Unauthenticated RCE in Taskcluster web-server via GraphQL filter argument (sift $where)
🔹 Severity: Critical | 💰 12,000 USD
🔹 Weakness: Code Injection
🔹 Reported To: Mozilla
🔹 Reported By: griffinf
🔹 State: 🟢 Resolved
🔹 Disclosed: August 5, 2026, 3:50pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the Taskcluster web-server that allowed unauthenticated remote code execution through the GraphQL filter argument. The issue was caused by the use of the 'sift' library, which compiled the filter's '$where' string into a function using 'new Function' and executed it. This allowed an attacker to run arbitrary JavaScript in the context of the Node.js process, resulting in the…
👉 Read full report
🔹 Severity: Critical | 💰 12,000 USD
🔹 Weakness: Code Injection
🔹 Reported To: Mozilla
🔹 Reported By: griffinf
🔹 State: 🟢 Resolved
🔹 Disclosed: August 5, 2026, 3:50pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the Taskcluster web-server that allowed unauthenticated remote code execution through the GraphQL filter argument. The issue was caused by the use of the 'sift' library, which compiled the filter's '$where' string into a function using 'new Function' and executed it. This allowed an attacker to run arbitrary JavaScript in the context of the Node.js process, resulting in the…
👉 Read full report
[Wii U/3DS/Switch] Improper bounds check in StationURL in all NEX clients leading to remote crash/RCE
🔹 Severity: Low
🔹 Weakness: Stack Overflow
🔹 Reported To: Nintendo
🔹 Reported By: jonbarrow
🔹 State: 🔵 Duplicate
🔹 Disclosed: August 7, 2026, 1:04am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Stack Overflow
🔹 Reported To: Nintendo
🔹 Reported By: jonbarrow
🔹 State: 🔵 Duplicate
🔹 Disclosed: August 7, 2026, 1:04am (UTC)
🐞 Source: HackerOne
👉 Read full report
URL API: triple-slash parses path segment as hostname
🔹 Severity: Medium
🔹 Weakness: Use of Incorrectly-Resolved Name or Reference
🔹 Reported To: curl
🔹 Reported By: thinhlx
🔹 State: 🔴 N/A
🔹 Disclosed: August 7, 2026, 8:49pm (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Use of Incorrectly-Resolved Name or Reference
🔹 Reported To: curl
🔹 Reported By: thinhlx
🔹 State: 🔴 N/A
🔹 Disclosed: August 7, 2026, 8:49pm (UTC)
🐞 Source: HackerOne
👉 Read full report
Adding phone number to profile By OTP brute forcing
🔹 Severity: Medium | 💰 100 USD
🔹 Weakness: Insecure Storage of Sensitive Information
🔹 Reported To: CoinMate.io
🔹 Reported By: ganesh_reddy
🔹 State: 🟢 Resolved
🔹 Disclosed: August 8, 2026, 9:11am (UTC)
🐞 Source: HackerOne
A vulnerability was found that allowed an attacker to add any phone number to a user's profile by brute-forcing the one-time password (OTP) used for phone number verification. The steps involved intercepting the OTP verification request, using a brute-force attack to find the valid OTP, and then replaying the original request with the discovered OTP to complete the phone number addition.
👉 Read full report
🔹 Severity: Medium | 💰 100 USD
🔹 Weakness: Insecure Storage of Sensitive Information
🔹 Reported To: CoinMate.io
🔹 Reported By: ganesh_reddy
🔹 State: 🟢 Resolved
🔹 Disclosed: August 8, 2026, 9:11am (UTC)
🐞 Source: HackerOne
A vulnerability was found that allowed an attacker to add any phone number to a user's profile by brute-forcing the one-time password (OTP) used for phone number verification. The steps involved intercepting the OTP verification request, using a brute-force attack to find the valid OTP, and then replaying the original request with the discovered OTP to complete the phone number addition.
👉 Read full report
Unauthenticated MQTT Wildcard (board/#) Leaks All Pinboard UUIDs to Unauthorized Users
🔹 Severity: High
🔹 Reported To: Opera Public Bug Bounty
🔹 Reported By: ty5ona
🔹 State: 🟢 Resolved
🔹 Disclosed: August 11, 2026
🐞 Source: Bugcrowd
👉 Read full report
🔹 Severity: High
🔹 Reported To: Opera Public Bug Bounty
🔹 Reported By: ty5ona
🔹 State: 🟢 Resolved
🔹 Disclosed: August 11, 2026
🐞 Source: Bugcrowd
👉 Read full report
Myndr CORS Misconfiguration
🔹 Severity: No Rating
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Myndr
🔹 Reported By: hackwithshubh
🔹 State: 🟢 Resolved
🔹 Disclosed: August 12, 2026, 6:22am (UTC)
🐞 Source: HackerOne
The CORS configuration on admin.myndr.net allowed any .myndr.net subdomain to read authenticated admin panel responses, including CSRF nonces and session data. This vulnerability could have been exploited to take over admin accounts.
