incorrectly Configured SSL/TLS
🔹 Reported To: Node.js
🔹 Reported By: vnyuh
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2026, 2:09am (UTC)
🐞 Source: HackerOne
A vulnerability was identified in Node.js where HTTPS Agent TLS session reuse skipped hostname verification across identity policies, which was an incomplete fix for CVE-2026-48934. This affected Node.js versions 22.x, 24.x, and 26.x.
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Exploiting Incorrectly Configured SSL/TLS
🔹 Reported To: Node.js
🔹 Reported By: vnyuh
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2026, 2:09am (UTC)
🐞 Source: HackerOne
A vulnerability was identified in Node.js where HTTPS Agent TLS session reuse skipped hostname verification across identity policies, which was an incomplete fix for CVE-2026-48934. This affected Node.js versions 22.x, 24.x, and 26.x.
👉 Read full report
Active Storage Vips Transformer Missing validate_transformation — CVE-2025-24293 Incomplete Fix
🔹 Severity: High
🔹 Weakness: Path Traversal
🔹 Reported To: Ruby on Rails
🔹 Reported By: friedchicken112211
🔹 State: ⚪️ Informative
🔹 Disclosed: July 30, 2026, 1:47pm (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: High
🔹 Weakness: Path Traversal
🔹 Reported To: Ruby on Rails
🔹 Reported By: friedchicken112211
🔹 State: ⚪️ Informative
🔹 Disclosed: July 30, 2026, 1:47pm (UTC)
🐞 Source: HackerOne
👉 Read full report
Permission Model bypass: process.report writes (and overwrites) files outside --allow-fs-write paths
🔹 Severity: Low
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Node.js
🔹 Reported By: sinan-polat
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2026, 3:07pm (UTC)
🐞 Source: HackerOne
A flaw was found in the Node.js Permission Model enforcement that allowed the process.report function to write (and overwrite) files outside the --allow-fs-write paths.
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Node.js
🔹 Reported By: sinan-polat
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2026, 3:07pm (UTC)
🐞 Source: HackerOne
A flaw was found in the Node.js Permission Model enforcement that allowed the process.report function to write (and overwrite) files outside the --allow-fs-write paths.
👉 Read full report
Stored XSS via SVG Upload — check_content() Blocklist Bypass & 256-Byte Scan Limit (Self-Propagating Worm)
🔹 Severity: Medium
🔹 Weakness: Cross-site Scripting (XSS) - Stored
🔹 Reported To: phpBB
🔹 Reported By: a7mmr
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2026, 8:29pm (UTC)
🐞 Source: HackerOne
A stored XSS vulnerability was discovered in phpBB 4.0.0-a2-dev. The vulnerability was caused by an incomplete blocklist for file uploads and a 256-byte read limit in the content scanning check. Specifically, SVG files with malicious payloads in the onload and onbegin attributes were able to bypass the content check and be stored on the server. Additionally, any content beyond the 256-byte limit was not scanned…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Cross-site Scripting (XSS) - Stored
🔹 Reported To: phpBB
🔹 Reported By: a7mmr
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2026, 8:29pm (UTC)
🐞 Source: HackerOne
A stored XSS vulnerability was discovered in phpBB 4.0.0-a2-dev. The vulnerability was caused by an incomplete blocklist for file uploads and a 256-byte read limit in the content scanning check. Specifically, SVG files with malicious payloads in the onload and onbegin attributes were able to bypass the content check and be stored on the server. Additionally, any content beyond the 256-byte limit was not scanned…
👉 Read full report
Broken Link Hijacking (Impersonation) on jpl.nasa.gov via Unregistered Facebook URL
🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: Vansh_Rathore
🔹 State: 🟢 Resolved
🔹 Disclosed: July 31, 2026
🐞 Source: Bugcrowd
👉 Read full report
🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: Vansh_Rathore
🔹 State: 🟢 Resolved
🔹 Disclosed: July 31, 2026
🐞 Source: Bugcrowd
👉 Read full report
Access To ( nasa slack channel ) Vai Live Slack Invitation Link ( https://join.slack.com/t/nasa-ammos/shared_invite/zt-1mlgmk5c2-MgqVSyKzVRUWrXy87FNqPw )
🔹 Severity: High
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: Kartiktantubai
🔹 State: 🟢 Resolved
🔹 Disclosed: July 31, 2026
🐞 Source: Bugcrowd
👉 Read full report
🔹 Severity: High
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: Kartiktantubai
🔹 State: 🟢 Resolved
🔹 Disclosed: July 31, 2026
🐞 Source: Bugcrowd
👉 Read full report
Stored XSS in nameserver field on account settings page
🔹 Severity: Low
🔹 Weakness: Cross-site Scripting (XSS) - Stored
🔹 Reported To: Tucows (VDP)
🔹 Reported By: axolot23
🔹 State: 🟢 Resolved
🔹 Disclosed: July 31, 2026, 3:07pm (UTC)
🐞 Source: HackerOne
A stored XSS vulnerability was discovered in the nameserver field on the account settings page. The lack of input validation and weak CSP configuration allowed the injection of malicious JavaScript code that executed when the settings page was reloaded. The vulnerability was limited to a self-XSS scenario, affecting only the account owner who injected the payload and not other users.
