Windows SSPI connection-pool probe can reuse a connection under the wrong user

🔹 Severity: Medium
🔹 Weakness: Authentication Bypass by Spoofing
🔹 Reported To: curl
🔹 Reported By: mr4bugs
🔹 State: 🔴 N/A
🔹 Disclosed: August 14, 2026, 12:05pm (UTC)
🐞 Source: HackerOne

👉 Read full report

TaskProcessing callback authorization bypass allows ex-members to post as Assistant Talk Bot

🔹 Severity: Medium
🔹 Weakness: Insecure Direct Object Reference (IDOR)
🔹 Reported To: Nextcloud
🔹 Reported By: kuninogu
🔹 State: 🟢 Resolved
🔹 Disclosed: August 14, 2026, 2:50pm (UTC)
🐞 Source: HackerOne

A vulnerability was discovered that allowed an authenticated low-privilege user to cause the trusted Assistant Talk Bot to post attacker-guided AI-generated content into a Talk conversation, even after the user had left the conversation. The issue was caused by the Talk Bot's endpoint trusting the caller-supplied conversation token without verifying that the callback belonged to a task originally scheduled by the…

👉 Read full report

`set_daemon` wallet-rpc silently ignores `ssl_allowed_fingerprints` → pinning bypassed, wallet↔daemon MITM

🔹 Severity: High
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: Monero
🔹 Reported By: benisprlh
🔹 State: 🟢 Resolved
🔹 Disclosed: August 5, 2026, 5:06am (UTC)
🐞 Source: HackerOne

The `set_daemon` JSON-RPC in `monero-wallet-rpc` was found to have a vulnerability that silently ignored the `ssl_allowed_fingerprints` parameter, allowing MITM attacks against the wallet-daemon connection. The vulnerability was introduced in the initial release of the RPC in March 2019 and affected all subsequent versions up to the latest release. The vulnerability was caused by improper handling of the…

👉 Read full report

Restricted RPC Policy Bypass on ZMQ JSON-RPC Allows Unauthenticated Remote Admin Actions

🔹 Severity: High
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: Monero
🔹 Reported By: usagirabbit
🔹 State: 🟢 Resolved
🔹 Disclosed: August 17, 2026, 9:16am (UTC)
🐞 Source: HackerOne

A high-severity access-control issue was found in Monero's ZMQ JSON-RPC surface. When the daemon is started in restricted/public-node mode, the HTTP RPC layer correctly suppresses admin-only methods, but the ZMQ JSON-RPC layer did not inherit or enforce that restriction. This allowed an unauthenticated remote client to invoke state-changing methods that should have been unavailable in restricted mode.

👉 Read full report

Wallet RPC Restricted-Mode Policy Bypass

🔹 Severity: High
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: Monero
🔹 Reported By: usagirabbit
🔹 State: 🟢 Resolved
🔹 Disclosed: August 17, 2026, 9:16am (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in the Monero wallet RPC server that allowed restricted-mode clients to perform non-view-only operations. The issue was caused by inconsistent enforcement of the restricted mode, which allowed clients to bypass the intended view-only access controls and perform state-changing actions such as creating wallets, closing wallets, and mutating wallet state. The vulnerability was confirmed…

👉 Read full report

URGENT: CRITICAL DATA BREACH - Cross-User PHI/PII Leakage via Prompt Injection - Non-malicious discovery

🔹 Severity: Critical
🔹 Reported To: OpenAI
🔹 Reported By: Teringette-adamuzonyi
🔹 State: 🟢 Resolved
🔹 Disclosed: August 19, 2026
🐞 Source: Bugcrowd

👉 Read full report

Stored HTML Injection (CWE-79) via Livechat Visitor Name

🔹 Severity: Low
🔹 Weakness: Cross-site Scripting (XSS) - DOM
🔹 Reported To: Rocket.Chat
🔹 Reported By: hillng
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 7:18pm (UTC)
🐞 Source: HackerOne

👉 Read full report

DDP methods getThreadsList / getThreadMessages leaks private thread content to any authenticated low privilege user (unpatched sibling of #1446767)

🔹 Severity: High
🔹 Weakness: NoSQL Injection
🔹 Reported To: Rocket.Chat
🔹 Reported By: iamaangx028
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 7:54pm (UTC)
🐞 Source: HackerOne

👉 Read full report

Unauthenticated Error-Based SQL Injection via POST Parameter Name in /api/experiment/answer/new/

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: iaramsri
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026
🐞 Source: Bugcrowd

👉 Read full report

Unauthenticated Remote Code Execution in NASA AMMOS AIT-GUI 2.5.0 via /tlm/query file write chained to /script/run code execution

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: ward0
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026
🐞 Source: Bugcrowd

👉 Read full report

Unauthenticated SSRF in NASA Trek addManifest allows internal network access from the Trek server