👉 Read full report
🔹 Severity: No Rating
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Myndr
🔹 Reported By: hackwithshubh
🔹 State: 🟢 Resolved
🔹 Disclosed: August 12, 2026, 6:22am (UTC)
🐞 Source: HackerOne
The CORS configuration on admin.myndr.net allowed any .myndr.net subdomain to read authenticated admin panel responses, including CSRF nonces and session data. This vulnerability could have been exploited to take over admin accounts.
👉 Read full report
JaaS: Unauthenticated, cross-tenant outbound SIP calling via JaaS SIP gateway (toll fraud + caller-ID spoofing)
🔹 Severity: Medium | 💰 500 USD
🔹 Weakness: Missing Authorization
🔹 Reported To: 8x8
🔹 Reported By: offseq
🔹 State: 🟢 Resolved
🔹 Disclosed: August 12, 2026, 4:07pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the JaaS SIP gateway that allowed unauthenticated, cross-tenant outbound SIP calling. This could have facilitated toll fraud and caller-ID spoofing.
👉 Read full report
🔹 Severity: Medium | 💰 500 USD
🔹 Weakness: Missing Authorization
🔹 Reported To: 8x8
🔹 Reported By: offseq
🔹 State: 🟢 Resolved
🔹 Disclosed: August 12, 2026, 4:07pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the JaaS SIP gateway that allowed unauthenticated, cross-tenant outbound SIP calling. This could have facilitated toll fraud and caller-ID spoofing.
👉 Read full report
Reflected XSS on itims.bia.gov
🔹 Severity: Medium
🔹 Reported To: Bureau of Indian Affairs
🔹 Reported By: meeterpreeter
🔹 State: 🟠 Unresolved
🔹 Disclosed: August 13, 2026
🐞 Source: Bugcrowd
👉 Read full report
🔹 Severity: Medium
🔹 Reported To: Bureau of Indian Affairs
🔹 Reported By: meeterpreeter
🔹 State: 🟠 Unresolved
🔹 Disclosed: August 13, 2026
🐞 Source: Bugcrowd
👉 Read full report
Host Header Injection
🔹 Severity: Informational
🔹 Reported To: Bureau of Indian Affairs
🔹 Reported By: ChinmayNangia
🔹 State: ⚪️ Informational
🔹 Disclosed: August 13, 2026
🐞 Source: Bugcrowd
👉 Read full report
🔹 Severity: Informational
🔹 Reported To: Bureau of Indian Affairs
🔹 Reported By: ChinmayNangia
🔹 State: ⚪️ Informational
🔹 Disclosed: August 13, 2026
🐞 Source: Bugcrowd
👉 Read full report
Server Side Errors
🔹 Severity: Informational
🔹 Reported To: The Bureau of Indian Education Vulnerability Disclosure Program
🔹 Reported By: mrnazu01
🔹 State: ⚪️ Informational
🔹 Disclosed: August 13, 2026
🐞 Source: Bugcrowd
👉 Read full report
🔹 Severity: Informational
🔹 Reported To: The Bureau of Indian Education Vulnerability Disclosure Program
🔹 Reported By: mrnazu01
🔹 State: ⚪️ Informational
🔹 Disclosed: August 13, 2026
🐞 Source: Bugcrowd
👉 Read full report
Debug Deep Link Abuse Allows Repeated Forced Logout and Application Disruption
🔹 Severity: Low
🔹 Weakness: Violation of Secure Design Principles
🔹 Reported To: Yelp
🔹 Reported By: 0xkarim_dix
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2026, 1:30pm (UTC)
🐞 Source: HackerOne
A debug deep link was discovered in the Android application "com.yelp.android.biz" that could be triggered externally, causing the application to crash and the user's session to be invalidated, requiring the user to log in again. The existence of this exposed deep link allowed any malicious application installed on the same device to repeatedly trigger this behavior, resulting in a persistent local denial of…
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Violation of Secure Design Principles
🔹 Reported To: Yelp
🔹 Reported By: 0xkarim_dix
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2026, 1:30pm (UTC)
🐞 Source: HackerOne
A debug deep link was discovered in the Android application "com.yelp.android.biz" that could be triggered externally, causing the application to crash and the user's session to be invalidated, requiring the user to log in again. The existence of this exposed deep link allowed any malicious application installed on the same device to repeatedly trigger this behavior, resulting in a persistent local denial of…
👉 Read full report
Cookie jar load skips public suffix check on PSL builds
🔹 Severity: Medium
🔹 Weakness: Information Exposure Through Sent Data
🔹 Reported To: curl
🔹 Reported By: 1rhino2
🔹 State: ⚪️ Informative
🔹 Disclosed: August 14, 2026, 7:33am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Information Exposure Through Sent Data
🔹 Reported To: curl
🔹 Reported By: 1rhino2
🔹 State: ⚪️ Informative
🔹 Disclosed: August 14, 2026, 7:33am (UTC)
