Windows SSPI connection-pool probe can reuse a connection under the wrong user

🔹 Severity: Medium
🔹 Weakness: Authentication Bypass by Spoofing
🔹 Reported To: curl
🔹 Reported By: mr4bugs
🔹 State: 🔴 N/A
🔹 Disclosed: October 26, 2026, 9:09am (UTC)
🐞 Source: HackerOne

👉 Read full report

20: HTAB before `Secure` attribute silently drops the Secure cookie flag

🔹 Severity: No Rating
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: 🔵 Duplicate
🔹 Disclosed: October 26, 2026, 9:10am (UTC)
🐞 Source: HackerOne

👉 Read full report

14: HSTS cache import silently drops a longer-lived child beneath an includeSubDomains parent

🔹 Severity: No Rating
🔹 Weakness: Cleartext Transmission of Sensitive Information
🔹 Reported To: curl
🔹 Reported By: giant_anteater
🔹 State: 🔵 Duplicate
🔹 Disclosed: October 26, 2026, 9:10am (UTC)
🐞 Source: HackerOne

👉 Read full report

FTP authentication options leak to a cross-origin FTP redirect with unrestricted auth disabled

🔹 Severity: Low
🔹 Weakness: Insufficiently Protected Credentials
🔹 Reported To: curl
🔹 Reported By: galcan
🔹 State: 🔴 N/A
🔹 Disclosed: October 26, 2026, 9:10am (UTC)
🐞 Source: HackerOne

👉 Read full report

OpenSSL provider OSSL_LIB_CTX used after free via the connection shutdown list (CVE-2026-80229 fix incomplete)

🔹 Severity: Low
🔹 Weakness: Use After Free
🔹 Reported To: curl
🔹 Reported By: sujitjaunjal
🔹 State: 🔵 Duplicate
🔹 Disclosed: October 26, 2026, 9:10am (UTC)
🐞 Source: HackerOne

👉 Read full report

A disabled account's API key still works on BMO's Mojolicious /rest/ routes, including for security-group bugs filed after the disable

🔹 Severity: High | 💰 4,000 USD
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: Mozilla
🔹 Reported By: timhaines
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026, 10:49am (UTC)
🐞 Source: HackerOne

A Bugzilla instance had inconsistent authentication validation across its API implementations. The newer REST routes failed to verify account status when processing API keys, while the legacy REST API and web interface correctly rejected disabled accounts. This allowed disabled accounts' API keys to remain functional on the newer routes, including for security-sensitive bug operations. The vulnerability was…

👉 Read full report

Vercel subdomain takeover — capitalcalc.settle.com & embed.settle.com

🔹 Severity: Medium
🔹 Reported To: Settle Vulnerability Disclosure Program
🔹 Reported By: jagdishpandey
🔹 State: 🟢 Resolved
🔹 Disclosed: October 26, 2026
🐞 Source: Bugcrowd

👉 Read full report

Cross-protocol redirect to imap:// or smtp:// uploads the -F/MIMEPOST form and the custom Authorization/Cookie headers to the redirect target

🔹 Severity: Low
🔹 Weakness: Information Exposure Through Sent Data
🔹 Reported To: curl
🔹 Reported By: sujitjaunjal
🔹 State: 🔴 N/A
🔹 Disclosed: October 26, 2026, 12:50pm (UTC)
🐞 Source: HackerOne

👉 Read full report

OpenSSL+Apple SecTrust: SecTrust accepts certificates that the app's CURLOPT_SSL_CTX_FUNCTION trust store or verify callback rejected

🔹 Severity: Low
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: curl
🔹 Reported By: sujitjaunjal
🔹 State: 🔴 N/A
🔹 Disclosed: October 26, 2026, 12:50pm (UTC)
🐞 Source: HackerOne

👉 Read full report

GnuTLS + Apple SecTrust discards authenticated OCSP failure

🔹 Severity: Medium
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: curl
🔹 Reported By: stze
🔹 State: 🔴 N/A
🔹 Disclosed: October 26, 2026, 12:50pm (UTC)
🐞 Source: HackerOne

