Loss of multisig funds through single malicious participant's deliberate deception
🔹 Severity: Medium
🔹 Weakness: Business Logic Errors
🔹 Reported To: Monero
🔹 Reported By: k-privacy-enjoyer
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 11:47pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the Monero multisig implementation. A single malicious participant of a multisig could trick other users into sending funds multiple times to a certain recipient, which could not be easily distinguished from a legitimate user action. This issue was caused by the inability to view the inputs of partially signed multisig transactions, and the lack of a mechanism to deliberately…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Business Logic Errors
🔹 Reported To: Monero
🔹 Reported By: k-privacy-enjoyer
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 11:47pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the Monero multisig implementation. A single malicious participant of a multisig could trick other users into sending funds multiple times to a certain recipient, which could not be easily distinguished from a legitimate user action. This issue was caused by the inability to view the inputs of partially signed multisig transactions, and the lack of a mechanism to deliberately…
👉 Read full report
monero:// deeplink parsing accepts tx_amount=(all) and can trigger send-all transaction mode
🔹 Severity: Medium
🔹 Weakness: Business Logic Errors
🔹 Reported To: Monero
🔹 Reported By: qttps
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 11:47pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the Monero GUI wallet application. The vulnerability allowed an attacker to craft a malicious URI that could be used to trigger a "send-all" transaction mode, where the victim's entire unlocked balance would be transferred to the attacker's address. The vulnerability was caused by improper validation of the "tx_amount" parameter in the external "monero://" URI handler, which…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Business Logic Errors
🔹 Reported To: Monero
🔹 Reported By: qttps
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 11:47pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the Monero GUI wallet application. The vulnerability allowed an attacker to craft a malicious URI that could be used to trigger a "send-all" transaction mode, where the victim's entire unlocked balance would be transferred to the attacker's address. The vulnerability was caused by improper validation of the "tx_amount" parameter in the external "monero://" URI handler, which…
👉 Read full report
Windows installer grants low-privileged users write access to executable P2Pool directory, enabling local code execution
🔹 Severity: High
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Monero
🔹 Reported By: qttps
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 11:47pm (UTC)
🐞 Source: HackerOne
A Windows installer for the Monero GUI wallet created a subdirectory for P2Pool with overly broad write permissions for low-privileged users. The GUI later executed the `p2pool.exe` binary from that directory without any additional integrity checks, allowing a local attacker to plant malicious code that would be executed by the GUI.
👉 Read full report
🔹 Severity: High
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Monero
🔹 Reported By: qttps
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 11:47pm (UTC)
🐞 Source: HackerOne
A Windows installer for the Monero GUI wallet created a subdirectory for P2Pool with overly broad write permissions for low-privileged users. The GUI later executed the `p2pool.exe` binary from that directory without any additional integrity checks, allowing a local attacker to plant malicious code that would be executed by the GUI.
👉 Read full report
HTML Injection in Transaction Confirmation Dialog via Address Book Description Enables UI Spoofing Before Fund Transfer
🔹 Severity: Medium
🔹 Weakness: Code Injection
🔹 Reported To: Monero
🔹 Reported By: fg0x0
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 11:49pm (UTC)
🐞 Source: HackerOne
The Monero GUI wallet was found to render address book descriptions as HTML in the transaction confirmation dialog without sanitizing the input. This vulnerability could enable an attacker to craft a malicious Monero URI or QR code, which when added to the victim's address book, would display arbitrary HTML in the confirmation dialog before fund transfer. This could be used to spoof the recipient's details and…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Code Injection
🔹 Reported To: Monero
🔹 Reported By: fg0x0
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 11:49pm (UTC)
🐞 Source: HackerOne
The Monero GUI wallet was found to render address book descriptions as HTML in the transaction confirmation dialog without sanitizing the input. This vulnerability could enable an attacker to craft a malicious Monero URI or QR code, which when added to the victim's address book, would display arbitrary HTML in the confirmation dialog before fund transfer. This could be used to spoof the recipient's details and…
👉 Read full report
View-only offline transaction creation bypasses the long-payment-ID privacy block
🔹 Severity: Medium
🔹 Weakness: Information Disclosure
🔹 Reported To: Monero
🔹 Reported By: qttps
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 11:49pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the monero-gui wallet software where the view-only offline transaction creation process did not enforce the same protection against long payment IDs as the normal online transaction sending process. This allowed a malicious payment request to include a standalone payment ID, which could then be included in an unsigned offline transaction, potentially exposing the user's transaction…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Information Disclosure
🔹 Reported To: Monero
🔹 Reported By: qttps
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 11:49pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the monero-gui wallet software where the view-only offline transaction creation process did not enforce the same protection against long payment IDs as the normal online transaction sending process. This allowed a malicious payment request to include a standalone payment ID, which could then be included in an unsigned offline transaction, potentially exposing the user's transaction…
👉 Read full report
Monero GUI OpenAlias DNSSEC-invalid resolution still writes spoofable address into recipient field
🔹 Severity: Medium
🔹 Reported To: Monero
🔹 Reported By: lilpeko
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 11:51pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the Monero GUI that could allow an attacker to spoof the recipient address for a transaction. The vulnerability was caused by the GUI writing a potentially spoofed address to the recipient field, even when DNSSEC validation failed during an OpenAlias resolution. This could result in funds being sent to an attacker-controlled address if the user proceeded with the transaction.