🐞 Source: HackerOne
👉 Read full report
libcurl cache updates follow symlinks and truncate their targets
🔹 Severity: Low
🔹 Weakness: Time-of-check Time-of-use (TOCTOU) Race Condition
🔹 Reported To: curl
🔹 Reported By: mr4bugs
🔹 State: 🔴 N/A
🔹 Disclosed: August 14, 2026, 12:04pm (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Time-of-check Time-of-use (TOCTOU) Race Condition
🔹 Reported To: curl
🔹 Reported By: mr4bugs
🔹 State: 🔴 N/A
🔹 Disclosed: August 14, 2026, 12:04pm (UTC)
🐞 Source: HackerOne
👉 Read full report
Windows SSPI connection-pool probe can reuse a connection under the wrong user
🔹 Severity: Medium
🔹 Weakness: Authentication Bypass by Spoofing
🔹 Reported To: curl
🔹 Reported By: mr4bugs
🔹 State: 🔴 N/A
🔹 Disclosed: August 14, 2026, 12:05pm (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Authentication Bypass by Spoofing
🔹 Reported To: curl
🔹 Reported By: mr4bugs
🔹 State: 🔴 N/A
🔹 Disclosed: August 14, 2026, 12:05pm (UTC)
🐞 Source: HackerOne
👉 Read full report
TaskProcessing callback authorization bypass allows ex-members to post as Assistant Talk Bot
🔹 Severity: Medium
🔹 Weakness: Insecure Direct Object Reference (IDOR)
🔹 Reported To: Nextcloud
🔹 Reported By: kuninogu
🔹 State: 🟢 Resolved
🔹 Disclosed: August 14, 2026, 2:50pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered that allowed an authenticated low-privilege user to cause the trusted Assistant Talk Bot to post attacker-guided AI-generated content into a Talk conversation, even after the user had left the conversation. The issue was caused by the Talk Bot's endpoint trusting the caller-supplied conversation token without verifying that the callback belonged to a task originally scheduled by the…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Insecure Direct Object Reference (IDOR)
🔹 Reported To: Nextcloud
🔹 Reported By: kuninogu
🔹 State: 🟢 Resolved
🔹 Disclosed: August 14, 2026, 2:50pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered that allowed an authenticated low-privilege user to cause the trusted Assistant Talk Bot to post attacker-guided AI-generated content into a Talk conversation, even after the user had left the conversation. The issue was caused by the Talk Bot's endpoint trusting the caller-supplied conversation token without verifying that the callback belonged to a task originally scheduled by the…
👉 Read full report
`set_daemon` wallet-rpc silently ignores `ssl_allowed_fingerprints` → pinning bypassed, wallet↔daemon MITM
🔹 Severity: High
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: Monero
🔹 Reported By: benisprlh
🔹 State: 🟢 Resolved
🔹 Disclosed: August 5, 2026, 5:06am (UTC)
🐞 Source: HackerOne
The `set_daemon` JSON-RPC in `monero-wallet-rpc` was found to have a vulnerability that silently ignored the `ssl_allowed_fingerprints` parameter, allowing MITM attacks against the wallet-daemon connection. The vulnerability was introduced in the initial release of the RPC in March 2019 and affected all subsequent versions up to the latest release. The vulnerability was caused by improper handling of the…
👉 Read full report
🔹 Severity: High
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: Monero
🔹 Reported By: benisprlh
🔹 State: 🟢 Resolved
🔹 Disclosed: August 5, 2026, 5:06am (UTC)
🐞 Source: HackerOne
The `set_daemon` JSON-RPC in `monero-wallet-rpc` was found to have a vulnerability that silently ignored the `ssl_allowed_fingerprints` parameter, allowing MITM attacks against the wallet-daemon connection. The vulnerability was introduced in the initial release of the RPC in March 2019 and affected all subsequent versions up to the latest release. The vulnerability was caused by improper handling of the…
👉 Read full report
Restricted RPC Policy Bypass on ZMQ JSON-RPC Allows Unauthenticated Remote Admin Actions
🔹 Severity: High
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: Monero
🔹 Reported By: usagirabbit
🔹 State: 🟢 Resolved
🔹 Disclosed: August 17, 2026, 9:16am (UTC)
🐞 Source: HackerOne
A high-severity access-control issue was found in Monero's ZMQ JSON-RPC surface. When the daemon is started in restricted/public-node mode, the HTTP RPC layer correctly suppresses admin-only methods, but the ZMQ JSON-RPC layer did not inherit or enforce that restriction. This allowed an unauthenticated remote client to invoke state-changing methods that should have been unavailable in restricted mode.
