Stored XSS via SVG Upload — check_content() Blocklist Bypass & 256-Byte Scan Limit (Self-Propagating Worm)
🔹 Severity: Medium
🔹 Weakness: Cross-site Scripting (XSS) - Stored
🔹 Reported To: phpBB
🔹 Reported By: a7mmr
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2026, 8:29pm (UTC)
🐞 Source: HackerOne
A stored XSS vulnerability was discovered in phpBB 4.0.0-a2-dev. The vulnerability was caused by an incomplete blocklist for file uploads and a 256-byte read limit in the content scanning check. Specifically, SVG files with malicious payloads in the onload and onbegin attributes were able to bypass the content check and be stored on the server. Additionally, any content beyond the 256-byte limit was not scanned…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Cross-site Scripting (XSS) - Stored
🔹 Reported To: phpBB
🔹 Reported By: a7mmr
🔹 State: 🟢 Resolved
🔹 Disclosed: July 30, 2026, 8:29pm (UTC)
🐞 Source: HackerOne
A stored XSS vulnerability was discovered in phpBB 4.0.0-a2-dev. The vulnerability was caused by an incomplete blocklist for file uploads and a 256-byte read limit in the content scanning check. Specifically, SVG files with malicious payloads in the onload and onbegin attributes were able to bypass the content check and be stored on the server. Additionally, any content beyond the 256-byte limit was not scanned…
👉 Read full report
Broken Link Hijacking (Impersonation) on jpl.nasa.gov via Unregistered Facebook URL
🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: Vansh_Rathore
🔹 State: 🟢 Resolved
🔹 Disclosed: July 31, 2026
🐞 Source: Bugcrowd
👉 Read full report
🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: Vansh_Rathore
🔹 State: 🟢 Resolved
🔹 Disclosed: July 31, 2026
🐞 Source: Bugcrowd
👉 Read full report
Access To ( nasa slack channel ) Vai Live Slack Invitation Link ( https://join.slack.com/t/nasa-ammos/shared_invite/zt-1mlgmk5c2-MgqVSyKzVRUWrXy87FNqPw )
🔹 Severity: High
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: Kartiktantubai
🔹 State: 🟢 Resolved
🔹 Disclosed: July 31, 2026
🐞 Source: Bugcrowd
👉 Read full report
🔹 Severity: High
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: Kartiktantubai
🔹 State: 🟢 Resolved
🔹 Disclosed: July 31, 2026
🐞 Source: Bugcrowd
👉 Read full report
Stored XSS in nameserver field on account settings page
🔹 Severity: Low
🔹 Weakness: Cross-site Scripting (XSS) - Stored
🔹 Reported To: Tucows (VDP)
🔹 Reported By: axolot23
🔹 State: 🟢 Resolved
🔹 Disclosed: July 31, 2026, 3:07pm (UTC)
🐞 Source: HackerOne
A stored XSS vulnerability was discovered in the nameserver field on the account settings page. The lack of input validation and weak CSP configuration allowed the injection of malicious JavaScript code that executed when the settings page was reloaded. The vulnerability was limited to a self-XSS scenario, affecting only the account owner who injected the payload and not other users.
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Cross-site Scripting (XSS) - Stored
🔹 Reported To: Tucows (VDP)
🔹 Reported By: axolot23
🔹 State: 🟢 Resolved
🔹 Disclosed: July 31, 2026, 3:07pm (UTC)
🐞 Source: HackerOne
A stored XSS vulnerability was discovered in the nameserver field on the account settings page. The lack of input validation and weak CSP configuration allowed the injection of malicious JavaScript code that executed when the settings page was reloaded. The vulnerability was limited to a self-XSS scenario, affecting only the account owner who injected the payload and not other users.
