URGENT: CRITICAL DATA BREACH - Cross-User PHI/PII Leakage via Prompt Injection - Non-malicious discovery

🔹 Severity: Critical
🔹 Reported To: OpenAI
🔹 Reported By: Teringette-adamuzonyi
🔹 State: 🟢 Resolved
🔹 Disclosed: August 19, 2026
🐞 Source: Bugcrowd

👉 Read full report

Stored HTML Injection (CWE-79) via Livechat Visitor Name

🔹 Severity: Low
🔹 Weakness: Cross-site Scripting (XSS) - DOM
🔹 Reported To: Rocket.Chat
🔹 Reported By: hillng
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 7:18pm (UTC)
🐞 Source: HackerOne

👉 Read full report

DDP methods getThreadsList / getThreadMessages leaks private thread content to any authenticated low privilege user (unpatched sibling of #1446767)

🔹 Severity: High
🔹 Weakness: NoSQL Injection
🔹 Reported To: Rocket.Chat
🔹 Reported By: iamaangx028
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 7:54pm (UTC)
🐞 Source: HackerOne

👉 Read full report

Unauthenticated Error-Based SQL Injection via POST Parameter Name in /api/experiment/answer/new/

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: iaramsri
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026
🐞 Source: Bugcrowd

👉 Read full report

Unauthenticated Remote Code Execution in NASA AMMOS AIT-GUI 2.5.0 via /tlm/query file write chained to /script/run code execution

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: ward0
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026
🐞 Source: Bugcrowd

👉 Read full report

Unauthenticated SSRF in NASA Trek addManifest allows internal network access from the Trek server

🔹 Severity: High
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: n0RollBack
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026
🐞 Source: Bugcrowd

👉 Read full report

Unauthorized Access to CI/CD Infrastructure and Project Secrets via Compromised GitLab Runner Token

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: oguzhan_00
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026
🐞 Source: Bugcrowd

👉 Read full report

Loss of multisig funds through single malicious participant's deliberate deception

🔹 Severity: Medium
🔹 Weakness: Business Logic Errors
🔹 Reported To: Monero
🔹 Reported By: k-privacy-enjoyer
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 11:47pm (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in the Monero multisig implementation. A single malicious participant of a multisig could trick other users into sending funds multiple times to a certain recipient, which could not be easily distinguished from a legitimate user action. This issue was caused by the inability to view the inputs of partially signed multisig transactions, and the lack of a mechanism to deliberately…

👉 Read full report

monero:// deeplink parsing accepts tx_amount=(all) and can trigger send-all transaction mode

🔹 Severity: Medium
🔹 Weakness: Business Logic Errors
🔹 Reported To: Monero
🔹 Reported By: qttps
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 11:47pm (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in the Monero GUI wallet application. The vulnerability allowed an attacker to craft a malicious URI that could be used to trigger a "send-all" transaction mode, where the victim's entire unlocked balance would be transferred to the attacker's address. The vulnerability was caused by improper validation of the "tx_amount" parameter in the external "monero://" URI handler, which…

👉 Read full report

Windows installer grants low-privileged users write access to executable P2Pool directory, enabling local code execution

🔹 Severity: High
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Monero
🔹 Reported By: qttps
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 11:47pm (UTC)
🐞 Source: HackerOne

A Windows installer for the Monero GUI wallet created a subdirectory for P2Pool with overly broad write permissions for low-privileged users. The GUI later executed the `p2pool.exe` binary from that directory without any additional integrity checks, allowing a local attacker to plant malicious code that would be executed by the GUI.

👉 Read full report

HTML Injection in Transaction Confirmation Dialog via Address Book Description Enables UI Spoofing Before Fund Transfer

🔹 Severity: Medium
🔹 Weakness: Code Injection
🔹 Reported To: Monero
🔹 Reported By: fg0x0
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 11:49pm (UTC)
🐞 Source: HackerOne

The Monero GUI wallet was found to render address book descriptions as HTML in the transaction confirmation dialog without sanitizing the input. This vulnerability could enable an attacker to craft a malicious Monero URI or QR code, which when added to the victim's address book, would display arbitrary HTML in the confirmation dialog before fund transfer. This could be used to spoof the recipient's details and…

👉 Read full report

View-only offline transaction creation bypasses the long-payment-ID privacy block

