CVE-2026-80231: native CA store conn reuse

🔹 Severity: Low
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2026, 6:08am (UTC)
🐞 Source: HackerOne

👉 Read full report

CVE-2026-80230: OpenSSL pinning bypass

🔹 Severity: None
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2026, 6:08am (UTC)
🐞 Source: HackerOne

👉 Read full report

CVE-2026-80229: OpenSSL provider use-after-free

🔹 Severity: None
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2026, 6:09am (UTC)
🐞 Source: HackerOne

👉 Read full report

CVE-2026-19931: Negotiate ambient user conn reuse

🔹 Severity: Medium
🔹 Weakness: Authentication Bypass by Primary Weakness
🔹 Reported To: curl
🔹 Reported By: dukek
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2026, 6:09am (UTC)
🐞 Source: HackerOne

👉 Read full report

CVE-2026-82209: domain-scoped PSL domain cookie

🔹 Severity: No Rating
🔹 Weakness: Information Disclosure
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2026, 6:09am (UTC)
🐞 Source: HackerOne

👉 Read full report

Unauthorized Silent Webcam Activation via Loom Chrome Extension Web Accessible Resources

🔹 Severity: Medium
🔹 Reported To: Atlassian
🔹 Reported By: AlixSchaefer
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2026
🐞 Source: Bugcrowd

👉 Read full report

Stack Overflow DoS in ST_GeomFromGeoJSON Allows Any Authenticated User to Crash the Entire Server

🔹 Severity: Medium
🔹 Weakness: Stack Overflow
🔹 Reported To: MariaDB
🔹 Reported By: byteoverride
🔹 State: 🟢 Resolved
🔹 Disclosed: September 3, 2026, 10:13pm (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in the MariaDB database server's ST_GeomFromGeoJSON function. Any authenticated user with basic SELECT privileges could crash the entire server by passing a deeply nested GeoJSON GeometryCollection. The crash was caused by unbounded recursion in the GeoJSON parser, which consumed the server's stack until it overflowed, leading to a SIGSEGV crash that killed all active connections and…

👉 Read full report

Unauthenticated ?q= search query causes exponential pyparsing backtracking under a process-global lock in Weblate

🔹 Severity: High
🔹 Weakness: Uncontrolled Resource Consumption
🔹 Reported To: Weblate
🔹 Reported By: type5afe
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2026, 8:10am (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in Weblate, an open-source translation management system. The vulnerability was caused by the search query grammar implementation in Weblate, which was built using the `pyparsing` library. The grammar was ambiguous at every position and did not enable memoization, leading to exponential backtracking during parsing of search queries with nested parentheses. This resulted in a…

👉 Read full report

API token sent to URL dictated by an untrusted project .weblate file

🔹 Severity: Medium
🔹 Weakness: Information Disclosure
🔹 Reported To: Weblate
🔹 Reported By: type5afe
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2026, 8:10am (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in the wlc Python library used to interact with the Weblate translation management system. The vulnerability allowed an untrusted .weblate file to specify the Weblate API URL, which could then receive the API token set in the environment. The API token was resolved independently and was not bound to a trusted URL source, allowing the secret to be sent to an attacker-chosen server.

👉 Read full report

Mail contact autocomplete bypasses administrator-configured user enumeration restrictions and expose member information outside the intended scope

🔹 Severity: Medium
🔹 Weakness: Privacy Violation
🔹 Reported To: Nextcloud
🔹 Reported By: njh215
🔹 State: 🟢 Resolved
🔹 Disclosed: September 4, 2026, 8:38pm (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in the Mail contact autocomplete feature of Nextcloud that allowed an authenticated user to bypass administrator-configured user enumeration restrictions and expose member information outside the intended scope. The vulnerability was present in the `ContactIntegrationController::autoComplete()` handler, which did not apply the stricter user enumeration controls used elsewhere in the…

👉 Read full report

Activity app does not verify federated file activity received from remote servers

🔹 Severity: Low | 💰 150 USD
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: Nextcloud
🔹 Reported By: cyebrsunita
🔹 State: 🟢 Resolved
🔹 Disclosed: September 5, 2026, 2:18pm (UTC)
🐞 Source: HackerOne

The activity app stored activity content received from remote servers without verifying the content first.

👉 Read full report

Missing Duplicate Check allowing Multiple Retention Rules per System Tag

🔹 Severity: Low
🔹 Weakness: Business Logic Errors
🔹 Reported To: Nextcloud
🔹 Reported By: charankumar39
🔹 State: 🟢 Resolved
🔹 Disclosed: September 5, 2026, 2:23pm (UTC)
🐞 Source: HackerOne

A bug allowed admins to create multiple retention rules for the same tag, causing potential confusion for other admins.