👉 Read full report
HTTP Request Smuggling via Connection: close<TAB> in Node.js llhttp parser
🔹 Severity: Medium
🔹 Weakness: HTTP Request Smuggling
🔹 Reported To: Node.js
🔹 Reported By: nadav0077
🔹 State: 🟢 Resolved
🔹 Disclosed: July 31, 2026, 3:27pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the Node.js HTTP server where it ignores the "Connection: close" header when the token is followed by a tab character. This allows an attacker to send a second request on the same connection, even after the first request should have closed the connection.
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: HTTP Request Smuggling
🔹 Reported To: Node.js
🔹 Reported By: nadav0077
🔹 State: 🟢 Resolved
🔹 Disclosed: July 31, 2026, 3:27pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the Node.js HTTP server where it ignores the "Connection: close" header when the token is followed by a tab character. This allows an attacker to send a second request on the same connection, even after the first request should have closed the connection.
👉 Read full report
🔥1
Data Integrity Risk & PII Exposure: Publicly Editable OPAG Collaboration Document (Google Sheets) via science.nasa.gov
🔹 Severity: Informational
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: Vansh_Rathore
🔹 State: ⚪️ Informational
🔹 Disclosed: July 31, 2026
🐞 Source: Bugcrowd
👉 Read full report
🔹 Severity: Informational
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: Vansh_Rathore
🔹 State: ⚪️ Informational
🔹 Disclosed: July 31, 2026
🐞 Source: Bugcrowd
👉 Read full report
Unauthenticated team "income/payments" export ignores donor privacy settings (hide_giving, hide_from_lists) and uses frozen visibility, exposing donat
🔹 Severity: Medium | 💰 100 USD
🔹 Reported To: Liberapay
🔹 Reported By: its9me
🔹 State: 🟢 Resolved
🔹 Disclosed: August 1, 2026, 12:27pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the unauthenticated team "income/payments" export feature of Liberapay. The vulnerability allowed an attacker to retrieve donor identity, exact donation amount, and donation dates for public donors, bypassing the donor's explicit privacy settings such as "hide_giving" and "hide_from_lists". The root cause was that the endpoint only honored the frozen visibility flag of the payment…
👉 Read full report
🔹 Severity: Medium | 💰 100 USD
🔹 Reported To: Liberapay
🔹 Reported By: its9me
🔹 State: 🟢 Resolved
🔹 Disclosed: August 1, 2026, 12:27pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the unauthenticated team "income/payments" export feature of Liberapay. The vulnerability allowed an attacker to retrieve donor identity, exact donation amount, and donation dates for public donors, bypassing the donor's explicit privacy settings such as "hide_giving" and "hide_from_lists". The root cause was that the endpoint only honored the frozen visibility flag of the payment…
👉 Read full report
SMTP CRLF injection in custom SMTP recipient operand allows additional SMTP commands after authentication
🔹 Severity: Medium
🔹 Weakness: CRLF Injection
🔹 Reported To: curl
🔹 Reported By: dark_river
🔹 State: 🔴 N/A
🔹 Disclosed: August 3, 2026, 7:16am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: CRLF Injection
🔹 Reported To: curl
🔹 Reported By: dark_river
🔹 State: 🔴 N/A
🔹 Disclosed: August 3, 2026, 7:16am (UTC)
🐞 Source: HackerOne
👉 Read full report
Unauthenticated Path Traversal (LFI) via /custom-sounds/ when CustomSounds uses FileSystem storage
🔹 Severity: High
🔹 Weakness: Path Traversal
🔹 Reported To: Rocket.Chat
🔹 Reported By: howtoplay
🔹 State: 🟢 Resolved
🔹 Disclosed: August 3, 2026, 1:35pm (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: High
🔹 Weakness: Path Traversal
🔹 Reported To: Rocket.Chat
🔹 Reported By: howtoplay
🔹 State: 🟢 Resolved
🔹 Disclosed: August 3, 2026, 1:35pm (UTC)
🐞 Source: HackerOne
👉 Read full report
GitHub Retired UsernameTakeover From [aws/████████]
🔹 Severity: Low
🔹 Weakness: Inclusion of Functionality from Untrusted Control Sphere
🔹 Reported To: AWS VDP
🔹 Reported By: sh3d0w
🔹 State: 🟢 Resolved
🔹 Disclosed: August 3, 2026, 6:17pm (UTC)
🐞 Source: HackerOne
A retired GitHub username was discovered to be unclaimed, allowing an attacker to register the username and create a repository with the same name as the original. As a result, the original link to the repository now points to the attacker-controlled repository, enabling a persistent repository hijack.
