CVE-2026-18924: HTTP/2 server push UAF
🔹 Severity: Low
🔹 Weakness: Use After Free
🔹 Reported To: curl
🔹 Reported By: stze
🔹 State: 🟢 Resolved
🔹 Disclosed: September 2, 2026, 7:44am (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in libcurl versions 8.21.0 and later, where a use-after-free issue could occur in the HTTP/2 server push functionality. The vulnerability was caused by the fact that when a pushed transfer ends, the connection's pool is not properly handled, leading to the freed connection data being accessed later. The vulnerability was reproducible in a standalone program using the affected libcurl…
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Use After Free
🔹 Reported To: curl
🔹 Reported By: stze
🔹 State: 🟢 Resolved
🔹 Disclosed: September 2, 2026, 7:44am (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in libcurl versions 8.21.0 and later, where a use-after-free issue could occur in the HTTP/2 server push functionality. The vulnerability was caused by the fact that when a pushed transfer ends, the connection's pool is not properly handled, leading to the freed connection data being accessed later. The vulnerability was reproducible in a standalone program using the affected libcurl…
👉 Read full report
SSRF via URL Parser Differential in `normalize_request_url` (wlc)
🔹 Severity: High
🔹 Weakness: Server-Side Request Forgery (SSRF)
🔹 Reported To: Weblate
🔹 Reported By: dark_river
🔹 State: 🟢 Resolved
🔹 Disclosed: September 2, 2026, 7:49am (UTC)
🐞 Source: HackerOne
The Weblate CLI client (wlc) was found to be vulnerable to Server-Side Request Forgery (SSRF) due to a differential in URL parsing between the urllib and urllib3 libraries. The vulnerability was present in the normalize_request_url function, which was meant to validate that outgoing API requests stayed on the configured server's origin. However, the actual HTTP request was dispatched by the requests library, which…
👉 Read full report
🔹 Severity: High
🔹 Weakness: Server-Side Request Forgery (SSRF)
🔹 Reported To: Weblate
🔹 Reported By: dark_river
🔹 State: 🟢 Resolved
🔹 Disclosed: September 2, 2026, 7:49am (UTC)
🐞 Source: HackerOne
The Weblate CLI client (wlc) was found to be vulnerable to Server-Side Request Forgery (SSRF) due to a differential in URL parsing between the urllib and urllib3 libraries. The vulnerability was present in the normalize_request_url function, which was meant to validate that outgoing API requests stayed on the configured server's origin. However, the actual HTTP request was dispatched by the requests library, which…
👉 Read full report
CVE-2026-80256: wcurl backslash bypass
🔹 Severity: Medium
🔹 Weakness: Path Traversal: '.../...//'
🔹 Reported To: curl
🔹 Reported By: 1rhino2
🔹 State: 🟢 Resolved
🔹 Disclosed: September 2, 2026, 9:19am (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the wcurl script of the curl project. The vulnerability allowed an attacker-controlled URL to create a new file outside the directory chosen by a Windows user, subject to the user's filesystem permissions and the target not already existing. The vulnerability was caused by the get_url_filename() function in the wcurl script, which protected percent-encoded characters but left a…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Path Traversal: '.../...//'
🔹 Reported To: curl
🔹 Reported By: 1rhino2
🔹 State: 🟢 Resolved
🔹 Disclosed: September 2, 2026, 9:19am (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the wcurl script of the curl project. The vulnerability allowed an attacker-controlled URL to create a new file outside the directory chosen by a Windows user, subject to the user's filesystem permissions and the target not already existing. The vulnerability was caused by the get_url_filename() function in the wcurl script, which protected percent-encoded characters but left a…
👉 Read full report
Command injection in Harmony trajectory-subsetter (subset.shape GeoJSON) gives any Earthdata user remote code execution (RCE) as root on harmony.earthdata.nasa.gov
🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: cl45h
🔹 State: 🟢 Resolved
🔹 Disclosed: September 2, 2026
🐞 Source: Bugcrowd
👉 Read full report
🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: cl45h
🔹 State: 🟢 Resolved
🔹 Disclosed: September 2, 2026
🐞 Source: Bugcrowd
👉 Read full report
CVE-2026-13608: OpenLDAP SASL authentication bypass
🔹 Severity: Low
🔹 Weakness: Authentication Bypass by Primary Weakness
🔹 Reported To: curl
🔹 Reported By: hahahkim
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2026, 12:35am (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the OpenLDAP SASL authentication mechanism in libcurl. The vulnerability could allow a malicious LDAP server to bypass SASL authentication, potentially allowing the injection of arbitrary LDAP results. The vulnerable code has been present since the OpenLDAP SASL support was introduced and was unchanged in the current release.
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Authentication Bypass by Primary Weakness
🔹 Reported To: curl
🔹 Reported By: hahahkim
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2026, 12:35am (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the OpenLDAP SASL authentication mechanism in libcurl. The vulnerability could allow a malicious LDAP server to bypass SASL authentication, potentially allowing the injection of arbitrary LDAP results. The vulnerable code has been present since the OpenLDAP SASL support was introduced and was unchanged in the current release.