👉 Read full report
🔹 Severity: Medium
🔹 Reported To: Monero
🔹 Reported By: lilpeko
🔹 State: 🟢 Resolved
🔹 Disclosed: August 20, 2026, 11:51pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the Monero GUI that could allow an attacker to spoof the recipient address for a transaction. The vulnerability was caused by the GUI writing a potentially spoofed address to the recipient field, even when DNSSEC validation failed during an OpenAlias resolution. This could result in funds being sent to an attacker-controlled address if the user proceeded with the transaction.
👉 Read full report
Domainless COOKIEFILE cookie leaks to unrelated IP-literal hosts
🔹 Severity: No Rating
🔹 Weakness: Information Exposure Through Sent Data
🔹 Reported To: curl
🔹 Reported By: accl
🔹 State: ⚪️ Informative
🔹 Disclosed: August 21, 2026, 6:32am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: No Rating
🔹 Weakness: Information Exposure Through Sent Data
🔹 Reported To: curl
🔹 Reported By: accl
🔹 State: ⚪️ Informative
🔹 Disclosed: August 21, 2026, 6:32am (UTC)
🐞 Source: HackerOne
👉 Read full report
Path Traversal in Nextcloud Talk Android Exposes User Credentials and Private Data via FileProvider
🔹 Severity: Medium
🔹 Weakness: Path Traversal
🔹 Reported To: Nextcloud
🔹 Reported By: mirachael
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2026, 1:23am (UTC)
🐞 Source: HackerOne
A vulnerability in Nextcloud Talk Android allowed an external Android app to write and retrieve config files by pinging an internal endpoint.
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Path Traversal
🔹 Reported To: Nextcloud
🔹 Reported By: mirachael
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2026, 1:23am (UTC)
🐞 Source: HackerOne
A vulnerability in Nextcloud Talk Android allowed an external Android app to write and retrieve config files by pinging an internal endpoint.
👉 Read full report
URI scheme validation bypass in ActionText `to_markdown` via user-supplied `<action-text-markdown>` marker tag
🔹 Severity: Medium
🔹 Weakness: Cross-site Scripting (XSS) - Reflected
🔹 Reported To: Ruby on Rails
🔹 Reported By: offsetmd
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2026, 4:21pm (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Cross-site Scripting (XSS) - Reflected
🔹 Reported To: Ruby on Rails
🔹 Reported By: offsetmd
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2026, 4:21pm (UTC)
🐞 Source: HackerOne
👉 Read full report
wolfSSL backend disables hostname verification when CURLOPT_SSL_VERIFYPEER is 0
🔹 Severity: Medium
🔹 Weakness: Improper Validation of Certificate with Host Mismatch
🔹 Reported To: curl
🔹 Reported By: subadevan
🔹 State: 🔴 N/A
🔹 Disclosed: August 24, 2026, 9:51pm (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Improper Validation of Certificate with Host Mismatch
🔹 Reported To: curl
🔹 Reported By: subadevan
🔹 State: 🔴 N/A
🔹 Disclosed: August 24, 2026, 9:51pm (UTC)
🐞 Source: HackerOne
👉 Read full report
RTSP CRLF injection in libcurl allows CURLOPT_RTSP_* values to inject commands into independent sessions
🔹 Severity: Medium
🔹 Weakness: CRLF Injection
🔹 Reported To: curl
🔹 Reported By: subadevan
🔹 State: 🔴 N/A
🔹 Disclosed: August 24, 2026, 9:51pm (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: CRLF Injection
🔹 Reported To: curl
🔹 Reported By: subadevan
🔹 State: 🔴 N/A
🔹 Disclosed: August 24, 2026, 9:51pm (UTC)
🐞 Source: HackerOne
👉 Read full report
@jitsi/docker-jitsi-meet: `/colibri-relay-ws/` unsafe nginx regex (OCTO relay configuration)
🔹 Severity: Low
🔹 Weakness: Cross-site Scripting (XSS) - Generic
🔹 Reported To: 8x8
🔹 Reported By: a3z4km3
🔹 State: 🟢 Resolved
🔹 Disclosed: August 25, 2026, 2:09am (UTC)
🐞 Source: HackerOne
An unsafe nginx regex pattern was discovered in the `/colibri-relay-ws/` location of the @jitsi/docker-jitsi-meet project. The regex `[a-zA-Z0-9-\\._]+` accepted arbitrary domain names and IP addresses for proxy_pass directives, allowing unauthenticated requests to be proxied to attacker-specified destinations. The vulnerable nginx location and associated relay WebSocket proxy configuration have been removed.
