Re-entrant `nghttp2_session_mem_send()` during `nghttp2_session_mem_recv()` causes heap-use-after-free in Node.js HTTP/2

🔹 Severity: High
🔹 Weakness: Use After Free
🔹 Reported To: Node.js
🔹 Reported By: hahahkim
🔹 State: 🟢 Resolved
🔹 Disclosed: August 28, 2026, 2:15pm (UTC)
🐞 Source: HackerOne

A flaw was discovered in the Node.js HTTP/2 implementation that allowed the `nghttp2_session_mem_send()` function to be called re-entrantly while `nghttp2_session_mem_recv()` was executing, resulting in a heap-use-after-free vulnerability. This issue affected Node.js versions 26.x, 24.x, and 22.x.

👉 Read full report

node:sqlite SQLTagStore Iterator Replay Lets Attacker Re-Execute Victim-Bound Writes Indefinitely

🔹 Severity: Medium
🔹 Weakness: Time-of-check Time-of-use (TOCTOU) Race Condition
🔹 Reported To: Node.js
🔹 Reported By: cantina-security
🔹 State: 🟢 Resolved
🔹 Disclosed: August 28, 2026, 2:15pm (UTC)
🐞 Source: HackerOne

A flaw was discovered in the node:sqlite package for Node.js that allowed a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it had been reset and rebound with new parameters. The vulnerability was caused by the SQLTagStore feature resetting cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism…

👉 Read full report

dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records

🔹 Severity: Medium
🔹 Weakness: Uncontrolled Resource Consumption
🔹 Reported To: Node.js
🔹 Reported By: cantina-security
🔹 State: 🟢 Resolved
🔹 Disclosed: August 28, 2026, 2:16pm (UTC)
🐞 Source: HackerOne

A flaw in Node.js was discovered where the dns.resolveAny() function aborted the Node.js process when a DNS response contained more than 256 A records.

👉 Read full report

Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected)

🔹 Severity: Medium
🔹 Weakness: Uncontrolled Resource Consumption
🔹 Reported To: Node.js
🔹 Reported By: byvini
🔹 State: 🟢 Resolved
🔹 Disclosed: August 28, 2026, 2:16pm (UTC)
🐞 Source: HackerOne

A flaw was discovered in the synchronous Node.js zlib APIs that allowed a spoofed TypedArray byteLength to trigger a reachable assertion, causing the entire process to crash. All 11 synchronous zlib functions were affected.

👉 Read full report

HTTP Request Smuggling via Silent Header Truncation in Node.js HTTP Parser

🔹 Severity: Low
🔹 Weakness: HTTP Request Smuggling
🔹 Reported To: Node.js
🔹 Reported By: yushengchen
🔹 State: 🟢 Resolved
🔹 Disclosed: August 28, 2026, 2:16pm (UTC)
🐞 Source: HackerOne

A flaw in the Node.js HTTP client was discovered that could cause a request desynchronization for Node.js-based forwarding proxies. The issue was caused by the Node.js HTTP parser omitting headers beyond the configured limit from the visible request headers, while still using those headers internally for HTTP message framing. This vulnerability was found to affect all supported Node.js release lines.

👉 Read full report

Author → stored XSS in wp-admin: unescaped sub-size filename from attachment metadata breaks out of the `src` attribute in `get_media_item()`

🔹 Severity: Critical
🔹 Weakness: Cross-site Scripting (XSS) - Stored
🔹 Reported To: WordPress
🔹 Reported By: jakubk
🔹 State: 🟢 Resolved
🔹 Disclosed: August 28, 2026, 4:38pm (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in the WordPress media upload and finalize endpoints. An author could upload a crafted image with a malicious filename, which was then stored verbatim by the endpoint and rendered without proper escaping in the WordPress admin media library. This could allow the execution of arbitrary JavaScript in the context of an administrator's browser session.

👉 Read full report

Author → arbitrary file deletion anywhere on disk (site takeover) via `POST /wp/v2/media/<id>/finalize` poisoning `_wp_attachment_metadata`

🔹 Severity: Critical
🔹 Weakness: Path Traversal
🔹 Reported To: WordPress
🔹 Reported By: jakubk
🔹 State: 🟢 Resolved
🔹 Disclosed: August 28, 2026, 4:39pm (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in the WordPress media processing functionality. This vulnerability allowed an authenticated author to delete arbitrary files on the server. The vulnerability was caused by insufficient input validation in the `finalize_item()` function, which allowed an attacker to control the file paths stored in the attachment metadata. This resulted in the `wp_delete_attachment_files()` function…

👉 Read full report

Unauthorized vertical privilege escalation vulnerability found on ibm.com endpoint

🔹 Severity: No Rating
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: IBM
🔹 Reported By: inventor0x01
🔹 State: 🟢 Resolved
🔹 Disclosed: August 28, 2026, 6:20pm (UTC)
🐞 Source: HackerOne

A vertical privilege escalation vulnerability was found on an ibm.com endpoint. The vulnerability was reported to IBM, analyzed, and remediated.