👉 Read full report
CVE-2026-80255: secure cookie attribute bypass with tab
🔹 Severity: No Rating
🔹 Weakness: Improper Input Validation
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2026, 6:08am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: No Rating
🔹 Weakness: Improper Input Validation
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2026, 6:08am (UTC)
🐞 Source: HackerOne
👉 Read full report
CVE-2026-82208: wolfSSL CA-cache hit overrides callback
🔹 Severity: No Rating
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2026, 6:08am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: No Rating
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2026, 6:08am (UTC)
🐞 Source: HackerOne
👉 Read full report
CVE-2026-80231: native CA store conn reuse
🔹 Severity: Low
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2026, 6:08am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Low
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2026, 6:08am (UTC)
🐞 Source: HackerOne
👉 Read full report
CVE-2026-80230: OpenSSL pinning bypass
🔹 Severity: None
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2026, 6:08am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: None
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2026, 6:08am (UTC)
🐞 Source: HackerOne
👉 Read full report
CVE-2026-80229: OpenSSL provider use-after-free
🔹 Severity: None
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2026, 6:09am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: None
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2026, 6:09am (UTC)
🐞 Source: HackerOne
👉 Read full report
CVE-2026-19931: Negotiate ambient user conn reuse
🔹 Severity: Medium
🔹 Weakness: Authentication Bypass by Primary Weakness
🔹 Reported To: curl
🔹 Reported By: dukek
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2026, 6:09am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Authentication Bypass by Primary Weakness
🔹 Reported To: curl
🔹 Reported By: dukek
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2026, 6:09am (UTC)
🐞 Source: HackerOne
👉 Read full report
CVE-2026-82209: domain-scoped PSL domain cookie
🔹 Severity: No Rating
🔹 Weakness: Information Disclosure
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2026, 6:09am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: No Rating
🔹 Weakness: Information Disclosure
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2026, 6:09am (UTC)
🐞 Source: HackerOne
👉 Read full report
Unauthorized Silent Webcam Activation via Loom Chrome Extension Web Accessible Resources
🔹 Severity: Medium
🔹 Reported To: Atlassian
🔹 Reported By: AlixSchaefer
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2026
🐞 Source: Bugcrowd
👉 Read full report
🔹 Severity: Medium
🔹 Reported To: Atlassian
🔹 Reported By: AlixSchaefer
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2026
🐞 Source: Bugcrowd
👉 Read full report
Stack Overflow DoS in ST_GeomFromGeoJSON Allows Any Authenticated User to Crash the Entire Server
🔹 Severity: Medium
🔹 Weakness: Stack Overflow
🔹 Reported To: MariaDB
🔹 Reported By: byteoverride
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2026, 10:13pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the MariaDB database server's ST_GeomFromGeoJSON function. Any authenticated user with basic SELECT privileges could crash the entire server by passing a deeply nested GeoJSON GeometryCollection. The crash was caused by unbounded recursion in the GeoJSON parser, which consumed the server's stack until it overflowed, leading to a SIGSEGV crash that killed all active connections and…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Stack Overflow
🔹 Reported To: MariaDB
🔹 Reported By: byteoverride
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2026, 10:13pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the MariaDB database server's ST_GeomFromGeoJSON function. Any authenticated user with basic SELECT privileges could crash the entire server by passing a deeply nested GeoJSON GeometryCollection. The crash was caused by unbounded recursion in the GeoJSON parser, which consumed the server's stack until it overflowed, leading to a SIGSEGV crash that killed all active connections and…
👉 Read full report
Unauthenticated ?q= search query causes exponential pyparsing backtracking under a process-global lock in Weblate
🔹 Severity: High
🔹 Weakness: Uncontrolled Resource Consumption
🔹 Reported To: Weblate
🔹 Reported By: type5afe
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2026, 8:10am (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in Weblate, an open-source translation management system. The vulnerability was caused by the search query grammar implementation in Weblate, which was built using the `pyparsing` library. The grammar was ambiguous at every position and did not enable memoization, leading to exponential backtracking during parsing of search queries with nested parentheses. This resulted in a…
👉 Read full report
🔹 Severity: High
🔹 Weakness: Uncontrolled Resource Consumption
🔹 Reported To: Weblate
🔹 Reported By: type5afe
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2026, 8:10am (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in Weblate, an open-source translation management system. The vulnerability was caused by the search query grammar implementation in Weblate, which was built using the `pyparsing` library. The grammar was ambiguous at every position and did not enable memoization, leading to exponential backtracking during parsing of search queries with nested parentheses. This resulted in a…
👉 Read full report
API token sent to URL dictated by an untrusted project .weblate file
🔹 Severity: Medium
🔹 Weakness: Information Disclosure
🔹 Reported To: Weblate
🔹 Reported By: type5afe
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2026, 8:10am (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the wlc Python library used to interact with the Weblate translation management system. The vulnerability allowed an untrusted .weblate file to specify the Weblate API URL, which could then receive the API token set in the environment. The API token was resolved independently and was not bound to a trusted URL source, allowing the secret to be sent to an attacker-chosen server.