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Inclusion of Functionality from Untrusted Control Sphere
🔹 Reported To: AWS VDP
🔹 Reported By: sh3d0w
🔹 State: 🟢 Resolved
🔹 Disclosed: August 3, 2026, 6:17pm (UTC)
🐞 Source: HackerOne
A retired GitHub username was discovered to be unclaimed, allowing an attacker to register the username and create a repository with the same name as the original. As a result, the original link to the repository now points to the attacker-controlled repository, enabling a persistent repository hijack.
👉 Read full report
Heap use-after-free (write) in mev_forget_socket() via reentrant curl_easy_pause() — incomplete fix for CVE-2026-9080
🔹 Severity: Medium
🔹 Weakness: Use After Free
🔹 Reported To: curl
🔹 Reported By: juthawong
🔹 State: 🔴 N/A
🔹 Disclosed: August 4, 2026, 2:55pm (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Use After Free
🔹 Reported To: curl
🔹 Reported By: juthawong
🔹 State: 🔴 N/A
🔹 Disclosed: August 4, 2026, 2:55pm (UTC)
🐞 Source: HackerOne
👉 Read full report
`relay_tx` wallet-rpc skips `--restricted-rpc` guard and lets any caller corrupt wallet state via attacker-controlled `pending_tx`
🔹 Severity: Critical
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Monero
🔹 Reported By: benisprlh
🔹 State: 🟢 Resolved
🔹 Disclosed: August 5, 2026, 5:05am (UTC)
🐞 Source: HackerOne
The `relay_tx` wallet-RPC method in Monero was found to bypass the `--restricted-rpc` guard, allowing any caller to corrupt the wallet state by submitting a malicious `pending_tx` blob. The issue was that the `on_relay_tx` handler did not perform any ownership checks on the supplied `pending_tx` before passing it to `commit_tx`, which then updated the wallet state based on the attacker-controlled data. This…
👉 Read full report
🔹 Severity: Critical
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Monero
🔹 Reported By: benisprlh
🔹 State: 🟢 Resolved
🔹 Disclosed: August 5, 2026, 5:05am (UTC)
🐞 Source: HackerOne
The `relay_tx` wallet-RPC method in Monero was found to bypass the `--restricted-rpc` guard, allowing any caller to corrupt the wallet state by submitting a malicious `pending_tx` blob. The issue was that the `on_relay_tx` handler did not perform any ownership checks on the supplied `pending_tx` before passing it to `commit_tx`, which then updated the wallet state based on the attacker-controlled data. This…
👉 Read full report
wallet-rpc describe_transfer uses real_output_in_tx_index instead of real_output: cold-wallet pre-sign review shows wrong ring member
🔹 Severity: Medium
🔹 Weakness: Array Index Underflow
🔹 Reported To: Monero
🔹 Reported By: bebensap
🔹 State: 🟢 Resolved
🔹 Disclosed: August 5, 2026, 10:23am (UTC)
🐞 Source: HackerOne
The wallet-rpc method "describe_transfer" was found to use the wrong index when retrieving information about the ring members for each input. Instead of using the "real_output" index, which represents the position of the real entry in the ring, it used the "real_output_in_tx_index", which represents the position of the output in the source transaction. This resulted in the pre-sign review displaying the wrong…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Array Index Underflow
🔹 Reported To: Monero
🔹 Reported By: bebensap
🔹 State: 🟢 Resolved
🔹 Disclosed: August 5, 2026, 10:23am (UTC)
🐞 Source: HackerOne
The wallet-rpc method "describe_transfer" was found to use the wrong index when retrieving information about the ring members for each input. Instead of using the "real_output" index, which represents the position of the real entry in the ring, it used the "real_output_in_tx_index", which represents the position of the output in the source transaction. This resulted in the pre-sign review displaying the wrong…
👉 Read full report
