HTTP Request Smuggling via Unsanitized Hop-by-Hop Headers

🔹 Severity: High | 💰 1,500 USD
🔹 Weakness: HTTP Request Smuggling
🔹 Reported To: Cloudflare Public Bug Bounty
🔹 Reported By: 1nsomnia1102
🔹 State: 🟢 Resolved
🔹 Disclosed: September 14, 2026, 4:57am (UTC)
🐞 Source: HackerOne

A vulnerability was found in Pingora that could allow HTTP request smuggling through improper handling of hop-by-hop headers. The issue was fixed in Pingora 0.9.0.

👉 Read full report

[Atlas Browser] Fullscreen notification is missing when requestFullscreen() is called from a popup window

🔹 Severity: Low
🔹 Reported To: OpenAI
🔹 Reported By: Moch_Azril
🔹 State: 🟢 Resolved
🔹 Disclosed: September 14, 2026
🐞 Source: Bugcrowd

👉 Read full report

[Atlas Browser] Fullscreen Notification Overlap by Screen Share Permission Dialog Leading to UI Spoofing and Unauthorized Screen Capture in ChatGPT Atlas for macOS

🔹 Severity: Low
🔹 Reported To: OpenAI
🔹 Reported By: Moch_Azril
🔹 State: 🟢 Resolved
🔹 Disclosed: September 14, 2026
🐞 Source: Bugcrowd

👉 Read full report

37: `curl_mprintf` `%F` format specifier not consumed, causing variadic argument desynchronization

🔹 Severity: No Rating
🔹 Weakness: Type Confusion
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: September 14, 2026, 6:58am (UTC)
🐞 Source: HackerOne

👉 Read full report

10: CURLOPT_MAXLIFETIME_CONN bypass on active HTTP/2 connections

🔹 Severity: No Rating
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: September 14, 2026, 6:58am (UTC)
🐞 Source: HackerOne

👉 Read full report

56: IBM i CL wrapper `parse_command_line()` never enters quote mode

🔹 Severity: No Rating
🔹 Weakness: Command Injection - Generic
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: September 14, 2026, 6:58am (UTC)
🐞 Source: HackerOne

👉 Read full report

53: HTTP/1 CONNECT chunked-407 trailers bypass CURLOPT_SUPPRESS_CONNECT_HEADERS and lose CURLH_CONNECT classification

🔹 Severity: No Rating
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: September 14, 2026, 6:58am (UTC)
🐞 Source: HackerOne

👉 Read full report

Heap-use-after-free in CURLOPT_REFERER when passed a CURLINFO_REFERER pointer

🔹 Severity: Low
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: September 14, 2026, 6:59am (UTC)
🐞 Source: HackerOne

👉 Read full report

OpenSSL ENGINE selection omitted from mTLS connection matching

🔹 Severity: Low
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: September 14, 2026, 6:59am (UTC)
🐞 Source: HackerOne

👉 Read full report

TLS session resumption client cert bypass with CURLOPT_SSL_CTX_FUNCTION

🔹 Severity: Medium
🔹 Weakness: Authentication Bypass by Primary Weakness
🔹 Reported To: curl
🔹 Reported By: causalsecurity
🔹 State: ⚪️ Informative
🔹 Disclosed: September 14, 2026, 7:41am (UTC)
🐞 Source: HackerOne

👉 Read full report

[Atlas Browser]Bypass the full-screen notification security layer by displaying a permission dialog to open an external app

🔹 Severity: Low
🔹 Reported To: OpenAI
🔹 Reported By: Moch_Azril
🔹 State: 🟢 Resolved
🔹 Disclosed: September 14, 2026
🐞 Source: Bugcrowd

👉 Read full report

[Atlas Browser]Bypassing Full-Screen Notification via Right-Click Context Menu Leads to Spoofing Attacks

🔹 Severity: Low
🔹 Reported To: OpenAI
🔹 Reported By: Moch_Azril
🔹 State: 🟢 Resolved
🔹 Disclosed: September 14, 2026
🐞 Source: Bugcrowd

👉 Read full report

Use-After-Free in BTREE Index Traversal via Stale key_version in heap_update() in MariaDB Server

🔹 Severity: No Rating
🔹 Weakness: Use After Free
🔹 Reported To: MariaDB
🔹 Reported By: lukas_kupczyk
🔹 State: 🟢 Resolved
🔹 Disclosed: September 14, 2026, 4:05pm (UTC)
🐞 Source: HackerOne

A use-after-free vulnerability was discovered in the MEMORY (HEAP) storage engine of MariaDB Server. The vulnerability was caused by incorrect handling of the `key_changed` variable in the `heap_update()` function, which could lead to stale pointers being dereferenced during BTREE index traversal. While the vulnerability could be triggered by an authenticated user with standard database privileges, no further…

👉 Read full report

Encoded slash traversal in the IPFS/IPNS URL rewrite escapes the configured gateway namespace

🔹 Severity: Medium
🔹 Weakness: Improper Handling of URL Encoding (Hex Encoding)
🔹 Reported To: curl
🔹 Reported By: 1rhino2
🔹 State: ⚪️ Informative
🔹 Disclosed: September 14, 2026, 8:11pm (UTC)
🐞 Source: HackerOne

👉 Read full report