Cross-User Lock/Unlock via Absolute DAV Path
🔹 Severity: Medium
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: Nextcloud
🔹 Reported By: 0x0doteth
🔹 State: 🟢 Resolved
🔹 Disclosed: September 17, 2026, 1:09pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the files_lock app for Nextcloud. The vulnerability allowed any authenticated user to lock or unlock files they did not own by targeting absolute WebDAV paths of other users. This was possible because the DAV plugin resolved files from the absolute request URI without verifying that the user ID path segment matched the authenticated session user. This enabled cross-user manual…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: Nextcloud
🔹 Reported By: 0x0doteth
🔹 State: 🟢 Resolved
🔹 Disclosed: September 17, 2026, 1:09pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the files_lock app for Nextcloud. The vulnerability allowed any authenticated user to lock or unlock files they did not own by targeting absolute WebDAV paths of other users. This was possible because the DAV plugin resolved files from the absolute request URI without verifying that the user ID path segment matched the authenticated session user. This enabled cross-user manual…
👉 Read full report
ZMQ get_output_distribution duplicate amount DoS
🔹 Severity: Medium
🔹 Reported To: Monero
🔹 Reported By: helping_bro
🔹 State: 🟢 Resolved
🔹 Disclosed: September 17, 2026, 5:38pm (UTC)
🐞 Source: HackerOne
The ZMQ `get_output_distribution` RPC was vulnerable to a memory exhaustion denial-of-service attack. The method accepted an unbounded `amounts` array and returned a separate distribution for each entry, allowing a small request to expand into a very large response by repeatedly including the amount `0`. The issue was also reachable with `--restricted-zmq-rpc` because ZMQ lacked the stricter validation applied by…
👉 Read full report
🔹 Severity: Medium
🔹 Reported To: Monero
🔹 Reported By: helping_bro
🔹 State: 🟢 Resolved
🔹 Disclosed: September 17, 2026, 5:38pm (UTC)
🐞 Source: HackerOne
The ZMQ `get_output_distribution` RPC was vulnerable to a memory exhaustion denial-of-service attack. The method accepted an unbounded `amounts` array and returned a separate distribution for each entry, allowing a small request to expand into a very large response by repeatedly including the amount `0`. The issue was also reachable with `--restricted-zmq-rpc` because ZMQ lacked the stricter validation applied by…
👉 Read full report
Restricted ZMQ RPC bypasses HTTP restricted-mode resource checks
🔹 Severity: Medium
🔹 Reported To: Monero
🔹 Reported By: helping_bro
🔹 State: 🟢 Resolved
🔹 Disclosed: September 17, 2026, 5:42pm (UTC)
🐞 Source: HackerOne
The restricted ZMQ RPC in monerod did not enforce the same request restrictions as the restricted HTTP RPC. The ZMQ RPC relied primarily on a small method blocklist, allowing several allowed methods to accept requests that the restricted HTTP RPC explicitly rejected or capped. This issue was resolved in version 0.18.5.0.
👉 Read full report
🔹 Severity: Medium
🔹 Reported To: Monero
🔹 Reported By: helping_bro
🔹 State: 🟢 Resolved
🔹 Disclosed: September 17, 2026, 5:42pm (UTC)
🐞 Source: HackerOne
The restricted ZMQ RPC in monerod did not enforce the same request restrictions as the restricted HTTP RPC. The ZMQ RPC relied primarily on a small method blocklist, allowing several allowed methods to accept requests that the restricted HTTP RPC explicitly rejected or capped. This issue was resolved in version 0.18.5.0.
👉 Read full report
sign_multisig crashes monero-wallet-rpc on a malformed but decryptable multisig txset
🔹 Severity: High
🔹 Reported To: Monero
🔹 Reported By: helping_bro
🔹 State: 🟢 Resolved
🔹 Disclosed: September 17, 2026, 5:45pm (UTC)
🐞 Source: HackerOne
The vulnerability in `monero-wallet-rpc`'s `sign_multisig` function allowed a malformed but decryptable multisig transaction set to cause a process crash instead of returning an error. The issue was resolved in version 0.18.5.0.
👉 Read full report
🔹 Severity: High
🔹 Reported To: Monero
🔹 Reported By: helping_bro
🔹 State: 🟢 Resolved
🔹 Disclosed: September 17, 2026, 5:45pm (UTC)
🐞 Source: HackerOne
The vulnerability in `monero-wallet-rpc`'s `sign_multisig` function allowed a malformed but decryptable multisig transaction set to cause a process crash instead of returning an error. The issue was resolved in version 0.18.5.0.
