Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected)

🔹 Severity: Medium
🔹 Weakness: Uncontrolled Resource Consumption
🔹 Reported To: Node.js
🔹 Reported By: byvini
🔹 State: 🟢 Resolved
🔹 Disclosed: August 28, 2026, 2:16pm (UTC)
🐞 Source: HackerOne

A flaw was discovered in the synchronous Node.js zlib APIs that allowed a spoofed TypedArray byteLength to trigger a reachable assertion, causing the entire process to crash. All 11 synchronous zlib functions were affected.

👉 Read full report

HTTP Request Smuggling via Silent Header Truncation in Node.js HTTP Parser

🔹 Severity: Low
🔹 Weakness: HTTP Request Smuggling
🔹 Reported To: Node.js
🔹 Reported By: yushengchen
🔹 State: 🟢 Resolved
🔹 Disclosed: August 28, 2026, 2:16pm (UTC)
🐞 Source: HackerOne

A flaw in the Node.js HTTP client was discovered that could cause a request desynchronization for Node.js-based forwarding proxies. The issue was caused by the Node.js HTTP parser omitting headers beyond the configured limit from the visible request headers, while still using those headers internally for HTTP message framing. This vulnerability was found to affect all supported Node.js release lines.

👉 Read full report

Author → stored XSS in wp-admin: unescaped sub-size filename from attachment metadata breaks out of the `src` attribute in `get_media_item()`

🔹 Severity: Critical
🔹 Weakness: Cross-site Scripting (XSS) - Stored
🔹 Reported To: WordPress
🔹 Reported By: jakubk
🔹 State: 🟢 Resolved
🔹 Disclosed: August 28, 2026, 4:38pm (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in the WordPress media upload and finalize endpoints. An author could upload a crafted image with a malicious filename, which was then stored verbatim by the endpoint and rendered without proper escaping in the WordPress admin media library. This could allow the execution of arbitrary JavaScript in the context of an administrator's browser session.

👉 Read full report

Author → arbitrary file deletion anywhere on disk (site takeover) via `POST /wp/v2/media/<id>/finalize` poisoning `_wp_attachment_metadata`

🔹 Severity: Critical
🔹 Weakness: Path Traversal
🔹 Reported To: WordPress
🔹 Reported By: jakubk
🔹 State: 🟢 Resolved
🔹 Disclosed: August 28, 2026, 4:39pm (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in the WordPress media processing functionality. This vulnerability allowed an authenticated author to delete arbitrary files on the server. The vulnerability was caused by insufficient input validation in the `finalize_item()` function, which allowed an attacker to control the file paths stored in the attachment metadata. This resulted in the `wp_delete_attachment_files()` function…

👉 Read full report

Unauthorized vertical privilege escalation vulnerability found on ibm.com endpoint

🔹 Severity: No Rating
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: IBM
🔹 Reported By: inventor0x01
🔹 State: 🟢 Resolved
🔹 Disclosed: August 28, 2026, 6:20pm (UTC)
🐞 Source: HackerOne

A vertical privilege escalation vulnerability was found on an ibm.com endpoint. The vulnerability was reported to IBM, analyzed, and remediated.

👉 Read full report

42: `VMS_STS` macro typo (`< 3` vs `<< 3`) turns curl failures into successful OpenVMS conditions

🔹 Severity: No Rating
🔹 Weakness: Improper Check or Handling of Exceptional Conditions
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: August 29, 2026, 12:48pm (UTC)
🐞 Source: HackerOne

👉 Read full report

50: CMake `HTTP_ONLY` does not disable SSH backends — SCP and SFTP remain usable

🔹 Severity: No Rating
🔹 Weakness: Server-Side Request Forgery (SSRF)
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: August 29, 2026, 12:51pm (UTC)
🐞 Source: HackerOne

👉 Read full report

**Unauthenticated IDOR allows modification of payment customer billing information**

🔹 Severity: High
🔹 Weakness: Insecure Direct Object Reference (IDOR)
🔹 Reported To: Weblate
🔹 Reported By: visionx7
🔹 State: 🟢 Resolved
🔹 Disclosed: August 30, 2026, 4:54am (UTC)
🐞 Source: HackerOne

The application contained an access control issue in the payment billing information edit functionality. An unauthenticated user was able to access the payment edit endpoint and modify the billing information associated with a payment without any authorization check. The issue occurred because the application allowed access to the edit page using only the payment identifier in the URL, and the server did not verify…

👉 Read full report

06: Incomplete fix for CVE-2026-7009: GCC/SecTrust builds silently discard stapled OCSP responses

🔹 Severity: No Rating
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: August 31, 2026, 7:02am (UTC)
🐞 Source: HackerOne