👉 Read full report

Improper Input Validation and Integer Overflow in timeamount parameter of files_retention app

🔹 Severity: Low
🔹 Weakness: Integer Overflow
🔹 Reported To: Nextcloud
🔹 Reported By: nishantbaswal1996
🔹 State: 🟢 Resolved
🔹 Disclosed: September 5, 2026, 2:29pm (UTC)
🐞 Source: HackerOne

The timeamount parameter of the files_retention app lacked proper input validation, allowing an administrator to store an unintended long time amount as the retention period. This vulnerability could have potentially led to files never getting deleted.

👉 Read full report

Email Enumeration via Password-Protected Share Identity Verification

🔹 Severity: Low | 💰 100 USD
🔹 Weakness: Information Disclosure
🔹 Reported To: Nextcloud
🔹 Reported By: cybershinu90
🔹 State: 🟢 Resolved
🔹 Disclosed: September 5, 2026, 2:38pm (UTC)
🐞 Source: HackerOne

The vulnerability allowed email enumeration through password-protected share identity verification. Requesting a password for an email share resulted in different response messages depending on whether the email address was the intended recipient, enabling confirmation of the share recipient.

👉 Read full report

Unauthenticated testing endpoint of notify_push expose internal IP

🔹 Severity: Medium | 💰 150 USD
🔹 Weakness: Information Disclosure
🔹 Reported To: Nextcloud
🔹 Reported By: chinnuy935336
🔹 State: 🟢 Resolved
🔹 Disclosed: September 5, 2026, 2:45pm (UTC)
🐞 Source: HackerOne

The testing endpoint of the notify_push component exposed internal IP addresses to unauthenticated users.

👉 Read full report

PII Exposure of Credit Applications and Social Security Numbers equifax-6070.my.salesforce-sites.com (Salesforce guest user)

🔹 Severity: High
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: Equifax-vdp
🔹 Reported By: dr32
🔹 State: 🟢 Resolved
🔹 Disclosed: September 6, 2026, 10:03am (UTC)
🐞 Source: HackerOne

A Salesforce community portal belonging to Equifax was found to be leaking tens of thousands of credit reports and other sensitive financial information. The portal's Salesforce guest user profile and sharing settings granted unauthenticated access to multiple objects, including Contact, Online_Credit_Application__c, and related financial data. This exposure allowed an anonymous user to read a large number of…

👉 Read full report

ACL cache collision lets a role inherit privileges from a same-named socket user

🔹 Severity: No Rating
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: MariaDB
🔹 Reported By: dogeshark
🔹 State: 🟢 Resolved
🔹 Disclosed: September 7, 2026, 7:55pm (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in MariaDB's database privilege cache where a role and a UNIX-socket user with the same name were not distinguished. When the socket user warmed the cache with their privileges, a different account that activated the same-named role then received the cached user privileges, even though those privileges were never granted to the role.

👉 Read full report

KILL authorization trusts the presented login name instead of the authenticated anonymous account

🔹 Severity: No Rating
🔹 Weakness: Incorrect Calculation of Buffer Size
🔹 Reported To: MariaDB
🔹 Reported By: dogeshark
🔹 State: 🟢 Resolved
🔹 Disclosed: September 7, 2026, 7:55pm (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in the KILL authorization process of a database management system. The vulnerability allowed an anonymous account to terminate connections using a supplied login name, even if the authenticated identity was different. This was because the KILL authorization relied on the presented login name instead of the authenticated account identity.

👉 Read full report

MariaDB: heap buffer overflow in ha_tina::chain_append() lets a low-privileged user crash the server via CSV row deletion

🔹 Severity: Medium
🔹 Weakness: Heap Overflow
🔹 Reported To: MariaDB
🔹 Reported By: v3rtical
🔹 State: 🟢 Resolved
🔹 Disclosed: September 7, 2026, 7:59pm (UTC)
🐞 Source: HackerOne

A heap buffer overflow vulnerability was discovered in the ha_tina::chain_append() function of the MariaDB database server. The vulnerability was caused by an incorrect memory allocation during the growth of a data structure. This could allow a low-privileged user to crash the server by executing a specific SQL command involving CSV data deletion. The vulnerability was confirmed to affect both the stock Ubuntu…

👉 Read full report

MariaDB GRANT PROXY permits unauthorized authentication changes and administrator account takeover

🔹 Severity: High
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: MariaDB
🔹 Reported By: kevin_mizu
🔹 State: 🟢 Resolved
🔹 Disclosed: September 7, 2026, 8:07pm (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in MariaDB that allowed an authenticated user with only USAGE privileges to change the password of an existing administrator account. This was achieved through the grantee clause of the GRANT PROXY statement, which permitted bypassing the authorization checks and directly modifying the target account's authentication information. The vulnerability was tested on MariaDB versions 12.3.2…

👉 Read full report

11: `CURLOPT_FORBID_REUSE` silently lost on multiplexed HTTP/2 connection when the forbidding transfer finishes first

🔹 Severity: No Rating
🔹 Weakness: Authentication Bypass by Primary Weakness
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: September 7, 2026, 9:05pm (UTC)
🐞 Source: HackerOne

👉 Read full report