🔹 Severity: High
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: n0RollBack
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026
🐞 Source: Bugcrowd

👉 Read full report

Unauthorized Access to CI/CD Infrastructure and Project Secrets via Compromised GitLab Runner Token

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: oguzhan_00
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026
🐞 Source: Bugcrowd

👉 Read full report

Loss of multisig funds through single malicious participant's deliberate deception

🔹 Severity: Medium
🔹 Weakness: Business Logic Errors
🔹 Reported To: Monero
🔹 Reported By: k-privacy-enjoyer
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 11:47pm (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in the Monero multisig implementation. A single malicious participant of a multisig could trick other users into sending funds multiple times to a certain recipient, which could not be easily distinguished from a legitimate user action. This issue was caused by the inability to view the inputs of partially signed multisig transactions, and the lack of a mechanism to deliberately…

👉 Read full report

monero:// deeplink parsing accepts tx_amount=(all) and can trigger send-all transaction mode

🔹 Severity: Medium
🔹 Weakness: Business Logic Errors
🔹 Reported To: Monero
🔹 Reported By: qttps
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 11:47pm (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in the Monero GUI wallet application. The vulnerability allowed an attacker to craft a malicious URI that could be used to trigger a "send-all" transaction mode, where the victim's entire unlocked balance would be transferred to the attacker's address. The vulnerability was caused by improper validation of the "tx_amount" parameter in the external "monero://" URI handler, which…

👉 Read full report

Windows installer grants low-privileged users write access to executable P2Pool directory, enabling local code execution

🔹 Severity: High
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Monero
🔹 Reported By: qttps
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 11:47pm (UTC)
🐞 Source: HackerOne

A Windows installer for the Monero GUI wallet created a subdirectory for P2Pool with overly broad write permissions for low-privileged users. The GUI later executed the `p2pool.exe` binary from that directory without any additional integrity checks, allowing a local attacker to plant malicious code that would be executed by the GUI.

👉 Read full report

HTML Injection in Transaction Confirmation Dialog via Address Book Description Enables UI Spoofing Before Fund Transfer

🔹 Severity: Medium
🔹 Weakness: Code Injection
🔹 Reported To: Monero
🔹 Reported By: fg0x0
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 11:49pm (UTC)
🐞 Source: HackerOne

The Monero GUI wallet was found to render address book descriptions as HTML in the transaction confirmation dialog without sanitizing the input. This vulnerability could enable an attacker to craft a malicious Monero URI or QR code, which when added to the victim's address book, would display arbitrary HTML in the confirmation dialog before fund transfer. This could be used to spoof the recipient's details and…

👉 Read full report

View-only offline transaction creation bypasses the long-payment-ID privacy block

🔹 Severity: Medium
🔹 Weakness: Information Disclosure
🔹 Reported To: Monero
🔹 Reported By: qttps
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 11:49pm (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in the monero-gui wallet software where the view-only offline transaction creation process did not enforce the same protection against long payment IDs as the normal online transaction sending process. This allowed a malicious payment request to include a standalone payment ID, which could then be included in an unsigned offline transaction, potentially exposing the user's transaction…

👉 Read full report

Monero GUI OpenAlias DNSSEC-invalid resolution still writes spoofable address into recipient field

🔹 Severity: Medium
🔹 Reported To: Monero
🔹 Reported By: lilpeko
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 11:51pm (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in the Monero GUI that could allow an attacker to spoof the recipient address for a transaction. The vulnerability was caused by the GUI writing a potentially spoofed address to the recipient field, even when DNSSEC validation failed during an OpenAlias resolution. This could result in funds being sent to an attacker-controlled address if the user proceeded with the transaction.

👉 Read full report

Domainless COOKIEFILE cookie leaks to unrelated IP-literal hosts

🔹 Severity: No Rating
🔹 Weakness: Information Exposure Through Sent Data
🔹 Reported To: curl
🔹 Reported By: accl
🔹 State: ⚪️ Informative
🔹 Disclosed: August 21, 2026, 6:32am (UTC)
🐞 Source: HackerOne

👉 Read full report

Path Traversal in Nextcloud Talk Android Exposes User Credentials and Private Data via FileProvider

🔹 Severity: Medium
🔹 Weakness: Path Traversal
🔹 Reported To: Nextcloud
🔹 Reported By: mirachael
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2026, 1:23am (UTC)
🐞 Source: HackerOne

A vulnerability in Nextcloud Talk Android allowed an external Android app to write and retrieve config files by pinging an internal endpoint.

👉 Read full report

URI scheme validation bypass in ActionText `to_markdown` via user-supplied `<action-text-markdown>` marker tag

🔹 Severity: Medium
🔹 Weakness: Cross-site Scripting (XSS) - Reflected
🔹 Reported To: Ruby on Rails
🔹 Reported By: offsetmd
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2026, 4:21pm (UTC)
🐞 Source: HackerOne

👉 Read full report