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Cross-site Scripting (XSS) - Generic
🔹 Reported To: 8x8
🔹 Reported By: a3z4km3
🔹 State: 🟢 Resolved
🔹 Disclosed: August 25, 2026, 2:09am (UTC)
🐞 Source: HackerOne
An unsafe nginx regex pattern was discovered in the `/colibri-relay-ws/` location of the @jitsi/docker-jitsi-meet project. The regex `[a-zA-Z0-9-\\._]+` accepted arbitrary domain names and IP addresses for proxy_pass directives, allowing unauthenticated requests to be proxied to attacker-specified destinations. The vulnerable nginx location and associated relay WebSocket proxy configuration have been removed.
👉 Read full report
libcurl Digest/NTLM authentication ignores an explicit Authorization header
🔹 Severity: Medium
🔹 Weakness: Incorrect Authorization
🔹 Reported To: curl
🔹 Reported By: subadevan
🔹 State: ⚪️ Informative
🔹 Disclosed: August 25, 2026, 1:26pm (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Incorrect Authorization
🔹 Reported To: curl
🔹 Reported By: subadevan
🔹 State: ⚪️ Informative
🔹 Disclosed: August 25, 2026, 1:26pm (UTC)
🐞 Source: HackerOne
👉 Read full report
TLS session cache case-folds CA paths and bypasses the active trust profile
🔹 Severity: Medium
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: curl
🔹 Reported By: 1rhino2
🔹 State: ⚪️ Informative
🔹 Disclosed: August 25, 2026, 5:21pm (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: curl
🔹 Reported By: 1rhino2
🔹 State: ⚪️ Informative
🔹 Disclosed: August 25, 2026, 5:21pm (UTC)
🐞 Source: HackerOne
👉 Read full report
Add labels to arbitrary issues/prs via Memex Bulk Update to compromise github actions label gating
🔹 Severity: Medium
🔹 Weakness: Insecure Direct Object Reference (IDOR)
🔹 Reported To: GitHub
🔹 Reported By: ahacker1
🔹 State: 🟢 Resolved
🔹 Disclosed: August 25, 2026, 9:22pm (UTC)
🐞 Source: HackerOne
A vulnerability was identified in GitHub Enterprise Server that allowed a user with read access to a repository and write access to a project to modify issue and pull request metadata through the project. When adding an item to a project that already existed, column value updates were applied without verifying the actor's repository write permissions.
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Insecure Direct Object Reference (IDOR)
🔹 Reported To: GitHub
🔹 Reported By: ahacker1
🔹 State: 🟢 Resolved
🔹 Disclosed: August 25, 2026, 9:22pm (UTC)
🐞 Source: HackerOne
A vulnerability was identified in GitHub Enterprise Server that allowed a user with read access to a repository and write access to a project to modify issue and pull request metadata through the project. When adding an item to a project that already existed, column value updates were applied without verifying the actor's repository write permissions.