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Cross-site Scripting (XSS) - Stored
🔹 Reported To: Tucows (VDP)
🔹 Reported By: axolot23
🔹 State: 🟢 Resolved
🔹 Disclosed: July 31, 2026, 3:07pm (UTC)
🐞 Source: HackerOne
A stored XSS vulnerability was discovered in the nameserver field on the account settings page. The lack of input validation and weak CSP configuration allowed the injection of malicious JavaScript code that executed when the settings page was reloaded. The vulnerability was limited to a self-XSS scenario, affecting only the account owner who injected the payload and not other users.
👉 Read full report
HTTP Request Smuggling via Connection: close<TAB> in Node.js llhttp parser
🔹 Severity: Medium
🔹 Weakness: HTTP Request Smuggling
🔹 Reported To: Node.js
🔹 Reported By: nadav0077
🔹 State: 🟢 Resolved
🔹 Disclosed: July 31, 2026, 3:27pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the Node.js HTTP server where it ignores the "Connection: close" header when the token is followed by a tab character. This allows an attacker to send a second request on the same connection, even after the first request should have closed the connection.
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: HTTP Request Smuggling
🔹 Reported To: Node.js
🔹 Reported By: nadav0077
🔹 State: 🟢 Resolved
🔹 Disclosed: July 31, 2026, 3:27pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the Node.js HTTP server where it ignores the "Connection: close" header when the token is followed by a tab character. This allows an attacker to send a second request on the same connection, even after the first request should have closed the connection.
👉 Read full report
🔥1
Data Integrity Risk & PII Exposure: Publicly Editable OPAG Collaboration Document (Google Sheets) via science.nasa.gov
🔹 Severity: Informational
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: Vansh_Rathore
🔹 State: ⚪️ Informational
🔹 Disclosed: July 31, 2026
🐞 Source: Bugcrowd
👉 Read full report
🔹 Severity: Informational
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: Vansh_Rathore
🔹 State: ⚪️ Informational
🔹 Disclosed: July 31, 2026
🐞 Source: Bugcrowd
👉 Read full report
Unauthenticated team "income/payments" export ignores donor privacy settings (hide_giving, hide_from_lists) and uses frozen visibility, exposing donat
🔹 Severity: Medium | 💰 100 USD
🔹 Reported To: Liberapay
🔹 Reported By: its9me
🔹 State: 🟢 Resolved
🔹 Disclosed: August 1, 2026, 12:27pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the unauthenticated team "income/payments" export feature of Liberapay. The vulnerability allowed an attacker to retrieve donor identity, exact donation amount, and donation dates for public donors, bypassing the donor's explicit privacy settings such as "hide_giving" and "hide_from_lists". The root cause was that the endpoint only honored the frozen visibility flag of the payment…
👉 Read full report
🔹 Severity: Medium | 💰 100 USD
🔹 Reported To: Liberapay
🔹 Reported By: its9me
🔹 State: 🟢 Resolved
🔹 Disclosed: August 1, 2026, 12:27pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the unauthenticated team "income/payments" export feature of Liberapay. The vulnerability allowed an attacker to retrieve donor identity, exact donation amount, and donation dates for public donors, bypassing the donor's explicit privacy settings such as "hide_giving" and "hide_from_lists". The root cause was that the endpoint only honored the frozen visibility flag of the payment…
👉 Read full report
SMTP CRLF injection in custom SMTP recipient operand allows additional SMTP commands after authentication
🔹 Severity: Medium
🔹 Weakness: CRLF Injection
🔹 Reported To: curl
🔹 Reported By: dark_river
🔹 State: 🔴 N/A
🔹 Disclosed: August 3, 2026, 7:16am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: CRLF Injection
🔹 Reported To: curl
🔹 Reported By: dark_river
🔹 State: 🔴 N/A
🔹 Disclosed: August 3, 2026, 7:16am (UTC)
🐞 Source: HackerOne
👉 Read full report
Unauthenticated Path Traversal (LFI) via /custom-sounds/ when CustomSounds uses FileSystem storage
🔹 Severity: High
🔹 Weakness: Path Traversal
🔹 Reported To: Rocket.Chat
🔹 Reported By: howtoplay
🔹 State: 🟢 Resolved
🔹 Disclosed: August 3, 2026, 1:35pm (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: High
🔹 Weakness: Path Traversal
🔹 Reported To: Rocket.Chat
🔹 Reported By: howtoplay
🔹 State: 🟢 Resolved
🔹 Disclosed: August 3, 2026, 1:35pm (UTC)
🐞 Source: HackerOne
👉 Read full report