Author → arbitrary file deletion anywhere on disk (site takeover) via `POST /wp/v2/media/<id>/finalize` poisoning `_wp_attachment_metadata`

🔹 Severity: Critical
🔹 Weakness: Path Traversal
🔹 Reported To: WordPress
🔹 Reported By: jakubk
🔹 State: 🟢 Resolved
🔹 Disclosed: August 28, 2026, 4:39pm (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in the WordPress media processing functionality. This vulnerability allowed an authenticated author to delete arbitrary files on the server. The vulnerability was caused by insufficient input validation in the `finalize_item()` function, which allowed an attacker to control the file paths stored in the attachment metadata. This resulted in the `wp_delete_attachment_files()` function…

👉 Read full report

Unauthorized vertical privilege escalation vulnerability found on ibm.com endpoint

🔹 Severity: No Rating
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: IBM
🔹 Reported By: inventor0x01
🔹 State: 🟢 Resolved
🔹 Disclosed: August 28, 2026, 6:20pm (UTC)
🐞 Source: HackerOne

A vertical privilege escalation vulnerability was found on an ibm.com endpoint. The vulnerability was reported to IBM, analyzed, and remediated.

👉 Read full report

42: `VMS_STS` macro typo (`< 3` vs `<< 3`) turns curl failures into successful OpenVMS conditions

🔹 Severity: No Rating
🔹 Weakness: Improper Check or Handling of Exceptional Conditions
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: August 29, 2026, 12:48pm (UTC)
🐞 Source: HackerOne

👉 Read full report

50: CMake `HTTP_ONLY` does not disable SSH backends — SCP and SFTP remain usable

🔹 Severity: No Rating
🔹 Weakness: Server-Side Request Forgery (SSRF)
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: August 29, 2026, 12:51pm (UTC)
🐞 Source: HackerOne

👉 Read full report

**Unauthenticated IDOR allows modification of payment customer billing information**

🔹 Severity: High
🔹 Weakness: Insecure Direct Object Reference (IDOR)
🔹 Reported To: Weblate
🔹 Reported By: visionx7
🔹 State: 🟢 Resolved
🔹 Disclosed: August 30, 2026, 4:54am (UTC)
🐞 Source: HackerOne

The application contained an access control issue in the payment billing information edit functionality. An unauthenticated user was able to access the payment edit endpoint and modify the billing information associated with a payment without any authorization check. The issue occurred because the application allowed access to the edit page using only the payment identifier in the URL, and the server did not verify…

👉 Read full report

06: Incomplete fix for CVE-2026-7009: GCC/SecTrust builds silently discard stapled OCSP responses

🔹 Severity: No Rating
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: August 31, 2026, 7:02am (UTC)
🐞 Source: HackerOne

👉 Read full report

41: `main_checkfds()` pipe reuse leaks proxy credentials into HTTPS upload body

🔹 Severity: No Rating
🔹 Weakness: Information Exposure Through Sent Data
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: August 31, 2026, 7:02am (UTC)
🐞 Source: HackerOne

👉 Read full report

33: CONNECT_ONLY raw I/O selects wrong connection after CURLOPT_SHARE detach (incomplete fix for CVE-2020-8231)

🔹 Severity: No Rating
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: August 31, 2026, 7:02am (UTC)
🐞 Source: HackerOne

👉 Read full report

18: Explicit IPv6 proxy zone ID silently ignored — proxy credentials sent to wrong interface

🔹 Severity: No Rating
🔹 Weakness: Information Disclosure
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: August 31, 2026, 7:02am (UTC)
🐞 Source: HackerOne

👉 Read full report

Unauthenticated Create, Read, and Delete of Any User's Data + Email Relay on JPL Hurricane Watch

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: Aman12321
🔹 State: 🟢 Resolved
🔹 Disclosed: September 1, 2026
🐞 Source: Bugcrowd

👉 Read full report

Unauthenticated OS Command Injection (RCE) in NASA International Mass Loading Service CGI (massloading.smce.nasa.gov /cgi-bin/eop_series.py)

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: radithyaputra
🔹 State: 🟢 Resolved
🔹 Disclosed: September 1, 2026
🐞 Source: Bugcrowd

👉 Read full report

DOM-based cross-site scripting through the publicly exposed Cesium Sandcastle shared-code feature

🔹 Severity: Medium
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: iaramsri
🔹 State: 🟢 Resolved
🔹 Disclosed: September 1, 2026
🐞 Source: Bugcrowd

👉 Read full report

Publicly Accessible Administrative Configuration File Exposes Authentication Hashes and Internal Configuration

🔹 Severity: Medium
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: JulienZgh
🔹 State: 🟢 Resolved
🔹 Disclosed: September 1, 2026
🐞 Source: Bugcrowd

