Reflected XSS on itims.bia.gov

🔹 Severity: Medium
🔹 Reported To: Bureau of Indian Affairs
🔹 Reported By: meeterpreeter
🔹 State: 🟠 Unresolved
🔹 Disclosed: August 13, 2026
🐞 Source: Bugcrowd

👉 Read full report

Host Header Injection

🔹 Severity: Informational
🔹 Reported To: Bureau of Indian Affairs
🔹 Reported By: ChinmayNangia
🔹 State: ⚪️ Informational
🔹 Disclosed: August 13, 2026
🐞 Source: Bugcrowd

👉 Read full report

Server Side Errors

🔹 Severity: Informational
🔹 Reported To: The Bureau of Indian Education Vulnerability Disclosure Program
🔹 Reported By: mrnazu01
🔹 State: ⚪️ Informational
🔹 Disclosed: August 13, 2026
🐞 Source: Bugcrowd

👉 Read full report

Debug Deep Link Abuse Allows Repeated Forced Logout and Application Disruption

🔹 Severity: Low
🔹 Weakness: Violation of Secure Design Principles
🔹 Reported To: Yelp
🔹 Reported By: 0xkarim_dix
🔹 State: 🟢 Resolved
🔹 Disclosed: August 13, 2026, 1:30pm (UTC)
🐞 Source: HackerOne

A debug deep link was discovered in the Android application "com.yelp.android.biz" that could be triggered externally, causing the application to crash and the user's session to be invalidated, requiring the user to log in again. The existence of this exposed deep link allowed any malicious application installed on the same device to repeatedly trigger this behavior, resulting in a persistent local denial of…

👉 Read full report

Cookie jar load skips public suffix check on PSL builds

🔹 Severity: Medium
🔹 Weakness: Information Exposure Through Sent Data
🔹 Reported To: curl
🔹 Reported By: 1rhino2
🔹 State: ⚪️ Informative
🔹 Disclosed: August 14, 2026, 7:33am (UTC)
🐞 Source: HackerOne

👉 Read full report

libcurl cache updates follow symlinks and truncate their targets

🔹 Severity: Low
🔹 Weakness: Time-of-check Time-of-use (TOCTOU) Race Condition
🔹 Reported To: curl
🔹 Reported By: mr4bugs
🔹 State: 🔴 N/A
🔹 Disclosed: August 14, 2026, 12:04pm (UTC)
🐞 Source: HackerOne

👉 Read full report

Windows SSPI connection-pool probe can reuse a connection under the wrong user

🔹 Severity: Medium
🔹 Weakness: Authentication Bypass by Spoofing
🔹 Reported To: curl
🔹 Reported By: mr4bugs
🔹 State: 🔴 N/A
🔹 Disclosed: August 14, 2026, 12:05pm (UTC)
🐞 Source: HackerOne

👉 Read full report

TaskProcessing callback authorization bypass allows ex-members to post as Assistant Talk Bot

🔹 Severity: Medium
🔹 Weakness: Insecure Direct Object Reference (IDOR)
🔹 Reported To: Nextcloud
🔹 Reported By: kuninogu
🔹 State: 🟢 Resolved
🔹 Disclosed: August 14, 2026, 2:50pm (UTC)
🐞 Source: HackerOne

A vulnerability was discovered that allowed an authenticated low-privilege user to cause the trusted Assistant Talk Bot to post attacker-guided AI-generated content into a Talk conversation, even after the user had left the conversation. The issue was caused by the Talk Bot's endpoint trusting the caller-supplied conversation token without verifying that the callback belonged to a task originally scheduled by the…

👉 Read full report

`set_daemon` wallet-rpc silently ignores `ssl_allowed_fingerprints` → pinning bypassed, wallet↔daemon MITM

🔹 Severity: High
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: Monero
🔹 Reported By: benisprlh
🔹 State: 🟢 Resolved
🔹 Disclosed: August 5, 2026, 5:06am (UTC)
🐞 Source: HackerOne

The `set_daemon` JSON-RPC in `monero-wallet-rpc` was found to have a vulnerability that silently ignored the `ssl_allowed_fingerprints` parameter, allowing MITM attacks against the wallet-daemon connection. The vulnerability was introduced in the initial release of the RPC in March 2019 and affected all subsequent versions up to the latest release. The vulnerability was caused by improper handling of the…

👉 Read full report

Restricted RPC Policy Bypass on ZMQ JSON-RPC Allows Unauthenticated Remote Admin Actions

🔹 Severity: High
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: Monero
🔹 Reported By: usagirabbit
🔹 State: 🟢 Resolved
🔹 Disclosed: August 17, 2026, 9:16am (UTC)
🐞 Source: HackerOne

A high-severity access-control issue was found in Monero's ZMQ JSON-RPC surface. When the daemon is started in restricted/public-node mode, the HTTP RPC layer correctly suppresses admin-only methods, but the ZMQ JSON-RPC layer did not inherit or enforce that restriction. This allowed an unauthenticated remote client to invoke state-changing methods that should have been unavailable in restricted mode.

