Path Traversal in Nextcloud Talk Android Exposes User Credentials and Private Data via FileProvider

🔹 Severity: Medium
🔹 Weakness: Path Traversal
🔹 Reported To: Nextcloud
🔹 Reported By: mirachael
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2026, 1:23am (UTC)
🐞 Source: HackerOne

A vulnerability in Nextcloud Talk Android allowed an external Android app to write and retrieve config files by pinging an internal endpoint.

👉 Read full report

URI scheme validation bypass in ActionText `to_markdown` via user-supplied `<action-text-markdown>` marker tag

🔹 Severity: Medium
🔹 Weakness: Cross-site Scripting (XSS) - Reflected
🔹 Reported To: Ruby on Rails
🔹 Reported By: offsetmd
🔹 State: 🟢 Resolved
🔹 Disclosed: August 24, 2026, 4:21pm (UTC)
🐞 Source: HackerOne

👉 Read full report

wolfSSL backend disables hostname verification when CURLOPT_SSL_VERIFYPEER is 0

🔹 Severity: Medium
🔹 Weakness: Improper Validation of Certificate with Host Mismatch
🔹 Reported To: curl
🔹 Reported By: subadevan
🔹 State: 🔴 N/A
🔹 Disclosed: August 24, 2026, 9:51pm (UTC)
🐞 Source: HackerOne

👉 Read full report

RTSP CRLF injection in libcurl allows CURLOPT_RTSP_* values to inject commands into independent sessions

🔹 Severity: Medium
🔹 Weakness: CRLF Injection
🔹 Reported To: curl
🔹 Reported By: subadevan
🔹 State: 🔴 N/A
🔹 Disclosed: August 24, 2026, 9:51pm (UTC)
🐞 Source: HackerOne

👉 Read full report

@jitsi/docker-jitsi-meet: `/colibri-relay-ws/` unsafe nginx regex (OCTO relay configuration)

🔹 Severity: Low
🔹 Weakness: Cross-site Scripting (XSS) - Generic
🔹 Reported To: 8x8
🔹 Reported By: a3z4km3
🔹 State: 🟢 Resolved
🔹 Disclosed: August 25, 2026, 2:09am (UTC)
🐞 Source: HackerOne

An unsafe nginx regex pattern was discovered in the `/colibri-relay-ws/` location of the @jitsi/docker-jitsi-meet project. The regex `[a-zA-Z0-9-\\._]+` accepted arbitrary domain names and IP addresses for proxy_pass directives, allowing unauthenticated requests to be proxied to attacker-specified destinations. The vulnerable nginx location and associated relay WebSocket proxy configuration have been removed.

👉 Read full report

libcurl Digest/NTLM authentication ignores an explicit Authorization header

🔹 Severity: Medium
🔹 Weakness: Incorrect Authorization
🔹 Reported To: curl
🔹 Reported By: subadevan
🔹 State: ⚪️ Informative
🔹 Disclosed: August 25, 2026, 1:26pm (UTC)
🐞 Source: HackerOne

👉 Read full report

TLS session cache case-folds CA paths and bypasses the active trust profile

🔹 Severity: Medium
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: curl
🔹 Reported By: 1rhino2
🔹 State: ⚪️ Informative
🔹 Disclosed: August 25, 2026, 5:21pm (UTC)
🐞 Source: HackerOne

👉 Read full report

Add labels to arbitrary issues/prs via Memex Bulk Update to compromise github actions label gating

🔹 Severity: Medium
🔹 Weakness: Insecure Direct Object Reference (IDOR)
🔹 Reported To: GitHub
🔹 Reported By: ahacker1
🔹 State: 🟢 Resolved
🔹 Disclosed: August 25, 2026, 9:22pm (UTC)
🐞 Source: HackerOne

A vulnerability was identified in GitHub Enterprise Server that allowed a user with read access to a repository and write access to a project to modify issue and pull request metadata through the project. When adding an item to a project that already existed, column value updates were applied without verifying the actor's repository write permissions.

