Hidden/restricted tags can be mutated through synonym ID paths without per-tag authorization

🔹 Severity: Medium
🔹 Weakness: Insecure Direct Object Reference (IDOR)
🔹 Reported To: Discourse
🔹 Reported By: ahpuh
🔹 State: 🟢 Resolved
🔹 Disclosed: August 26, 2026, 5:47am (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in Discourse where a non-admin user with tag-editing permission could modify hidden or restricted tags by supplying their numeric IDs to the synonym creation and tag settings endpoints. Although the user could not view the hidden tags, the controller only authorized the visible target tag and did not re-check authorization for each synonym tag ID, allowing the non-admin user to update…

👉 Read full report

curl_share TOCTOU > RCE via Curl_llist _dtor Function Pointer Hijack

🔹 Severity: Critical
🔹 Weakness: Time-of-check Time-of-use (TOCTOU) Race Condition
🔹 Reported To: curl
🔹 Reported By: k4rasu_s4ma
🔹 State: 🔴 N/A
🔹 Disclosed: August 26, 2026, 6:38am (UTC)
🐞 Source: HackerOne

👉 Read full report

Critical SQL Injection WDM API (████████)

🔹 Severity: Critical
🔹 Weakness: SQL Injection
🔹 Reported To: Essity
🔹 Reported By: matty69v
🔹 State: 🟢 Resolved
🔹 Disclosed: August 27, 2026, 7:23am (UTC)
🐞 Source: HackerOne

A boolean-based and time-based blind SQL injection vulnerability was discovered in the searchText query parameter of the GET /api/WDMProduct endpoint. The vulnerability allowed an unauthenticated attacker to read or modify data in the backing Microsoft SQL Server database. The backend was found to be hosted on an Azure App Service and served by the in-scope Angular front-end application.

👉 Read full report

Pre-authentication Stored XSS in Essity Customer-Service Pipeline via ContactApi (reCAPTCHA bypass + no rate limit)

🔹 Severity: Critical
🔹 Weakness: Cross-site Scripting (XSS) - Stored
🔹 Reported To: Essity
🔹 Reported By: matty69v
🔹 State: 🟢 Resolved
🔹 Disclosed: August 27, 2026, 7:35am (UTC)
🐞 Source: HackerOne

A pre-authentication stored cross-site scripting (XSS) vulnerability was discovered in the customer service API of the Essity company. The API accepted unauthenticated ticket submissions with arbitrary HTML/JavaScript in multiple fields, bypassing reCAPTCHA validation, CSRF protection, and rate limiting. When customer service operators viewed these tickets in the Umbraco back-office, the stored XSS executed in…

👉 Read full report

ARG_CLEAR credential scrubbing wipes only UTF-8 copies on Windows Unicode builds

🔹 Severity: Low
🔹 Weakness: Information Disclosure
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: 🔴 N/A
🔹 Disclosed: August 27, 2026, 8:21am (UTC)
🐞 Source: HackerOne

👉 Read full report

Unbound cross-peer HTTP Digest challenge state

🔹 Severity: Medium
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: August 27, 2026, 8:21am (UTC)
🐞 Source: HackerOne

👉 Read full report

Unauthenticated Disclosure of Unpublished / Embargoed

🔹 Severity: Informational
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: 0xPewPew
🔹 State: 🟢 Resolved
🔹 Disclosed: August 27, 2026
🐞 Source: Bugcrowd

👉 Read full report

Stacked --proto modifiers leave denied protocol enabled

🔹 Severity: Low
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: August 28, 2026, 8:22am (UTC)
🐞 Source: HackerOne

👉 Read full report

--etag-save - truncates append-redirected stdout

🔹 Severity: Low
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: August 28, 2026, 8:22am (UTC)
🐞 Source: HackerOne

👉 Read full report

34: `curl_mprintf` reads `double` for documented `long double` conversions — uninitialized value disclosure

🔹 Severity: No Rating
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: August 28, 2026, 9:33am (UTC)
🐞 Source: HackerOne

👉 Read full report

28: HTTP/3 UDP path ignores CURL_SOCKOPT_ALREADY_CONNECTED, reconnects callback-provided socket

🔹 Severity: Low
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: August 28, 2026, 9:33am (UTC)
🐞 Source: HackerOne

👉 Read full report

46: `--libcurl` output carries `--insecure` across `--next` boundaries

🔹 Severity: No Rating
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: August 28, 2026, 1:43pm (UTC)
🐞 Source: HackerOne

👉 Read full report

HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion

🔹 Severity: High
🔹 Weakness: Uncontrolled Resource Consumption
🔹 Reported To: Node.js
🔹 Reported By: leduckhuong
🔹 State: 🟢 Resolved
🔹 Disclosed: August 28, 2026, 2:15pm (UTC)
🐞 Source: HackerOne

A flaw in Node.js HTTP/2 handling was discovered that could cause HTTP/2 retained header blocks to evade the maxSessionMemory setting and enable remote memory exhaustion.

