Stack Buffer Overflow via Crafted keyseg->start/ keyseg->length in .MYI File (MariaDB MyISAM)

🔹 Severity: No Rating
🔹 Weakness: Classic Buffer Overflow
🔹 Reported To: MariaDB
🔹 Reported By: lukas_kupczyk
🔹 State: 🟢 Resolved
🔹 Disclosed: September 15, 2026, 9:37am (UTC)
🐞 Source: HackerOne

A stack buffer overflow vulnerability was discovered in the MyISAM storage engine of MariaDB. The vulnerability was caused by lack of validation of the "keyseg->start" and "keyseg->length" fields read from the .MYI file. This allowed an attacker to write data beyond the bounds of a fixed-size stack buffer, leading to a denial of service condition when a SQL query touched the affected table's key.

👉 Read full report

Heap Memory Disclosure via Integer Underflow in Item_func_json_arrayagg::cut_max_length in MariaDB Server

🔹 Severity: No Rating
🔹 Weakness: Buffer Over-read
🔹 Reported To: MariaDB
🔹 Reported By: lukas_kupczyk
🔹 State: 🟢 Resolved
🔹 Disclosed: September 15, 2026, 9:38am (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in the `JSON_ARRAYAGG` aggregate function of MariaDB Server. The vulnerability was caused by an integer underflow in the `cut_max_length` function, which could allow an authenticated user to read arbitrary heap memory from the server process. The vulnerability was introduced in commit 6c573a9146caa76807db1190e0747f5befb5b170 (2020-06-15) and affected versions of MariaDB Server prior…

👉 Read full report

Stack Buffer-Overflow in MariaDB Charset_collation_map_st::insert_or_replace()

🔹 Severity: No Rating
🔹 Weakness: Stack Overflow
🔹 Reported To: MariaDB
🔹 Reported By: lukas_kupczyk
🔹 State: 🟢 Resolved
🔹 Disclosed: September 15, 2026, 9:39am (UTC)
🐞 Source: HackerOne

A stack-based buffer overflow was discovered in the MariaDB Server's `Charset_collation_map_st::insert_or_replace()` function. The function copied user-supplied charset and collation identifiers into fixed-size stack buffers using `strmake()` with the attacker-controlled token length as the size bound instead of the destination buffer size. This could have been leveraged by an authenticated user to crash the entire…

👉 Read full report

libcurl LDAP LDIF: entry DN and attribute names written without RFC 2849 base64 encoding, allowing server line injection

🔹 Severity: Low
🔹 Weakness: CRLF Injection
🔹 Reported To: curl
🔹 Reported By: 1rhino2
🔹 State: ⚪️ Informative
🔹 Disclosed: September 15, 2026, 10:11am (UTC)
🐞 Source: HackerOne

👉 Read full report

Authenticated `unsigned_txset` change spoof lets a malicious hot wallet steal cold-signer change

🔹 Severity: High
🔹 Weakness: Business Logic Errors
🔹 Reported To: Monero
🔹 Reported By: usagirabbit
🔹 State: 🟢 Resolved
🔹 Disclosed: September 16, 2026, 9:16am (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in Monero's wallet code that allowed a malicious or compromised hot/watch-only wallet with the victim wallet's private view key to forge an authenticated unsigned transaction. The forged transaction included an attacker-controlled output that was presented as change, and the offline signer then reconstructed and signed that output as change. This resulted in a direct loss-of-funds…

👉 Read full report

Unauthenticated RCE on hydrology.czdt.smce.nasa.gov via the CZDT flood agent's execute_custom_code tool

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: infernosalex
🔹 State: 🟢 Resolved
🔹 Disclosed: September 16, 2026
🐞 Source: Bugcrowd

👉 Read full report

Out-of-Bounds Read + Unsigned Integer Underflow in NASA ION-DTN CBOR string decoders (ici/library/cbor.c:839 / :777)