👉 Read full report

Wallet RPC Restricted-Mode Policy Bypass

🔹 Severity: High
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: Monero
🔹 Reported By: usagirabbit
🔹 State: 🟢 Resolved
🔹 Disclosed: August 17, 2026, 9:16am (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in the Monero wallet RPC server that allowed restricted-mode clients to perform non-view-only operations. The issue was caused by inconsistent enforcement of the restricted mode, which allowed clients to bypass the intended view-only access controls and perform state-changing actions such as creating wallets, closing wallets, and mutating wallet state. The vulnerability was confirmed…

👉 Read full report

URGENT: CRITICAL DATA BREACH - Cross-User PHI/PII Leakage via Prompt Injection - Non-malicious discovery

🔹 Severity: Critical
🔹 Reported To: OpenAI
🔹 Reported By: Teringette-adamuzonyi
🔹 State: 🟢 Resolved
🔹 Disclosed: August 19, 2026
🐞 Source: Bugcrowd

👉 Read full report

Stored HTML Injection (CWE-79) via Livechat Visitor Name

🔹 Severity: Low
🔹 Weakness: Cross-site Scripting (XSS) - DOM
🔹 Reported To: Rocket.Chat
🔹 Reported By: hillng
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 7:18pm (UTC)
🐞 Source: HackerOne

👉 Read full report

DDP methods getThreadsList / getThreadMessages leaks private thread content to any authenticated low privilege user (unpatched sibling of #1446767)

🔹 Severity: High
🔹 Weakness: NoSQL Injection
🔹 Reported To: Rocket.Chat
🔹 Reported By: iamaangx028
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 7:54pm (UTC)
🐞 Source: HackerOne

👉 Read full report

Unauthenticated Error-Based SQL Injection via POST Parameter Name in /api/experiment/answer/new/

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: iaramsri
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026
🐞 Source: Bugcrowd

👉 Read full report

Unauthenticated Remote Code Execution in NASA AMMOS AIT-GUI 2.5.0 via /tlm/query file write chained to /script/run code execution

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: ward0
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026
🐞 Source: Bugcrowd

👉 Read full report

Unauthenticated SSRF in NASA Trek addManifest allows internal network access from the Trek server

🔹 Severity: High
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: n0RollBack
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026
🐞 Source: Bugcrowd

👉 Read full report

Unauthorized Access to CI/CD Infrastructure and Project Secrets via Compromised GitLab Runner Token

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: oguzhan_00
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026
🐞 Source: Bugcrowd

👉 Read full report

Loss of multisig funds through single malicious participant's deliberate deception

🔹 Severity: Medium
🔹 Weakness: Business Logic Errors
🔹 Reported To: Monero
🔹 Reported By: k-privacy-enjoyer
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 11:47pm (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in the Monero multisig implementation. A single malicious participant of a multisig could trick other users into sending funds multiple times to a certain recipient, which could not be easily distinguished from a legitimate user action. This issue was caused by the inability to view the inputs of partially signed multisig transactions, and the lack of a mechanism to deliberately…

👉 Read full report

monero:// deeplink parsing accepts tx_amount=(all) and can trigger send-all transaction mode

🔹 Severity: Medium
🔹 Weakness: Business Logic Errors
🔹 Reported To: Monero
🔹 Reported By: qttps
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 11:47pm (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in the Monero GUI wallet application. The vulnerability allowed an attacker to craft a malicious URI that could be used to trigger a "send-all" transaction mode, where the victim's entire unlocked balance would be transferred to the attacker's address. The vulnerability was caused by improper validation of the "tx_amount" parameter in the external "monero://" URI handler, which…

👉 Read full report

Windows installer grants low-privileged users write access to executable P2Pool directory, enabling local code execution

🔹 Severity: High
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Monero
🔹 Reported By: qttps
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 11:47pm (UTC)
🐞 Source: HackerOne

A Windows installer for the Monero GUI wallet created a subdirectory for P2Pool with overly broad write permissions for low-privileged users. The GUI later executed the `p2pool.exe` binary from that directory without any additional integrity checks, allowing a local attacker to plant malicious code that would be executed by the GUI.

👉 Read full report