SpendProofV1 txid-substitution: get_spend_proof/check_spend_proof do not verify returned transaction hash
🔹 Severity: Medium
🔹 Weakness: Missing Required Cryptographic Step
🔹 Reported To: Monero
🔹 Reported By: bebensap
🔹 State: 🟢 Resolved
🔹 Disclosed: August 5, 2026, 10:23am (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the Monero project where the get_spend_proof and check_spend_proof functions do not verify the returned transaction hash against the requested transaction ID. This allows a malicious or compromised daemon to provide a valid serialized transaction body for a different transaction than the one requested, which can be used to create or verify a spend proof for that different…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Missing Required Cryptographic Step
🔹 Reported To: Monero
🔹 Reported By: bebensap
🔹 State: 🟢 Resolved
🔹 Disclosed: August 5, 2026, 10:23am (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the Monero project where the get_spend_proof and check_spend_proof functions do not verify the returned transaction hash against the requested transaction ID. This allows a malicious or compromised daemon to provide a valid serialized transaction body for a different transaction than the one requested, which can be used to create or verify a spend proof for that different…
👉 Read full report
wallet-rpc crash via malformed /gettransactions response (empty txs → vector::front() in check_tx_key / check_tx_proof)
🔹 Severity: High
🔹 Weakness: NULL Pointer Dereference
🔹 Reported To: Monero
🔹 Reported By: bebensap
🔹 State: 🟢 Resolved
🔹 Disclosed: August 5, 2026, 10:23am (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the Monero wallet software that could cause the wallet-rpc process to crash when handling a malformed response from the daemon's /gettransactions endpoint. The vulnerability was due to the wallet software making assumptions about the response structure that were not always valid, leading to undefined behavior when attempting to access empty data structures. The crash occurred when…
👉 Read full report
🔹 Severity: High
🔹 Weakness: NULL Pointer Dereference
🔹 Reported To: Monero
🔹 Reported By: bebensap
🔹 State: 🟢 Resolved
🔹 Disclosed: August 5, 2026, 10:23am (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the Monero wallet software that could cause the wallet-rpc process to crash when handling a malformed response from the daemon's /gettransactions endpoint. The vulnerability was due to the wallet software making assumptions about the response structure that were not always valid, leading to undefined behavior when attempting to access empty data structures. The crash occurred when…
👉 Read full report
`check_reserve_proof` sums RingCT ECDH amounts without checking the output commitment
🔹 Severity: Medium
🔹 Weakness: Missing Required Cryptographic Step
🔹 Reported To: Monero
🔹 Reported By: bebensap
🔹 State: 🟢 Resolved
🔹 Disclosed: August 5, 2026, 10:23am (UTC)
🐞 Source: HackerOne
The `check_reserve_proof` function in the Monero codebase was found to sum RingCT ECDH amounts without checking the output commitment. The decoded amount was added to the total without verifying that it matched the commitment, which could allow a malicious prover to claim larger reserves than actually exist on-chain.
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Missing Required Cryptographic Step
🔹 Reported To: Monero
🔹 Reported By: bebensap
🔹 State: 🟢 Resolved
🔹 Disclosed: August 5, 2026, 10:23am (UTC)
🐞 Source: HackerOne
The `check_reserve_proof` function in the Monero codebase was found to sum RingCT ECDH amounts without checking the output commitment. The decoded amount was added to the total without verifying that it matched the commitment, which could allow a malicious prover to claim larger reserves than actually exist on-chain.