👉 Read full report

41: `main_checkfds()` pipe reuse leaks proxy credentials into HTTPS upload body

🔹 Severity: No Rating
🔹 Weakness: Information Exposure Through Sent Data
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: August 31, 2026, 7:02am (UTC)
🐞 Source: HackerOne

👉 Read full report

33: CONNECT_ONLY raw I/O selects wrong connection after CURLOPT_SHARE detach (incomplete fix for CVE-2020-8231)

🔹 Severity: No Rating
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: August 31, 2026, 7:02am (UTC)
🐞 Source: HackerOne

👉 Read full report

18: Explicit IPv6 proxy zone ID silently ignored — proxy credentials sent to wrong interface

🔹 Severity: No Rating
🔹 Weakness: Information Disclosure
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: August 31, 2026, 7:02am (UTC)
🐞 Source: HackerOne

👉 Read full report

Unauthenticated Create, Read, and Delete of Any User's Data + Email Relay on JPL Hurricane Watch

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: Aman12321
🔹 State: 🟢 Resolved
🔹 Disclosed: September 1, 2026
🐞 Source: Bugcrowd

👉 Read full report

Unauthenticated OS Command Injection (RCE) in NASA International Mass Loading Service CGI (massloading.smce.nasa.gov /cgi-bin/eop_series.py)

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: radithyaputra
🔹 State: 🟢 Resolved
🔹 Disclosed: September 1, 2026
🐞 Source: Bugcrowd

👉 Read full report

DOM-based cross-site scripting through the publicly exposed Cesium Sandcastle shared-code feature

🔹 Severity: Medium
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: iaramsri
🔹 State: 🟢 Resolved
🔹 Disclosed: September 1, 2026
🐞 Source: Bugcrowd

👉 Read full report

Publicly Accessible Administrative Configuration File Exposes Authentication Hashes and Internal Configuration

🔹 Severity: Medium
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: JulienZgh
🔹 State: 🟢 Resolved
🔹 Disclosed: September 1, 2026
🐞 Source: Bugcrowd

👉 Read full report

Impersonation via Broken Link Hijacking on NASA Earth Matters Blog Page

🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: muhammadabdillah64edc3
🔹 State: 🟢 Resolved
🔹 Disclosed: September 1, 2026
🐞 Source: Bugcrowd

👉 Read full report

Ticket Trick Attack allows access to Rockstar Games' workspaces

🔹 Severity: High
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Rockstar Games
🔹 Reported By: recon_ninja
🔹 State: 🟢 Resolved
🔹 Disclosed: September 1, 2026, 7:03pm (UTC)
🐞 Source: HackerOne

A vulnerability, referred to as "Ticket Trick Attack," was discovered in the support portal of Rockstar Games. The vulnerability allowed an attacker to gain unauthorized access to the company's workspaces by creating an account with an email address similar to the official support email address. This was possible because Rockstar Games did not properly validate the ownership of the email address before granting…

👉 Read full report

connect.8x8.com: Deserialization Vulnerability in Automation Builder via Jint→Newtonsoft serializer coercion (TypeNameHandling)

🔹 Severity: Critical | 💰 3,000 USD
🔹 Weakness: Deserialization of Untrusted Data
🔹 Reported To: 8x8
🔹 Reported By: kyotozzx
🔹 State: 🟢 Resolved
🔹 Disclosed: September 1, 2026, 11:51pm (UTC)
🐞 Source: HackerOne

A deserialization vulnerability was reported in the 8x8 Connect Automation Builder's HTTP request step. The vulnerability occurred when server-side template evaluation exposed Newtonsoft JSON objects directly to the Jint JavaScript engine. By providing a specially crafted JSON response, an authenticated user could coerce Jint's overload resolution to construct a `JsonSerializer` with attacker-controlled…

👉 Read full report

connect.8x8.com: Automation Builder - Input Validation Issue in Workflow Step Outputs

🔹 Severity: High | 💰 1,337 USD
🔹 Weakness: External Control of Critical State Data
🔹 Reported To: 8x8
🔹 Reported By: kyotozzx
🔹 State: 🟢 Resolved
🔹 Disclosed: September 2, 2026, 12:03am (UTC)
🐞 Source: HackerOne

An input validation issue was reported in the 8x8 Connect Automation Builder's API where workflow step output field names were not validated against reserved context variable names. The issue was addressed by implementing validation to reject reserved field names at workflow creation.

👉 Read full report

07: GnuTLS 0-RTT early data bypasses file-backed public-key pin verification

🔹 Severity: No Rating
🔹 Weakness: Information Disclosure
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: 🔴 N/A
🔹 Disclosed: September 2, 2026, 7:18am (UTC)
🐞 Source: HackerOne

👉 Read full report