Unauthorised access with hidden public link creation when sharing to a Team External Member

🔹 Severity: Low | 💰 100 USD
🔹 Weakness: Privilege Escalation
🔹 Reported To: Nextcloud
🔹 Reported By: fadalika
🔹 State: 🟢 Resolved
🔹 Disclosed: October 27, 2026, 11:10am (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in the sharing functionality where unauthorized access could be gained through the creation of hidden public links when sharing content to a team external member.

👉 Read full report

Unauthorized users can enumerate internal team resources via the Teams API when a team is visible to everyone

🔹 Severity: Medium
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Nextcloud
🔹 Reported By: yoyomiski
🔹 State: 🟢 Resolved
🔹 Disclosed: October 27, 2026, 11:17am (UTC)
🐞 Source: HackerOne

👉 Read full report

Users with read-only access to a Nextcloud Table can enumerate its share recipients via the Tables API

🔹 Severity: Low
🔹 Weakness: Information Disclosure
🔹 Reported To: Nextcloud
🔹 Reported By: yoyomiski
🔹 State: 🟢 Resolved
🔹 Disclosed: October 27, 2026, 11:19am (UTC)
🐞 Source: HackerOne

👉 Read full report

Tables application does not respect sharing limitations set by admin

🔹 Severity: Medium
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Nextcloud
🔹 Reported By: samin_zavarkesh
🔹 State: 🟢 Resolved
🔹 Disclosed: October 27, 2026, 11:22am (UTC)
🐞 Source: HackerOne

👉 Read full report

SSRF on Nextcloud Whiteboard Application via Recordings to Unauthorised Access to Whiteboards

🔹 Severity: Medium | 💰 250 USD
🔹 Weakness: Server-Side Request Forgery (SSRF)
🔹 Reported To: Nextcloud
🔹 Reported By: alex-elttam
🔹 State: 🟢 Resolved
🔹 Disclosed: October 27, 2026, 11:26am (UTC)
🐞 Source: HackerOne

👉 Read full report

FederationController::remoteWopiToken() returns full Wopi entity without token type validation

🔹 Severity: Low
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Nextcloud
🔹 Reported By: bornwinnerrr
🔹 State: 🟢 Resolved
🔹 Disclosed: October 27, 2026, 11:33am (UTC)
🐞 Source: HackerOne

👉 Read full report

Authorization flaw allows Bugcrowd staff to create customer only comments via API

🔹 Severity: Low
🔹 Reported To: Bugcrowd
🔹 Reported By: drunkrhin0
🔹 State: 🟠 Unresolved
🔹 Disclosed: October 27, 2026
🐞 Source: Bugcrowd

👉 Read full report

Launchpad file read leaks production keys

🔹 Severity: Critical
🔹 Weakness: Path Traversal
🔹 Reported To: Basecamp
🔹 Reported By: bl0rph
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026, 4:53am (UTC)
🐞 Source: HackerOne

A file-read vulnerability in a platform exposed production storage credentials. The vulnerable processing path was fixed, exposed credentials were rotated, and the old key was deleted.

👉 Read full report

Cross-account XSS on app.basecamp.com: oEmbed option injection chained through Turbo defeats the CSP nonce

🔹 Severity: High
🔹 Weakness: Cross-site Scripting (XSS) - Generic
🔹 Reported To: Basecamp
🔹 Reported By: deivizzzz
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026, 4:58am (UTC)
🐞 Source: HackerOne

A cross-account cross-site scripting vulnerability was discovered in an embed display endpoint that rendered attacker-supplied HTML verbatim on the application origin without proper authentication checks. The vulnerability could be exploited by crafting a malicious embed with injected HTML and JavaScript that would execute with the victim's privileges when the embed was accessed. The vulnerability was chained with…

👉 Read full report

GraphQL read resolvers and Metabase embed endpoint return full business data to Viewer role

🔹 Severity: Low
🔹 Reported To: Settle Vulnerability Disclosure Program
🔹 Reported By: Albinj
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

GraphQL label settings operations allow Viewer role changes

🔹 Severity: Low
🔹 Reported To: Settle Vulnerability Disclosure Program
🔹 Reported By: Albinj
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Unauthenticated Account Takeover on NASA SMCE Identity Provider (Keycloak CVE-2026-18963)

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: Shisones
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Reflected XSS in trek.nasa.gov TrekWS /rest/light endpoint via unescaped et (date) parameter

🔹 Severity: Medium
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: itz_madhusankha
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Unauthenticated remote code execution on psg.gsfc.nasa.gov via arbitrary file write from a stack overflow in the PSG continuum module (SURFACE-TYPE)

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: metantz
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

[Scan For Good] Unauthenticated Oracle SQL Injection in Solar System Treks Email Check API

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: ScanForGood
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Content Spoofing via Broken Link Hijacking on science.nasa.gov

🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: AbdulRahman-lx
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Content spoofing via Broken Link Hijacking @kwinkunks

🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: AbdulRahman-lx
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Broken Link Hijacking: Unclaimed Social Media Handle (@visualisingdata)

🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: AbdulRahman-lx
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Content Spoofing / Impersonation via Broken Link Hijacking on Science NASA Earth Observatory

🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: AbdulRahman-lx
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Content spoofing via Broken Link Hijacking on science.nasa.gov

🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: AbdulRahman-lx
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Email-Triggering Abuse: Custom Content Injection & Email Bombing via Official NASA Domain due to Missing CSRF

🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: sukmaaderamdani
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report