👉 Read full report
SSRF with bypass leads to client side hosting / vulnerabilities ( XSS and others )
🔹 Severity: Medium | 💰 500 USD
🔹 Weakness: Server-Side Request Forgery (SSRF)
🔹 Reported To: DuckDuckGo
🔹 Reported By: ferreiraklet_
🔹 State: 🟢 Resolved
🔹 Disclosed: September 17, 2026, 10:54pm (UTC)
🐞 Source: HackerOne
The web application was found to be vulnerable to server-side request forgery (SSRF). The SSRF vulnerability was discovered through testing with an HTTP interception proxy. The vulnerability allowed an attacker to make arbitrary HTTP requests from the server, which could potentially lead to unauthorized access or data exposure.
👉 Read full report
🔹 Severity: Medium | 💰 500 USD
🔹 Weakness: Server-Side Request Forgery (SSRF)
🔹 Reported To: DuckDuckGo
🔹 Reported By: ferreiraklet_
🔹 State: 🟢 Resolved
🔹 Disclosed: September 17, 2026, 10:54pm (UTC)
🐞 Source: HackerOne
The web application was found to be vulnerable to server-side request forgery (SSRF). The SSRF vulnerability was discovered through testing with an HTTP interception proxy. The vulnerability allowed an attacker to make arbitrary HTTP requests from the server, which could potentially lead to unauthorized access or data exposure.
👉 Read full report
Unauthenticated API allows reading, writing to and deleting any user's private chat history on ████████
🔹 Severity: Critical
🔹 Weakness: Misconfiguration
🔹 Reported To: Essity
🔹 Reported By: agusnicco
🔹 State: 🟢 Resolved
🔹 Disclosed: September 18, 2026, 6:04am (UTC)
🐞 Source: HackerOne
An unauthenticated API was discovered that allowed reading, writing to, and deleting any user's private chat history on the organization's internal chatbot application. The API had no authentication mechanism in place, allowing an attacker to list all conversations, retrieve the complete message history of any conversation, create new conversations, and delete any conversation. The deletion of a conversation was…
👉 Read full report
🔹 Severity: Critical
🔹 Weakness: Misconfiguration
🔹 Reported To: Essity
🔹 Reported By: agusnicco
🔹 State: 🟢 Resolved
🔹 Disclosed: September 18, 2026, 6:04am (UTC)
🐞 Source: HackerOne
An unauthenticated API was discovered that allowed reading, writing to, and deleting any user's private chat history on the organization's internal chatbot application. The API had no authentication mechanism in place, allowing an attacker to list all conversations, retrieve the complete message history of any conversation, create new conversations, and delete any conversation. The deletion of a conversation was…
👉 Read full report
Socket API drops expired timeouts for transfers queued behind a connection limit
🔹 Severity: No Rating
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: September 18, 2026, 6:33am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: No Rating
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: September 18, 2026, 6:33am (UTC)
🐞 Source: HackerOne
👉 Read full report
Persistent SMTP header injection via identity `organization` / `name`
🔹 Severity: None
🔹 Weakness: Buffer Under-read
🔹 Reported To: Nextcloud
🔹 Reported By: dogeshark
🔹 State: 🟢 Resolved
🔹 Disclosed: September 18, 2026, 1:24pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the Roundcube webmail client that allowed persistent SMTP header injection through the identity organization and name fields. The vulnerability was caused by insufficient validation of the user-supplied input, which resulted in the unfiltered data being stored and included in the email headers when sending messages. This issue could be exploited to inject arbitrary headers, such as…
👉 Read full report
🔹 Severity: None
🔹 Weakness: Buffer Under-read
🔹 Reported To: Nextcloud
🔹 Reported By: dogeshark
🔹 State: 🟢 Resolved
🔹 Disclosed: September 18, 2026, 1:24pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the Roundcube webmail client that allowed persistent SMTP header injection through the identity organization and name fields. The vulnerability was caused by insufficient validation of the user-supplied input, which resulted in the unfiltered data being stored and included in the email headers when sending messages. This issue could be exploited to inject arbitrary headers, such as…