🔹 Severity: Medium
🔹 Weakness: Information Disclosure
🔹 Reported To: Monero
🔹 Reported By: qttps
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 11:49pm (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in the monero-gui wallet software where the view-only offline transaction creation process did not enforce the same protection against long payment IDs as the normal online transaction sending process. This allowed a malicious payment request to include a standalone payment ID, which could then be included in an unsigned offline transaction, potentially exposing the user's transaction…

👉 Read full report

Monero GUI OpenAlias DNSSEC-invalid resolution still writes spoofable address into recipient field

🔹 Severity: Medium
🔹 Reported To: Monero
🔹 Reported By: lilpeko
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 11:51pm (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in the Monero GUI that could allow an attacker to spoof the recipient address for a transaction. The vulnerability was caused by the GUI writing a potentially spoofed address to the recipient field, even when DNSSEC validation failed during an OpenAlias resolution. This could result in funds being sent to an attacker-controlled address if the user proceeded with the transaction.

👉 Read full report

Domainless COOKIEFILE cookie leaks to unrelated IP-literal hosts

🔹 Severity: No Rating
🔹 Weakness: Information Exposure Through Sent Data
🔹 Reported To: curl
🔹 Reported By: accl
🔹 State: ⚪️ Informative
🔹 Disclosed: August 21, 2026, 6:32am (UTC)
🐞 Source: HackerOne

👉 Read full report

Path Traversal in Nextcloud Talk Android Exposes User Credentials and Private Data via FileProvider

🔹 Severity: Medium
🔹 Weakness: Path Traversal
🔹 Reported To: Nextcloud
🔹 Reported By: mirachael
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2026, 1:23am (UTC)
🐞 Source: HackerOne

A vulnerability in Nextcloud Talk Android allowed an external Android app to write and retrieve config files by pinging an internal endpoint.

👉 Read full report

URI scheme validation bypass in ActionText `to_markdown` via user-supplied `<action-text-markdown>` marker tag

🔹 Severity: Medium
🔹 Weakness: Cross-site Scripting (XSS) - Reflected
🔹 Reported To: Ruby on Rails
🔹 Reported By: offsetmd
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2026, 4:21pm (UTC)
🐞 Source: HackerOne

👉 Read full report

wolfSSL backend disables hostname verification when CURLOPT_SSL_VERIFYPEER is 0

🔹 Severity: Medium
🔹 Weakness: Improper Validation of Certificate with Host Mismatch
🔹 Reported To: curl
🔹 Reported By: subadevan
🔹 State: 🔴 N/A
🔹 Disclosed: August 24, 2026, 9:51pm (UTC)
🐞 Source: HackerOne

👉 Read full report

RTSP CRLF injection in libcurl allows CURLOPT_RTSP_* values to inject commands into independent sessions

🔹 Severity: Medium
🔹 Weakness: CRLF Injection
🔹 Reported To: curl
🔹 Reported By: subadevan
🔹 State: 🔴 N/A
🔹 Disclosed: August 24, 2026, 9:51pm (UTC)
🐞 Source: HackerOne

👉 Read full report

@jitsi/docker-jitsi-meet: `/colibri-relay-ws/` unsafe nginx regex (OCTO relay configuration)

🔹 Severity: Low
🔹 Weakness: Cross-site Scripting (XSS) - Generic
🔹 Reported To: 8x8
🔹 Reported By: a3z4km3
🔹 State: 🟢 Resolved
🔹 Disclosed: August 25, 2026, 2:09am (UTC)
🐞 Source: HackerOne

An unsafe nginx regex pattern was discovered in the `/colibri-relay-ws/` location of the @jitsi/docker-jitsi-meet project. The regex `[a-zA-Z0-9-\\._]+` accepted arbitrary domain names and IP addresses for proxy_pass directives, allowing unauthenticated requests to be proxied to attacker-specified destinations. The vulnerable nginx location and associated relay WebSocket proxy configuration have been removed.

👉 Read full report

libcurl Digest/NTLM authentication ignores an explicit Authorization header

🔹 Severity: Medium
🔹 Weakness: Incorrect Authorization
🔹 Reported To: curl
🔹 Reported By: subadevan
🔹 State: ⚪️ Informative
🔹 Disclosed: August 25, 2026, 1:26pm (UTC)
🐞 Source: HackerOne

👉 Read full report

TLS session cache case-folds CA paths and bypasses the active trust profile

🔹 Severity: Medium
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: curl
🔹 Reported By: 1rhino2
🔹 State: ⚪️ Informative
🔹 Disclosed: August 25, 2026, 5:21pm (UTC)
🐞 Source: HackerOne

👉 Read full report