👉 Read full report

42: `VMS_STS` macro typo (`< 3` vs `<< 3`) turns curl failures into successful OpenVMS conditions

🔹 Severity: No Rating
🔹 Weakness: Improper Check or Handling of Exceptional Conditions
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: August 29, 2026, 12:48pm (UTC)
🐞 Source: HackerOne

👉 Read full report

50: CMake `HTTP_ONLY` does not disable SSH backends — SCP and SFTP remain usable

🔹 Severity: No Rating
🔹 Weakness: Server-Side Request Forgery (SSRF)
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: August 29, 2026, 12:51pm (UTC)
🐞 Source: HackerOne

👉 Read full report

**Unauthenticated IDOR allows modification of payment customer billing information**

🔹 Severity: High
🔹 Weakness: Insecure Direct Object Reference (IDOR)
🔹 Reported To: Weblate
🔹 Reported By: visionx7
🔹 State: 🟢 Resolved
🔹 Disclosed: August 30, 2026, 4:54am (UTC)
🐞 Source: HackerOne

The application contained an access control issue in the payment billing information edit functionality. An unauthenticated user was able to access the payment edit endpoint and modify the billing information associated with a payment without any authorization check. The issue occurred because the application allowed access to the edit page using only the payment identifier in the URL, and the server did not verify…

👉 Read full report

06: Incomplete fix for CVE-2026-7009: GCC/SecTrust builds silently discard stapled OCSP responses

🔹 Severity: No Rating
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: August 31, 2026, 7:02am (UTC)
🐞 Source: HackerOne

👉 Read full report

41: `main_checkfds()` pipe reuse leaks proxy credentials into HTTPS upload body

🔹 Severity: No Rating
🔹 Weakness: Information Exposure Through Sent Data
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: August 31, 2026, 7:02am (UTC)
🐞 Source: HackerOne

👉 Read full report

33: CONNECT_ONLY raw I/O selects wrong connection after CURLOPT_SHARE detach (incomplete fix for CVE-2020-8231)

🔹 Severity: No Rating
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: August 31, 2026, 7:02am (UTC)
🐞 Source: HackerOne

👉 Read full report

18: Explicit IPv6 proxy zone ID silently ignored — proxy credentials sent to wrong interface

🔹 Severity: No Rating
🔹 Weakness: Information Disclosure
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: August 31, 2026, 7:02am (UTC)
🐞 Source: HackerOne

👉 Read full report

Unauthenticated Create, Read, and Delete of Any User's Data + Email Relay on JPL Hurricane Watch

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: Aman12321
🔹 State: 🟢 Resolved
🔹 Disclosed: September 1, 2026
🐞 Source: Bugcrowd

👉 Read full report

Unauthenticated OS Command Injection (RCE) in NASA International Mass Loading Service CGI (massloading.smce.nasa.gov /cgi-bin/eop_series.py)

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: radithyaputra
🔹 State: 🟢 Resolved
🔹 Disclosed: September 1, 2026
🐞 Source: Bugcrowd

👉 Read full report

DOM-based cross-site scripting through the publicly exposed Cesium Sandcastle shared-code feature

🔹 Severity: Medium
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: iaramsri
🔹 State: 🟢 Resolved
🔹 Disclosed: September 1, 2026
🐞 Source: Bugcrowd

👉 Read full report

Publicly Accessible Administrative Configuration File Exposes Authentication Hashes and Internal Configuration

🔹 Severity: Medium
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: JulienZgh
🔹 State: 🟢 Resolved
🔹 Disclosed: September 1, 2026
🐞 Source: Bugcrowd

👉 Read full report

Impersonation via Broken Link Hijacking on NASA Earth Matters Blog Page

🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: muhammadabdillah64edc3
🔹 State: 🟢 Resolved
🔹 Disclosed: September 1, 2026
🐞 Source: Bugcrowd

👉 Read full report

Ticket Trick Attack allows access to Rockstar Games' workspaces

🔹 Severity: High
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Rockstar Games
🔹 Reported By: recon_ninja
🔹 State: 🟢 Resolved
🔹 Disclosed: September 1, 2026, 7:03pm (UTC)
🐞 Source: HackerOne

A vulnerability, referred to as "Ticket Trick Attack," was discovered in the support portal of Rockstar Games. The vulnerability allowed an attacker to gain unauthorized access to the company's workspaces by creating an account with an email address similar to the official support email address. This was possible because Rockstar Games did not properly validate the ownership of the email address before granting…

👉 Read full report