👉 Read full report
`check_reserve_proof` counts duplicate entries: one output can inflate `total`
🔹 Severity: Medium
🔹 Weakness: Business Logic Errors
🔹 Reported To: Monero
🔹 Reported By: bebensap
🔹 State: 🟢 Resolved
🔹 Disclosed: August 5, 2026, 10:23am (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the `check_reserve_proof` function in the Monero wallet software. The vulnerability allowed duplicate entries in the reserve proof, which could artificially inflate the reported total reserve amount without affecting the verification of individual entries. The issue was in the verifier logic, where the accounting was done in a flat manner, adding the output amount for each row…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Business Logic Errors
🔹 Reported To: Monero
🔹 Reported By: bebensap
🔹 State: 🟢 Resolved
🔹 Disclosed: August 5, 2026, 10:23am (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the `check_reserve_proof` function in the Monero wallet software. The vulnerability allowed duplicate entries in the reserve proof, which could artificially inflate the reported total reserve amount without affecting the verification of individual entries. The issue was in the verifier logic, where the accounting was done in a flat manner, adding the output amount for each row…
👉 Read full report
curl Missing Sec-WebSocket-Accept Verification Enables MITM WebSocket Session Hijacking
🔹 Severity: No Rating
🔹 Weakness: Man-in-the-Middle
🔹 Reported To: curl
🔹 Reported By: kiyin
🔹 State: 🔴 N/A
🔹 Disclosed: August 5, 2026, 11:13am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: No Rating
🔹 Weakness: Man-in-the-Middle
🔹 Reported To: curl
🔹 Reported By: kiyin
🔹 State: 🔴 N/A
🔹 Disclosed: August 5, 2026, 11:13am (UTC)
🐞 Source: HackerOne
👉 Read full report
Unauthenticated RCE in Taskcluster web-server via GraphQL filter argument (sift $where)
🔹 Severity: Critical | 💰 12,000 USD
🔹 Weakness: Code Injection
🔹 Reported To: Mozilla
🔹 Reported By: griffinf
🔹 State: 🟢 Resolved
🔹 Disclosed: August 5, 2026, 3:50pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the Taskcluster web-server that allowed unauthenticated remote code execution through the GraphQL filter argument. The issue was caused by the use of the 'sift' library, which compiled the filter's '$where' string into a function using 'new Function' and executed it. This allowed an attacker to run arbitrary JavaScript in the context of the Node.js process, resulting in the…
👉 Read full report
🔹 Severity: Critical | 💰 12,000 USD
🔹 Weakness: Code Injection
🔹 Reported To: Mozilla
🔹 Reported By: griffinf
🔹 State: 🟢 Resolved
🔹 Disclosed: August 5, 2026, 3:50pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the Taskcluster web-server that allowed unauthenticated remote code execution through the GraphQL filter argument. The issue was caused by the use of the 'sift' library, which compiled the filter's '$where' string into a function using 'new Function' and executed it. This allowed an attacker to run arbitrary JavaScript in the context of the Node.js process, resulting in the…
👉 Read full report
[Wii U/3DS/Switch] Improper bounds check in StationURL in all NEX clients leading to remote crash/RCE
🔹 Severity: Low
🔹 Weakness: Stack Overflow
🔹 Reported To: Nintendo
🔹 Reported By: jonbarrow
🔹 State: 🔵 Duplicate
🔹 Disclosed: August 7, 2026, 1:04am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Stack Overflow
🔹 Reported To: Nintendo
🔹 Reported By: jonbarrow
🔹 State: 🔵 Duplicate
🔹 Disclosed: August 7, 2026, 1:04am (UTC)
🐞 Source: HackerOne
👉 Read full report
URL API: triple-slash parses path segment as hostname
🔹 Severity: Medium
🔹 Weakness: Use of Incorrectly-Resolved Name or Reference
🔹 Reported To: curl
🔹 Reported By: thinhlx
🔹 State: 🔴 N/A
🔹 Disclosed: August 7, 2026, 8:49pm (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Use of Incorrectly-Resolved Name or Reference
🔹 Reported To: curl
🔹 Reported By: thinhlx
🔹 State: 🔴 N/A
🔹 Disclosed: August 7, 2026, 8:49pm (UTC)
🐞 Source: HackerOne
👉 Read full report