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Information Disclosure
🔹 Reported To: Weblate
🔹 Reported By: type5afe
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2026, 8:10am (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the wlc Python library used to interact with the Weblate translation management system. The vulnerability allowed an untrusted .weblate file to specify the Weblate API URL, which could then receive the API token set in the environment. The API token was resolved independently and was not bound to a trusted URL source, allowing the secret to be sent to an attacker-chosen server.
👉 Read full report
Mail contact autocomplete bypasses administrator-configured user enumeration restrictions and expose member information outside the intended scope
🔹 Severity: Medium
🔹 Weakness: Privacy Violation
🔹 Reported To: Nextcloud
🔹 Reported By: njh215
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2026, 8:38pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the Mail contact autocomplete feature of Nextcloud that allowed an authenticated user to bypass administrator-configured user enumeration restrictions and expose member information outside the intended scope. The vulnerability was present in the `ContactIntegrationController::autoComplete()` handler, which did not apply the stricter user enumeration controls used elsewhere in the…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Privacy Violation
🔹 Reported To: Nextcloud
🔹 Reported By: njh215
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2026, 8:38pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the Mail contact autocomplete feature of Nextcloud that allowed an authenticated user to bypass administrator-configured user enumeration restrictions and expose member information outside the intended scope. The vulnerability was present in the `ContactIntegrationController::autoComplete()` handler, which did not apply the stricter user enumeration controls used elsewhere in the…
👉 Read full report
Activity app does not verify federated file activity received from remote servers
🔹 Severity: Low | 💰 150 USD
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: Nextcloud
🔹 Reported By: cyebrsunita
🔹 State: 🟢 Resolved
🔹 Disclosed: September 5, 2026, 2:18pm (UTC)
🐞 Source: HackerOne
The activity app stored activity content received from remote servers without verifying the content first.
👉 Read full report
🔹 Severity: Low | 💰 150 USD
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: Nextcloud
🔹 Reported By: cyebrsunita
🔹 State: 🟢 Resolved
🔹 Disclosed: September 5, 2026, 2:18pm (UTC)
🐞 Source: HackerOne
The activity app stored activity content received from remote servers without verifying the content first.
👉 Read full report
Missing Duplicate Check allowing Multiple Retention Rules per System Tag
🔹 Severity: Low
🔹 Weakness: Business Logic Errors
🔹 Reported To: Nextcloud
🔹 Reported By: charankumar39
🔹 State: 🟢 Resolved
🔹 Disclosed: September 5, 2026, 2:23pm (UTC)
🐞 Source: HackerOne
A bug allowed admins to create multiple retention rules for the same tag, causing potential confusion for other admins.
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Business Logic Errors
🔹 Reported To: Nextcloud
🔹 Reported By: charankumar39
🔹 State: 🟢 Resolved
🔹 Disclosed: September 5, 2026, 2:23pm (UTC)
🐞 Source: HackerOne
A bug allowed admins to create multiple retention rules for the same tag, causing potential confusion for other admins.
👉 Read full report
Improper Input Validation and Integer Overflow in timeamount parameter of files_retention app
🔹 Severity: Low
🔹 Weakness: Integer Overflow
🔹 Reported To: Nextcloud
🔹 Reported By: nishantbaswal1996
🔹 State: 🟢 Resolved
🔹 Disclosed: September 5, 2026, 2:29pm (UTC)
🐞 Source: HackerOne
The timeamount parameter of the files_retention app lacked proper input validation, allowing an administrator to store an unintended long time amount as the retention period. This vulnerability could have potentially led to files never getting deleted.
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Integer Overflow
🔹 Reported To: Nextcloud
🔹 Reported By: nishantbaswal1996
🔹 State: 🟢 Resolved
🔹 Disclosed: September 5, 2026, 2:29pm (UTC)
🐞 Source: HackerOne
The timeamount parameter of the files_retention app lacked proper input validation, allowing an administrator to store an unintended long time amount as the retention period. This vulnerability could have potentially led to files never getting deleted.
👉 Read full report
Email Enumeration via Password-Protected Share Identity Verification
🔹 Severity: Low | 💰 100 USD
🔹 Weakness: Information Disclosure
🔹 Reported To: Nextcloud
🔹 Reported By: cybershinu90
🔹 State: 🟢 Resolved
🔹 Disclosed: September 5, 2026, 2:38pm (UTC)
🐞 Source: HackerOne
The vulnerability allowed email enumeration through password-protected share identity verification. Requesting a password for an email share resulted in different response messages depending on whether the email address was the intended recipient, enabling confirmation of the share recipient.
👉 Read full report
🔹 Severity: Low | 💰 100 USD
🔹 Weakness: Information Disclosure
🔹 Reported To: Nextcloud
🔹 Reported By: cybershinu90
🔹 State: 🟢 Resolved
🔹 Disclosed: September 5, 2026, 2:38pm (UTC)
🐞 Source: HackerOne
The vulnerability allowed email enumeration through password-protected share identity verification. Requesting a password for an email share resulted in different response messages depending on whether the email address was the intended recipient, enabling confirmation of the share recipient.
👉 Read full report