🔹 Severity: Medium
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: puursuit
🔹 State: 🟢 Resolved
🔹 Disclosed: September 16, 2026
🐞 Source: Bugcrowd

👉 Read full report

SQL Injection in HEASARC TAP ADQL Endpoint via PostgreSQL Unicode Escape — Full pg_catalog Bypass

🔹 Severity: Medium
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: azeemakhtar4e8764
🔹 State: 🟢 Resolved
🔹 Disclosed: September 16, 2026
🐞 Source: Bugcrowd

👉 Read full report

Broken Link Hijacking — abandoned X/Twitter handle `NASA_FINESSE` still linked from a live nasa.gov page

🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: Niranj_R_Mahaswar
🔹 State: 🟢 Resolved
🔹 Disclosed: September 16, 2026
🐞 Source: Bugcrowd

👉 Read full report

Public Disclosure of Sensitive, Proprietary, and Predecisional Documents on NASA.gov Domains

🔹 Severity: Informational
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: zodaex
🔹 State: 🟢 Resolved
🔹 Disclosed: September 16, 2026
🐞 Source: Bugcrowd

👉 Read full report

Incomplete Input Sanitization in CodeInterpreter install_packages Allows Command Injection via pip Flags

🔹 Severity: High
🔹 Weakness: OS Command Injection
🔹 Reported To: AWS VDP
🔹 Reported By: mistercloudsec
🔹 State: 🟢 Resolved
🔹 Disclosed: September 16, 2026, 8:57pm (UTC)
🐞 Source: HackerOne

The Bedrock AgentCore Python SDK was found to have an incomplete input sanitization vulnerability in the `install_packages()` method. The sanitization process failed to properly handle certain pip flags, such as `--index-url`, which allowed arbitrary command execution within the Code Interpreter sandbox. This vulnerability was discovered to affect all versions of the `bedrock-agentcore-sdk-python` up to at least…

👉 Read full report

Team membership information returned on API level based on ID

🔹 Severity: Low | 💰 200 USD
🔹 Weakness: Insecure Direct Object Reference (IDOR)
🔹 Reported To: Nextcloud
🔹 Reported By: milou
🔹 State: 🟢 Resolved
🔹 Disclosed: September 17, 2026, 5:49am (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in the Nextcloud Circles app that allowed any authenticated user to access membership information for any circle and user combination, regardless of their authorization. The issue stemmed from a lack of permission checks in the affected service and request classes, as well as the public exposure of the vulnerable functionality through an API endpoint. This vulnerability could have led…

👉 Read full report

Unauthenticated blind SSRF in Circles signature verification bypasses Nextcloud local-address protections

🔹 Severity: Medium
🔹 Weakness: Server-Side Request Forgery (SSRF)
🔹 Reported To: Nextcloud
🔹 Reported By: 0x0doteth
🔹 State: 🟢 Resolved
🔹 Disclosed: September 17, 2026, 6:22am (UTC)
🐞 Source: HackerOne

A blind SSRF vulnerability was discovered in the Circles app for Nextcloud. The vulnerability allowed unauthenticated users to force the server to fetch internal URLs, bypassing local-address protections in Nextcloud. The vulnerability was caused by the Circles app's signature verification process, which fetched an attacker-provided URL before trust was established.

👉 Read full report

Public collectives allow to create pages

🔹 Severity: Low
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Nextcloud
🔹 Reported By: yoyomiski
🔹 State: 🟢 Resolved
🔹 Disclosed: September 17, 2026, 10:16am (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in the Nextcloud Collectives application that allowed non-members accessing a public collective to create new pages through the backend API, bypassing the collective-level permission settings configured to restrict editing to administrators only. The vulnerability was caused by inconsistent permission enforcement between the user interface, collective settings, and backend API.

👉 Read full report

Arbitrary Board Preference Injection via Deck Config API

🔹 Severity: Medium
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Nextcloud
🔹 Reported By: vidang04
🔹 State: 🟢 Resolved
🔹 Disclosed: September 17, 2026, 10:20am (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in the Deck Config API of the Nextcloud application that allowed authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating the user's ownership or permission to manage the referenced board.

