43: HTTP proxy CONNECT header chooses the `-OJ` filename after a redirect

🔹 Severity: No Rating
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: September 7, 2026, 9:06pm (UTC)
🐞 Source: HackerOne

👉 Read full report

57: Heap out-of-bounds read in `curl_easy_escape_ccsid()` / `curl_easy_unescape_ccsid()`

🔹 Severity: No Rating
🔹 Weakness: Out-of-bounds Read
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: September 7, 2026, 9:06pm (UTC)
🐞 Source: HackerOne

👉 Read full report

54: Rejected HTTP/2 push destroys MIME callback state still used by parent (use-after-free)

🔹 Severity: No Rating
🔹 Weakness: Use After Free
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: September 7, 2026, 9:06pm (UTC)
🐞 Source: HackerOne

👉 Read full report

HTTP Digest nonce reused across an https→http scheme change on the same handle

🔹 Severity: Low
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: September 8, 2026, 6:14am (UTC)
🐞 Source: HackerOne

👉 Read full report

Apple SecTrust fallback ignores CURLOPT_CRLFILE, letting a revoked cert pass

🔹 Severity: Low
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: September 8, 2026, 6:14am (UTC)
🐞 Source: HackerOne

👉 Read full report

08: CVE-2026-7009 fix incomplete for AWS-LC: `--cert-status` bypass on SecTrust path

🔹 Severity: No Rating
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: September 8, 2026, 6:14am (UTC)
🐞 Source: HackerOne

👉 Read full report

29: CURLOPT_ISSUERCERT accepts a different-key certificate when issuer metadata collides

🔹 Severity: None
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: September 8, 2026, 8:00am (UTC)
🐞 Source: HackerOne

👉 Read full report

49: Cookie-jar save transfers group access to a different GID

🔹 Severity: No Rating
🔹 Weakness: Improper Preservation of Permissions
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: September 8, 2026, 8:01am (UTC)
🐞 Source: HackerOne

👉 Read full report

Out-of-bounds read in MariaDB .frm parsing enables RCE via vtable hijacking

🔹 Severity: High
🔹 Weakness: Out-of-bounds Read
🔹 Reported To: MariaDB
🔹 Reported By: pinebudweiser
🔹 State: 🟢 Resolved
🔹 Disclosed: September 8, 2026, 8:19am (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in MariaDB where the `key_part->fieldnr` value parsed from a crafted `.frm` file was not validated before being used as an index into the `share->field[]` array. This resulted in an out-of-bounds read, allowing an attacker to hijack the C++ virtual method call and achieve arbitrary code execution within the context of the MariaDB server process. The vulnerability was successfully…

👉 Read full report

Stack Buffer Overflow in mariadb-dump quote_name() Allows Malicious Server to Execute Arbitrary Code on Client

🔹 Severity: Critical
🔹 Weakness: Stack Overflow
🔹 Reported To: MariaDB
🔹 Reported By: byteoverride
🔹 State: 🟢 Resolved
🔹 Disclosed: September 8, 2026, 1:30pm (UTC)
🐞 Source: HackerOne

A stack buffer overflow was discovered in the quote_name() function of the mariadb-dump client application. The overflow occurred due to a lack of length validation on table names returned by a malicious MySQL server. This allowed a server to provide an excessively long table name that would overflow the fixed-size buffer, leading to the overwriting of the return address and other control-flow data on the stack…

👉 Read full report

22: FTP wildcard matching decodes server-provided filenames, enabling directory traversal

🔹 Severity: None
🔹 Weakness: Path Traversal
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: September 8, 2026, 2:17pm (UTC)
🐞 Source: HackerOne

👉 Read full report

Unauthenticated Access to Internal Files via Direct Object Reference (UUID-based) Leading to Sensitive Data Exposure

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: Maholi_Tumanggor
🔹 State: 🟢 Resolved
🔹 Disclosed: September 9, 2026
🐞 Source: Bugcrowd

👉 Read full report

Broken Link Hijacking (Impersonation) on ntrs.nasa.gov via abandoned Facebook URL

🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: Niranj_R_Mahaswar
🔹 State: 🟢 Resolved
🔹 Disclosed: September 9, 2026
🐞 Source: Bugcrowd

👉 Read full report

CORS Misconfiguration / Broken Access Control

🔹 Severity: No Rating
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Myndr
🔹 Reported By: shubham71
🔹 State: 🟢 Resolved
🔹 Disclosed: September 10, 2026, 8:16am (UTC)
🐞 Source: HackerOne

A CORS misconfiguration was discovered on the admin panel that allowed any website hosted on a subdomain of the target organization to read authenticated admin responses, including CSRF nonces and session data. This vulnerability could have enabled full admin account takeover through a CSRF attack.

👉 Read full report

Tor onion service INTRODUCE2 invalid-MAC cells permanently grow service replay cache

🔹 Severity: Low
🔹 Weakness: Uncontrolled Resource Consumption
🔹 Reported To: Tor
🔹 Reported By: geeknik
🔹 State: 🟢 Resolved
🔹 Disclosed: September 10, 2026, 12:10pm (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in Tor's onion service INTRODUCE2 handling. A remote client could send well-formed INTRODUCE1 cells with an invalid MAC, but a unique byte pattern. The introduction point would forward these cells as INTRODUCE2 to the onion service. The onion service would insert the attacker-controlled encrypted section into the introduction-point replay cache before verifying the INTRODUCE2 MAC. The…

👉 Read full report

Conflux-queued zero-length RELAY_END triggers heap out-of-bounds read

🔹 Severity: Medium
🔹 Weakness: Out-of-bounds Read
🔹 Reported To: Tor
🔹 Reported By: geeknik
🔹 State: 🟢 Resolved
🔹 Disclosed: September 10, 2026, 12:10pm (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in Tor that could trigger a heap out-of-bounds read when a zero-length RELAY_END cell was processed on a non-open AP stream. The vulnerability was caused by the way Tor handles these cells, where the reason byte was read before checking the message length. This issue was compounded by Conflux's out-of-order delivery, which could copy the zero-length message into an exact-size heap…

👉 Read full report

27: IMAP custom FETCH listing classification skips literal boundaries, enabling response desynchronization

🔹 Severity: No Rating
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: September 10, 2026, 3:09pm (UTC)
🐞 Source: HackerOne

👉 Read full report

IMAP connection reuse runs requests in the wrong case-sensitive mailbox

🔹 Severity: Low
🔹 Weakness: Improper Handling of Case Sensitivity
🔹 Reported To: curl
🔹 Reported By: 1rhino2
🔹 State: ⚪️ Informative
🔹 Disclosed: September 10, 2026, 3:09pm (UTC)
🐞 Source: HackerOne

👉 Read full report

12: SASL DIGEST-MD5 does not validate the server's `rspauth` proof

🔹 Severity: No Rating
🔹 Weakness: Missing Critical Step in Authentication
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: September 10, 2026, 3:09pm (UTC)
🐞 Source: HackerOne

👉 Read full report

55: Heap-buffer-overflow read in `curl_formadd_ccsid()` with binary form data

🔹 Severity: No Rating
🔹 Weakness: Out-of-bounds Read
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: September 10, 2026, 3:10pm (UTC)
🐞 Source: HackerOne

👉 Read full report

Publicly Accessible Project Documentation Exposes Extensive Project Personnel Contact Information

🔹 Severity: Informational
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: nafee7hh
🔹 State: 🟢 Resolved
🔹 Disclosed: September 10, 2026
🐞 Source: Bugcrowd

👉 Read full report