👉 Read full report

OpenSSL `--cert-status` accepts indefinitely stale GOOD OCSP staples

🔹 Severity: Medium
🔹 Weakness: Improper Check for Certificate Revocation
🔹 Reported To: curl
🔹 Reported By: stze
🔹 State: 🔴 N/A
🔹 Disclosed: October 26, 2026, 12:50pm (UTC)
🐞 Source: HackerOne

👉 Read full report

wolfSSL TLS sessions retain native-CA trust after the application narrows trust

🔹 Severity: Low
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: curl
🔹 Reported By: stze
🔹 State: ⚪️ Informative
🔹 Disclosed: October 26, 2026, 12:50pm (UTC)
🐞 Source: HackerOne

👉 Read full report

netrc credentials leaked to a cross-host redirect target on the Basic auth path (not covered by redirect credential protections)

🔹 Severity: Medium
🔹 Weakness: Insufficiently Protected Credentials
🔹 Reported To: curl
🔹 Reported By: noraqiu
🔹 State: 🔴 N/A
🔹 Disclosed: October 26, 2026, 12:50pm (UTC)
🐞 Source: HackerOne

👉 Read full report

Permission Model filesystem over-grant via wildcard radix lookup

🔹 Severity: Low
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Node.js
🔹 Reported By: malikhamzaiqbal
🔹 State: 🟢 Resolved
🔹 Disclosed: October 27, 2026, 7:06am (UTC)
🐞 Source: HackerOne

A flaw was discovered in Node.js Permission Model filesystem enforcement that allowed access to be granted to paths not matching wildcard read or write rules. When a requested path was shorter than the prefix of a wildcard grant, the radix tree lookup would stop comparing early and incorrectly treat the path as a match. This issue affected wildcard grants positioned directly under the root of the permission tree…

👉 Read full report

Incomplete IDN hostname check on the transfer path can lead to credential disclosure to an unintended host

🔹 Severity: Low
🔹 Reported To: curl
🔹 Reported By: christos_eth
🔹 State: ⚪️ Informative
🔹 Disclosed: October 27, 2026, 7:53am (UTC)
🐞 Source: HackerOne

👉 Read full report

No password confirmation required when using apptoken on sensitive endpoint

🔹 Severity: Medium
🔹 Weakness: Improper Privilege Management
🔹 Reported To: Nextcloud
🔹 Reported By: npc
🔹 State: 🟢 Resolved
🔹 Disclosed: October 27, 2026, 10:40am (UTC)
🐞 Source: HackerOne

👉 Read full report

Unauthenticated Persistent Denial-of-Service via Federated Share Injection

🔹 Severity: High
🔹 Weakness: Uncontrolled Resource Consumption
🔹 Reported To: Nextcloud
🔹 Reported By: ncsc_nl
🔹 State: 🟢 Resolved
🔹 Disclosed: October 27, 2026, 10:43am (UTC)
🐞 Source: HackerOne

👉 Read full report

Public shares remain accessible via alternate endpoints after owner account is disabled

🔹 Severity: Medium | 💰 270 USD
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Nextcloud
🔹 Reported By: blinkyyy
🔹 State: 🟢 Resolved
🔹 Disclosed: October 27, 2026, 10:50am (UTC)
🐞 Source: HackerOne

👉 Read full report

Files Confidential tagging can be bypassed with # in filename

🔹 Severity: Medium
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Nextcloud
🔹 Reported By: xavlimsg
🔹 State: 🟢 Resolved
🔹 Disclosed: October 27, 2026, 11:00am (UTC)
🐞 Source: HackerOne

👉 Read full report

Unauthorised access with hidden public link creation when sharing to a Team External Member

🔹 Severity: Low | 💰 100 USD
🔹 Weakness: Privilege Escalation
🔹 Reported To: Nextcloud
🔹 Reported By: fadalika
🔹 State: 🟢 Resolved
🔹 Disclosed: October 27, 2026, 11:10am (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in the sharing functionality where unauthorized access could be gained through the creation of hidden public links when sharing content to a team external member.

👉 Read full report

Unauthorized users can enumerate internal team resources via the Teams API when a team is visible to everyone

🔹 Severity: Medium
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Nextcloud
🔹 Reported By: yoyomiski
🔹 State: 🟢 Resolved
🔹 Disclosed: October 27, 2026, 11:17am (UTC)
🐞 Source: HackerOne

👉 Read full report