👉 Read full report
Hidden/restricted tags can be mutated through synonym ID paths without per-tag authorization
🔹 Severity: Medium
🔹 Weakness: Insecure Direct Object Reference (IDOR)
🔹 Reported To: Discourse
🔹 Reported By: ahpuh
🔹 State: 🟢 Resolved
🔹 Disclosed: August 26, 2026, 5:47am (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in Discourse where a non-admin user with tag-editing permission could modify hidden or restricted tags by supplying their numeric IDs to the synonym creation and tag settings endpoints. Although the user could not view the hidden tags, the controller only authorized the visible target tag and did not re-check authorization for each synonym tag ID, allowing the non-admin user to update…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Insecure Direct Object Reference (IDOR)
🔹 Reported To: Discourse
🔹 Reported By: ahpuh
🔹 State: 🟢 Resolved
🔹 Disclosed: August 26, 2026, 5:47am (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in Discourse where a non-admin user with tag-editing permission could modify hidden or restricted tags by supplying their numeric IDs to the synonym creation and tag settings endpoints. Although the user could not view the hidden tags, the controller only authorized the visible target tag and did not re-check authorization for each synonym tag ID, allowing the non-admin user to update…
👉 Read full report
curl_share TOCTOU > RCE via Curl_llist _dtor Function Pointer Hijack
🔹 Severity: Critical
🔹 Weakness: Time-of-check Time-of-use (TOCTOU) Race Condition
🔹 Reported To: curl
🔹 Reported By: k4rasu_s4ma
🔹 State: 🔴 N/A
🔹 Disclosed: August 26, 2026, 6:38am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Critical
🔹 Weakness: Time-of-check Time-of-use (TOCTOU) Race Condition
🔹 Reported To: curl
🔹 Reported By: k4rasu_s4ma
🔹 State: 🔴 N/A
🔹 Disclosed: August 26, 2026, 6:38am (UTC)
🐞 Source: HackerOne
👉 Read full report
Critical SQL Injection WDM API (████████)
🔹 Severity: Critical
🔹 Weakness: SQL Injection
🔹 Reported To: Essity
🔹 Reported By: matty69v
🔹 State: 🟢 Resolved
🔹 Disclosed: August 27, 2026, 7:23am (UTC)
🐞 Source: HackerOne
A boolean-based and time-based blind SQL injection vulnerability was discovered in the searchText query parameter of the GET /api/WDMProduct endpoint. The vulnerability allowed an unauthenticated attacker to read or modify data in the backing Microsoft SQL Server database. The backend was found to be hosted on an Azure App Service and served by the in-scope Angular front-end application.
👉 Read full report
🔹 Severity: Critical
🔹 Weakness: SQL Injection
🔹 Reported To: Essity
🔹 Reported By: matty69v
🔹 State: 🟢 Resolved
🔹 Disclosed: August 27, 2026, 7:23am (UTC)
🐞 Source: HackerOne
A boolean-based and time-based blind SQL injection vulnerability was discovered in the searchText query parameter of the GET /api/WDMProduct endpoint. The vulnerability allowed an unauthenticated attacker to read or modify data in the backing Microsoft SQL Server database. The backend was found to be hosted on an Azure App Service and served by the in-scope Angular front-end application.
👉 Read full report
Pre-authentication Stored XSS in Essity Customer-Service Pipeline via ContactApi (reCAPTCHA bypass + no rate limit)
🔹 Severity: Critical
🔹 Weakness: Cross-site Scripting (XSS) - Stored
🔹 Reported To: Essity
🔹 Reported By: matty69v
🔹 State: 🟢 Resolved
🔹 Disclosed: August 27, 2026, 7:35am (UTC)
🐞 Source: HackerOne
A pre-authentication stored cross-site scripting (XSS) vulnerability was discovered in the customer service API of the Essity company. The API accepted unauthenticated ticket submissions with arbitrary HTML/JavaScript in multiple fields, bypassing reCAPTCHA validation, CSRF protection, and rate limiting. When customer service operators viewed these tickets in the Umbraco back-office, the stored XSS executed in…
👉 Read full report
🔹 Severity: Critical
🔹 Weakness: Cross-site Scripting (XSS) - Stored
🔹 Reported To: Essity
🔹 Reported By: matty69v
🔹 State: 🟢 Resolved
🔹 Disclosed: August 27, 2026, 7:35am (UTC)
🐞 Source: HackerOne
A pre-authentication stored cross-site scripting (XSS) vulnerability was discovered in the customer service API of the Essity company. The API accepted unauthenticated ticket submissions with arbitrary HTML/JavaScript in multiple fields, bypassing reCAPTCHA validation, CSRF protection, and rate limiting. When customer service operators viewed these tickets in the Umbraco back-office, the stored XSS executed in…
👉 Read full report
ARG_CLEAR credential scrubbing wipes only UTF-8 copies on Windows Unicode builds
🔹 Severity: Low
🔹 Weakness: Information Disclosure
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: 🔴 N/A
🔹 Disclosed: August 27, 2026, 8:21am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Information Disclosure
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: 🔴 N/A
🔹 Disclosed: August 27, 2026, 8:21am (UTC)
🐞 Source: HackerOne
👉 Read full report
Unbound cross-peer HTTP Digest challenge state
🔹 Severity: Medium
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: August 27, 2026, 8:21am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Medium
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: August 27, 2026, 8:21am (UTC)
🐞 Source: HackerOne
👉 Read full report