👉 Read full report

Impersonation via Broken Link Hijacking on NASA Earth Matters Blog Page

🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: muhammadabdillah64edc3
🔹 State: 🟢 Resolved
🔹 Disclosed: September 1, 2026
🐞 Source: Bugcrowd

👉 Read full report

Ticket Trick Attack allows access to Rockstar Games' workspaces

🔹 Severity: High
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Rockstar Games
🔹 Reported By: recon_ninja
🔹 State: 🟢 Resolved
🔹 Disclosed: September 1, 2026, 7:03pm (UTC)
🐞 Source: HackerOne

A vulnerability, referred to as "Ticket Trick Attack," was discovered in the support portal of Rockstar Games. The vulnerability allowed an attacker to gain unauthorized access to the company's workspaces by creating an account with an email address similar to the official support email address. This was possible because Rockstar Games did not properly validate the ownership of the email address before granting…

👉 Read full report

connect.8x8.com: Deserialization Vulnerability in Automation Builder via Jint→Newtonsoft serializer coercion (TypeNameHandling)

🔹 Severity: Critical | 💰 3,000 USD
🔹 Weakness: Deserialization of Untrusted Data
🔹 Reported To: 8x8
🔹 Reported By: kyotozzx
🔹 State: 🟢 Resolved
🔹 Disclosed: September 1, 2026, 11:51pm (UTC)
🐞 Source: HackerOne

A deserialization vulnerability was reported in the 8x8 Connect Automation Builder's HTTP request step. The vulnerability occurred when server-side template evaluation exposed Newtonsoft JSON objects directly to the Jint JavaScript engine. By providing a specially crafted JSON response, an authenticated user could coerce Jint's overload resolution to construct a `JsonSerializer` with attacker-controlled…

👉 Read full report

connect.8x8.com: Automation Builder - Input Validation Issue in Workflow Step Outputs

🔹 Severity: High | 💰 1,337 USD
🔹 Weakness: External Control of Critical State Data
🔹 Reported To: 8x8
🔹 Reported By: kyotozzx
🔹 State: 🟢 Resolved
🔹 Disclosed: September 2, 2026, 12:03am (UTC)
🐞 Source: HackerOne

An input validation issue was reported in the 8x8 Connect Automation Builder's API where workflow step output field names were not validated against reserved context variable names. The issue was addressed by implementing validation to reject reserved field names at workflow creation.

👉 Read full report

07: GnuTLS 0-RTT early data bypasses file-backed public-key pin verification

🔹 Severity: No Rating
🔹 Weakness: Information Disclosure
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: 🔴 N/A
🔹 Disclosed: September 2, 2026, 7:18am (UTC)
🐞 Source: HackerOne

👉 Read full report

CVE-2026-18924: HTTP/2 server push UAF

🔹 Severity: Low
🔹 Weakness: Use After Free
🔹 Reported To: curl
🔹 Reported By: stze
🔹 State: 🟢 Resolved
🔹 Disclosed: September 2, 2026, 7:44am (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in libcurl versions 8.21.0 and later, where a use-after-free issue could occur in the HTTP/2 server push functionality. The vulnerability was caused by the fact that when a pushed transfer ends, the connection's pool is not properly handled, leading to the freed connection data being accessed later. The vulnerability was reproducible in a standalone program using the affected libcurl…

👉 Read full report

SSRF via URL Parser Differential in `normalize_request_url` (wlc)

🔹 Severity: High
🔹 Weakness: Server-Side Request Forgery (SSRF)
🔹 Reported To: Weblate
🔹 Reported By: dark_river
🔹 State: 🟢 Resolved
🔹 Disclosed: September 2, 2026, 7:49am (UTC)
🐞 Source: HackerOne

The Weblate CLI client (wlc) was found to be vulnerable to Server-Side Request Forgery (SSRF) due to a differential in URL parsing between the urllib and urllib3 libraries. The vulnerability was present in the normalize_request_url function, which was meant to validate that outgoing API requests stayed on the configured server's origin. However, the actual HTTP request was dispatched by the requests library, which…

👉 Read full report

CVE-2026-80256: wcurl backslash bypass

🔹 Severity: Medium
🔹 Weakness: Path Traversal: '.../...//'
🔹 Reported To: curl
🔹 Reported By: 1rhino2
🔹 State: 🟢 Resolved
🔹 Disclosed: September 2, 2026, 9:19am (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in the wcurl script of the curl project. The vulnerability allowed an attacker-controlled URL to create a new file outside the directory chosen by a Windows user, subject to the user's filesystem permissions and the target not already existing. The vulnerability was caused by the get_url_filename() function in the wcurl script, which protected percent-encoded characters but left a…

👉 Read full report