👉 Read full report
🔹 Severity: High
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: Monero
🔹 Reported By: usagirabbit
🔹 State: 🟢 Resolved
🔹 Disclosed: August 17, 2026, 9:16am (UTC)
🐞 Source: HackerOne
A high-severity access-control issue was found in Monero's ZMQ JSON-RPC surface. When the daemon is started in restricted/public-node mode, the HTTP RPC layer correctly suppresses admin-only methods, but the ZMQ JSON-RPC layer did not inherit or enforce that restriction. This allowed an unauthenticated remote client to invoke state-changing methods that should have been unavailable in restricted mode.
👉 Read full report
Wallet RPC Restricted-Mode Policy Bypass
🔹 Severity: High
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: Monero
🔹 Reported By: usagirabbit
🔹 State: 🟢 Resolved
🔹 Disclosed: August 17, 2026, 9:16am (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the Monero wallet RPC server that allowed restricted-mode clients to perform non-view-only operations. The issue was caused by inconsistent enforcement of the restricted mode, which allowed clients to bypass the intended view-only access controls and perform state-changing actions such as creating wallets, closing wallets, and mutating wallet state. The vulnerability was confirmed…
👉 Read full report
🔹 Severity: High
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: Monero
🔹 Reported By: usagirabbit
🔹 State: 🟢 Resolved
🔹 Disclosed: August 17, 2026, 9:16am (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the Monero wallet RPC server that allowed restricted-mode clients to perform non-view-only operations. The issue was caused by inconsistent enforcement of the restricted mode, which allowed clients to bypass the intended view-only access controls and perform state-changing actions such as creating wallets, closing wallets, and mutating wallet state. The vulnerability was confirmed…
👉 Read full report
URGENT: CRITICAL DATA BREACH - Cross-User PHI/PII Leakage via Prompt Injection - Non-malicious discovery
🔹 Severity: Critical
🔹 Reported To: OpenAI
🔹 Reported By: Teringette-adamuzonyi
🔹 State: 🟢 Resolved
🔹 Disclosed: August 19, 2026
🐞 Source: Bugcrowd
👉 Read full report
🔹 Severity: Critical
🔹 Reported To: OpenAI
🔹 Reported By: Teringette-adamuzonyi
🔹 State: 🟢 Resolved
🔹 Disclosed: August 19, 2026
🐞 Source: Bugcrowd
👉 Read full report
Stored HTML Injection (CWE-79) via Livechat Visitor Name
🔹 Severity: Low
🔹 Weakness: Cross-site Scripting (XSS) - DOM
🔹 Reported To: Rocket.Chat
🔹 Reported By: hillng
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 7:18pm (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Cross-site Scripting (XSS) - DOM
🔹 Reported To: Rocket.Chat
🔹 Reported By: hillng
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 7:18pm (UTC)
🐞 Source: HackerOne
👉 Read full report
DDP methods getThreadsList / getThreadMessages leaks private thread content to any authenticated low privilege user (unpatched sibling of #1446767)
🔹 Severity: High
🔹 Weakness: NoSQL Injection
🔹 Reported To: Rocket.Chat
🔹 Reported By: iamaangx028
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 7:54pm (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: High
🔹 Weakness: NoSQL Injection
🔹 Reported To: Rocket.Chat
🔹 Reported By: iamaangx028
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 7:54pm (UTC)
🐞 Source: HackerOne
👉 Read full report