👉 Read full report

Re-entrant `nghttp2_session_mem_send()` during `nghttp2_session_mem_recv()` causes heap-use-after-free in Node.js HTTP/2

🔹 Severity: High
🔹 Weakness: Use After Free
🔹 Reported To: Node.js
🔹 Reported By: hahahkim
🔹 State: 🟢 Resolved
🔹 Disclosed: August 28, 2026, 2:15pm (UTC)
🐞 Source: HackerOne

A flaw was discovered in the Node.js HTTP/2 implementation that allowed the `nghttp2_session_mem_send()` function to be called re-entrantly while `nghttp2_session_mem_recv()` was executing, resulting in a heap-use-after-free vulnerability. This issue affected Node.js versions 26.x, 24.x, and 22.x.

👉 Read full report

node:sqlite SQLTagStore Iterator Replay Lets Attacker Re-Execute Victim-Bound Writes Indefinitely

🔹 Severity: Medium
🔹 Weakness: Time-of-check Time-of-use (TOCTOU) Race Condition
🔹 Reported To: Node.js
🔹 Reported By: cantina-security
🔹 State: 🟢 Resolved
🔹 Disclosed: August 28, 2026, 2:15pm (UTC)
🐞 Source: HackerOne

A flaw was discovered in the node:sqlite package for Node.js that allowed a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it had been reset and rebound with new parameters. The vulnerability was caused by the SQLTagStore feature resetting cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism…

👉 Read full report

dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records

🔹 Severity: Medium
🔹 Weakness: Uncontrolled Resource Consumption
🔹 Reported To: Node.js
🔹 Reported By: cantina-security
🔹 State: 🟢 Resolved
🔹 Disclosed: August 28, 2026, 2:16pm (UTC)
🐞 Source: HackerOne

A flaw in Node.js was discovered where the dns.resolveAny() function aborted the Node.js process when a DNS response contained more than 256 A records.

👉 Read full report

Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected)

🔹 Severity: Medium
🔹 Weakness: Uncontrolled Resource Consumption
🔹 Reported To: Node.js
🔹 Reported By: byvini
🔹 State: 🟢 Resolved
🔹 Disclosed: August 28, 2026, 2:16pm (UTC)
🐞 Source: HackerOne

A flaw was discovered in the synchronous Node.js zlib APIs that allowed a spoofed TypedArray byteLength to trigger a reachable assertion, causing the entire process to crash. All 11 synchronous zlib functions were affected.

👉 Read full report

HTTP Request Smuggling via Silent Header Truncation in Node.js HTTP Parser

🔹 Severity: Low
🔹 Weakness: HTTP Request Smuggling
🔹 Reported To: Node.js
🔹 Reported By: yushengchen
🔹 State: 🟢 Resolved
🔹 Disclosed: August 28, 2026, 2:16pm (UTC)
🐞 Source: HackerOne

A flaw in the Node.js HTTP client was discovered that could cause a request desynchronization for Node.js-based forwarding proxies. The issue was caused by the Node.js HTTP parser omitting headers beyond the configured limit from the visible request headers, while still using those headers internally for HTTP message framing. This vulnerability was found to affect all supported Node.js release lines.

👉 Read full report

Author → stored XSS in wp-admin: unescaped sub-size filename from attachment metadata breaks out of the `src` attribute in `get_media_item()`

🔹 Severity: Critical
🔹 Weakness: Cross-site Scripting (XSS) - Stored
🔹 Reported To: WordPress
🔹 Reported By: jakubk
🔹 State: 🟢 Resolved
🔹 Disclosed: August 28, 2026, 4:38pm (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in the WordPress media upload and finalize endpoints. An author could upload a crafted image with a malicious filename, which was then stored verbatim by the endpoint and rendered without proper escaping in the WordPress admin media library. This could allow the execution of arbitrary JavaScript in the context of an administrator's browser session.

👉 Read full report

Author → arbitrary file deletion anywhere on disk (site takeover) via `POST /wp/v2/media/<id>/finalize` poisoning `_wp_attachment_metadata`

🔹 Severity: Critical
🔹 Weakness: Path Traversal
🔹 Reported To: WordPress
🔹 Reported By: jakubk
🔹 State: 🟢 Resolved
🔹 Disclosed: August 28, 2026, 4:39pm (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in the WordPress media processing functionality. This vulnerability allowed an authenticated author to delete arbitrary files on the server. The vulnerability was caused by insufficient input validation in the `finalize_item()` function, which allowed an attacker to control the file paths stored in the attachment metadata. This resulted in the `wp_delete_attachment_files()` function…

👉 Read full report

Unauthorized vertical privilege escalation vulnerability found on ibm.com endpoint

🔹 Severity: No Rating
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: IBM
🔹 Reported By: inventor0x01
🔹 State: 🟢 Resolved
🔹 Disclosed: August 28, 2026, 6:20pm (UTC)
🐞 Source: HackerOne

A vertical privilege escalation vulnerability was found on an ibm.com endpoint. The vulnerability was reported to IBM, analyzed, and remediated.

👉 Read full report