👉 Read full report
files_lock: a write-share collaborator can place a TYPE_TOKEN lock that permanently denies the file owner, survives share revocation and account delet
🔹 Severity: Medium
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Nextcloud
🔹 Reported By: rz1027
🔹 State: 🟢 Resolved
🔹 Disclosed: September 18, 2026, 3:36pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in files_lock 33.0.4 on Nextcloud 33.0.3 that allowed a user with write-share permissions on a file to place a permanent lock on the file that could not be removed by the file owner or an administrator. The lock was stored in the database and persisted even after the collaborator's account was deleted or recreated. The only way to remove the lock was through direct database access…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Nextcloud
🔹 Reported By: rz1027
🔹 State: 🟢 Resolved
🔹 Disclosed: September 18, 2026, 3:36pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in files_lock 33.0.4 on Nextcloud 33.0.3 that allowed a user with write-share permissions on a file to place a permanent lock on the file that could not be removed by the file owner or an administrator. The lock was stored in the database and persisted even after the collaborator's account was deleted or recreated. The only way to remove the lock was through direct database access…
👉 Read full report
TELNET control and environment data bypass HTTPS-proxy TLS
🔹 Severity: No Rating
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: September 19, 2026, 8:36am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: No Rating
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: September 19, 2026, 8:36am (UTC)
🐞 Source: HackerOne
👉 Read full report
Use-after-free of the internal multi->admin easy handle via the documented CURLMOPT_NOTIFYFUNCTION callback
🔹 Severity: Medium
🔹 Weakness: Use After Free
🔹 Reported To: curl
🔹 Reported By: fengxiao
🔹 State: ⚪️ Informative
🔹 Disclosed: September 19, 2026, 8:36am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Use After Free
🔹 Reported To: curl
🔹 Reported By: fengxiao
🔹 State: ⚪️ Informative
🔹 Disclosed: September 19, 2026, 8:36am (UTC)
🐞 Source: HackerOne
👉 Read full report
HTTP/1.1 response framing violation and unsafe connection reuse when transfer decoding is disabled
🔹 Severity: Medium
🔹 Weakness: HTTP Request Smuggling
🔹 Reported To: curl
🔹 Reported By: thatcyberguyrich
🔹 State: ⚪️ Informative
🔹 Disclosed: September 19, 2026, 8:36am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: HTTP Request Smuggling
🔹 Reported To: curl
🔹 Reported By: thatcyberguyrich
🔹 State: ⚪️ Informative
🔹 Disclosed: September 19, 2026, 8:36am (UTC)
🐞 Source: HackerOne
👉 Read full report
Improper input validation in emoji field leads to sidebar UI denial of service
🔹 Severity: Low
🔹 Weakness: Business Logic Errors
🔹 Reported To: Nextcloud
🔹 Reported By: yoyomiski
🔹 State: 🟢 Resolved
🔹 Disclosed: September 20, 2026, 10:04am (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the Collectives app version 4.0.0 where the emoji field in the page emoji update endpoint did not properly validate user input. An attacker could have submitted an excessively long string including newline characters instead of a valid emoji, causing the sidebar layout to become broken.
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Business Logic Errors
🔹 Reported To: Nextcloud
🔹 Reported By: yoyomiski
🔹 State: 🟢 Resolved
🔹 Disclosed: September 20, 2026, 10:04am (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the Collectives app version 4.0.0 where the emoji field in the page emoji update endpoint did not properly validate user input. An attacker could have submitted an excessively long string including newline characters instead of a valid emoji, causing the sidebar layout to become broken.