👉 Read full report

Approval app's file-freshness check can be bypassed by omitting the etag parameter, allowing approval of unreviewed file changes

🔹 Severity: Medium
🔹 Weakness: Business Logic Errors
🔹 Reported To: Nextcloud
🔹 Reported By: vidang04
🔹 State: 🟢 Resolved
🔹 Disclosed: September 17, 2026, 10:34am (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in the approval app's file-freshness check. The vulnerability allowed bypassing the check by omitting the etag parameter, enabling approval of unreviewed file changes. This broke the integrity of the approval process, as the approver could approve a different file state than the one they reviewed.

👉 Read full report

Critical broken access control: API-only delegated admin can enumerate all Team Folders and grant access to arbitrary groups

🔹 Severity: Medium
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Nextcloud
🔹 Reported By: qloo
🔹 State: 🟢 Resolved
🔹 Disclosed: September 17, 2026, 10:41am (UTC)
🐞 Source: HackerOne

A critical broken access control vulnerability was discovered in Nextcloud's Group Folders app. The vulnerability allowed an API/REST only delegated admin to bypass folder-level authorization and gain access to any Team Folder by abusing the POST /index.php/apps/groupfolders/folders/{id}/groups endpoint. This was possible because the folder IDs were predictable, allowing the attacker to enumerate all Team Folders…

👉 Read full report

Shared smart albums in the Photos app can expose files outside the album owner's configured source folders

🔹 Severity: Medium
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Nextcloud
🔹 Reported By: suul
🔹 State: 🟢 Resolved
🔹 Disclosed: September 17, 2026, 10:48am (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in a file manager component of a file sharing application. The vulnerability allowed an attacker to access files outside of the intended shared folder by configuring more permissive search paths than the victim intended. This resulted in unauthorized information disclosure, as the system used the attacker's configuration to determine the search scope in the victim's folder. The…

👉 Read full report

Cross-User Lock/Unlock via Absolute DAV Path

🔹 Severity: Medium
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: Nextcloud
🔹 Reported By: 0x0doteth
🔹 State: 🟢 Resolved
🔹 Disclosed: September 17, 2026, 1:09pm (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in the files_lock app for Nextcloud. The vulnerability allowed any authenticated user to lock or unlock files they did not own by targeting absolute WebDAV paths of other users. This was possible because the DAV plugin resolved files from the absolute request URI without verifying that the user ID path segment matched the authenticated session user. This enabled cross-user manual…

👉 Read full report

ZMQ get_output_distribution duplicate amount DoS

🔹 Severity: Medium
🔹 Reported To: Monero
🔹 Reported By: helping_bro
🔹 State: 🟢 Resolved
🔹 Disclosed: September 17, 2026, 5:38pm (UTC)
🐞 Source: HackerOne

The ZMQ `get_output_distribution` RPC was vulnerable to a memory exhaustion denial-of-service attack. The method accepted an unbounded `amounts` array and returned a separate distribution for each entry, allowing a small request to expand into a very large response by repeatedly including the amount `0`. The issue was also reachable with `--restricted-zmq-rpc` because ZMQ lacked the stricter validation applied by…

👉 Read full report

Restricted ZMQ RPC bypasses HTTP restricted-mode resource checks

🔹 Severity: Medium
🔹 Reported To: Monero
🔹 Reported By: helping_bro
🔹 State: 🟢 Resolved
🔹 Disclosed: September 17, 2026, 5:42pm (UTC)
🐞 Source: HackerOne

The restricted ZMQ RPC in monerod did not enforce the same request restrictions as the restricted HTTP RPC. The ZMQ RPC relied primarily on a small method blocklist, allowing several allowed methods to accept requests that the restricted HTTP RPC explicitly rejected or capped. This issue was resolved in version 0.18.5.0.

👉 Read full report