👉 Read full report

Hidden/restricted tags can be mutated through synonym ID paths without per-tag authorization

🔹 Severity: Medium
🔹 Weakness: Insecure Direct Object Reference (IDOR)
🔹 Reported To: Discourse
🔹 Reported By: ahpuh
🔹 State: 🟢 Resolved
🔹 Disclosed: August 26, 2026, 5:47am (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in Discourse where a non-admin user with tag-editing permission could modify hidden or restricted tags by supplying their numeric IDs to the synonym creation and tag settings endpoints. Although the user could not view the hidden tags, the controller only authorized the visible target tag and did not re-check authorization for each synonym tag ID, allowing the non-admin user to update…

👉 Read full report

curl_share TOCTOU > RCE via Curl_llist _dtor Function Pointer Hijack

🔹 Severity: Critical
🔹 Weakness: Time-of-check Time-of-use (TOCTOU) Race Condition
🔹 Reported To: curl
🔹 Reported By: k4rasu_s4ma
🔹 State: 🔴 N/A
🔹 Disclosed: August 26, 2026, 6:38am (UTC)
🐞 Source: HackerOne

👉 Read full report

Critical SQL Injection WDM API (████████)

🔹 Severity: Critical
🔹 Weakness: SQL Injection
🔹 Reported To: Essity
🔹 Reported By: matty69v
🔹 State: 🟢 Resolved
🔹 Disclosed: August 27, 2026, 7:23am (UTC)
🐞 Source: HackerOne

A boolean-based and time-based blind SQL injection vulnerability was discovered in the searchText query parameter of the GET /api/WDMProduct endpoint. The vulnerability allowed an unauthenticated attacker to read or modify data in the backing Microsoft SQL Server database. The backend was found to be hosted on an Azure App Service and served by the in-scope Angular front-end application.

👉 Read full report

Pre-authentication Stored XSS in Essity Customer-Service Pipeline via ContactApi (reCAPTCHA bypass + no rate limit)

🔹 Severity: Critical
🔹 Weakness: Cross-site Scripting (XSS) - Stored
🔹 Reported To: Essity
🔹 Reported By: matty69v
🔹 State: 🟢 Resolved
🔹 Disclosed: August 27, 2026, 7:35am (UTC)
🐞 Source: HackerOne

A pre-authentication stored cross-site scripting (XSS) vulnerability was discovered in the customer service API of the Essity company. The API accepted unauthenticated ticket submissions with arbitrary HTML/JavaScript in multiple fields, bypassing reCAPTCHA validation, CSRF protection, and rate limiting. When customer service operators viewed these tickets in the Umbraco back-office, the stored XSS executed in…

👉 Read full report

ARG_CLEAR credential scrubbing wipes only UTF-8 copies on Windows Unicode builds

🔹 Severity: Low
🔹 Weakness: Information Disclosure
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: 🔴 N/A
🔹 Disclosed: August 27, 2026, 8:21am (UTC)
🐞 Source: HackerOne

👉 Read full report

Unbound cross-peer HTTP Digest challenge state

🔹 Severity: Medium
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: August 27, 2026, 8:21am (UTC)
🐞 Source: HackerOne

👉 Read full report

Unauthenticated Disclosure of Unpublished / Embargoed

🔹 Severity: Informational
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: 0xPewPew
🔹 State: 🟢 Resolved
🔹 Disclosed: August 27, 2026
🐞 Source: Bugcrowd

👉 Read full report

Stacked --proto modifiers leave denied protocol enabled

🔹 Severity: Low
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: August 28, 2026, 8:22am (UTC)
🐞 Source: HackerOne

👉 Read full report

--etag-save - truncates append-redirected stdout

🔹 Severity: Low
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: August 28, 2026, 8:22am (UTC)
🐞 Source: HackerOne

👉 Read full report

34: `curl_mprintf` reads `double` for documented `long double` conversions — uninitialized value disclosure

🔹 Severity: No Rating
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: August 28, 2026, 9:33am (UTC)
🐞 Source: HackerOne

👉 Read full report

28: HTTP/3 UDP path ignores CURL_SOCKOPT_ALREADY_CONNECTED, reconnects callback-provided socket

🔹 Severity: Low
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: August 28, 2026, 9:33am (UTC)
🐞 Source: HackerOne

👉 Read full report

46: `--libcurl` output carries `--insecure` across `--next` boundaries

🔹 Severity: No Rating
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: August 28, 2026, 1:43pm (UTC)
🐞 Source: HackerOne

👉 Read full report

HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion

🔹 Severity: High
🔹 Weakness: Uncontrolled Resource Consumption
🔹 Reported To: Node.js
🔹 Reported By: leduckhuong
🔹 State: 🟢 Resolved
🔹 Disclosed: August 28, 2026, 2:15pm (UTC)
🐞 Source: HackerOne

A flaw in Node.js HTTP/2 handling was discovered that could cause HTTP/2 retained header blocks to evade the maxSessionMemory setting and enable remote memory exhaustion.

👉 Read full report