👉 Read full report
Unauthenticated SQL injection in the `order` parameter - mars.nasa.gov `/api/v1/{news_items,events,missions}/`
🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: 0xJ0cKkY
🔹 State: 🟢 Resolved
🔹 Disclosed: September 23, 2026
🐞 Source: Bugcrowd
👉 Read full report
🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: 0xJ0cKkY
🔹 State: 🟢 Resolved
🔹 Disclosed: September 23, 2026
🐞 Source: Bugcrowd
👉 Read full report
NASA LSDA/NLSP Data Platform Allows Unauthenticated Write to Production Elasticsearch Cluster
🔹 Severity: High
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: spectreghost
🔹 State: 🟢 Resolved
🔹 Disclosed: September 23, 2026
🐞 Source: Bugcrowd
👉 Read full report
🔹 Severity: High
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: spectreghost
🔹 State: 🟢 Resolved
🔹 Disclosed: September 23, 2026
🐞 Source: Bugcrowd
👉 Read full report
HackerOne Code sends live password-reset tokens to Segment in automatic page events
🔹 Severity: Low | 💰 200 USD
🔹 Weakness: Insufficiently Protected Credentials
🔹 Reported To: HackerOne
🔹 Reported By: 1rhino2
🔹 State: 🟢 Resolved
🔹 Disclosed: September 24, 2026, 11:29am (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the HackerOne Code application, where opening a password-reset link automatically sent the complete unused 64-character reset token to Segment as the page loaded, before the reset form was submitted. The token was present in various fields of the Segment page event, which could potentially be accessed by anyone with read access to the Segment telemetry during the token's validity…
👉 Read full report
🔹 Severity: Low | 💰 200 USD
🔹 Weakness: Insufficiently Protected Credentials
🔹 Reported To: HackerOne
🔹 Reported By: 1rhino2
🔹 State: 🟢 Resolved
🔹 Disclosed: September 24, 2026, 11:29am (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the HackerOne Code application, where opening a password-reset link automatically sent the complete unused 64-character reset token to Segment as the page loaded, before the reset form was submitted. The token was present in various fields of the Segment page event, which could potentially be accessed by anyone with read access to the Segment telemetry during the token's validity…
👉 Read full report
Windows filename sanitizer misses Unicode COM/LPT reserved device names
🔹 Severity: None
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: September 24, 2026, 2:02pm (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: None
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: ⚪️ Informative
🔹 Disclosed: September 24, 2026, 2:02pm (UTC)
🐞 Source: HackerOne
👉 Read full report
Missing applicability validation allows non-applicable HTTPS RR to reach ECH processing
🔹 Severity: Medium
🔹 Weakness: Business Logic Errors
🔹 Reported To: curl
🔹 Reported By: m4nray
🔹 State: 🔴 N/A
🔹 Disclosed: September 26, 2026, 8:35am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Business Logic Errors
🔹 Reported To: curl
🔹 Reported By: m4nray
🔹 State: 🔴 N/A
🔹 Disclosed: September 26, 2026, 8:35am (UTC)
🐞 Source: HackerOne
👉 Read full report
[HIGH] CWE-22 — Path Traversal in FTP Wildcard Download via Unencoded `.` in Escaped Filenames
🔹 Severity: High
🔹 Weakness: Path Traversal
🔹 Reported To: curl
🔹 Reported By: mrtomato
🔹 State: ⚪️ Informative
🔹 Disclosed: September 26, 2026, 8:35am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: High
🔹 Weakness: Path Traversal
🔹 Reported To: curl
🔹 Reported By: mrtomato
🔹 State: ⚪️ Informative
🔹 Disclosed: September 26, 2026, 8:35am (UTC)
🐞 Source: HackerOne
👉 Read full report
Unauthenticated disclosure of draft/private/pending post titles & IDs via Secure Custom Fields nopriv AJAX field-query handlers (post_object/relations
🔹 Severity: Medium
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: WordPress
🔹 Reported By: jakubk
🔹 State: 🟢 Resolved
🔹 Disclosed: September 28, 2026, 11:14am (UTC)
🐞 Source: HackerOne
The Secure Custom Fields plugin in version 6.9.2 registered unauthenticated AJAX query handlers for the post_object, relationship, and page_link field types. These handlers ran a WordPress query with the post_status parameter set to "any", which returned draft, pending, private, and future posts without any capability or permission filtering. When these fields were rendered on a public-facing front-end form, the…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: WordPress
🔹 Reported By: jakubk
🔹 State: 🟢 Resolved
🔹 Disclosed: September 28, 2026, 11:14am (UTC)
🐞 Source: HackerOne
The Secure Custom Fields plugin in version 6.9.2 registered unauthenticated AJAX query handlers for the post_object, relationship, and page_link field types. These handlers ran a WordPress query with the post_status parameter set to "any", which returned draft, pending, private, and future posts without any capability or permission filtering. When these fields were rendered on a public-facing front-end form, the…
👉 Read full report
Backdooring the next release of Codex through Github Action Pipeline exploit chaining
🔹 Severity: Critical
🔹 Reported To: OpenAI
🔹 Reported By: W0rty
🔹 State: 🟢 Resolved
🔹 Disclosed: September 29, 2026
🐞 Source: Bugcrowd
👉 Read full report
🔹 Severity: Critical
🔹 Reported To: OpenAI
🔹 Reported By: W0rty
🔹 State: 🟢 Resolved
🔹 Disclosed: September 29, 2026
🐞 Source: Bugcrowd
👉 Read full report