Users with read-only access to a Nextcloud Table can enumerate its share recipients via the Tables API

🔹 Severity: Low
🔹 Weakness: Information Disclosure
🔹 Reported To: Nextcloud
🔹 Reported By: yoyomiski
🔹 State: 🟢 Resolved
🔹 Disclosed: October 27, 2026, 11:19am (UTC)
🐞 Source: HackerOne

👉 Read full report

Tables application does not respect sharing limitations set by admin

🔹 Severity: Medium
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Nextcloud
🔹 Reported By: samin_zavarkesh
🔹 State: 🟢 Resolved
🔹 Disclosed: October 27, 2026, 11:22am (UTC)
🐞 Source: HackerOne

👉 Read full report

SSRF on Nextcloud Whiteboard Application via Recordings to Unauthorised Access to Whiteboards

🔹 Severity: Medium | 💰 250 USD
🔹 Weakness: Server-Side Request Forgery (SSRF)
🔹 Reported To: Nextcloud
🔹 Reported By: alex-elttam
🔹 State: 🟢 Resolved
🔹 Disclosed: October 27, 2026, 11:26am (UTC)
🐞 Source: HackerOne

👉 Read full report

FederationController::remoteWopiToken() returns full Wopi entity without token type validation

🔹 Severity: Low
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Nextcloud
🔹 Reported By: bornwinnerrr
🔹 State: 🟢 Resolved
🔹 Disclosed: October 27, 2026, 11:33am (UTC)
🐞 Source: HackerOne

👉 Read full report

Authorization flaw allows Bugcrowd staff to create customer only comments via API

🔹 Severity: Low
🔹 Reported To: Bugcrowd
🔹 Reported By: drunkrhin0
🔹 State: 🟠 Unresolved
🔹 Disclosed: October 27, 2026
🐞 Source: Bugcrowd

👉 Read full report

Launchpad file read leaks production keys

🔹 Severity: Critical
🔹 Weakness: Path Traversal
🔹 Reported To: Basecamp
🔹 Reported By: bl0rph
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026, 4:53am (UTC)
🐞 Source: HackerOne

A file-read vulnerability in a platform exposed production storage credentials. The vulnerable processing path was fixed, exposed credentials were rotated, and the old key was deleted.

👉 Read full report

Cross-account XSS on app.basecamp.com: oEmbed option injection chained through Turbo defeats the CSP nonce

🔹 Severity: High
🔹 Weakness: Cross-site Scripting (XSS) - Generic
🔹 Reported To: Basecamp
🔹 Reported By: deivizzzz
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026, 4:58am (UTC)
🐞 Source: HackerOne

A cross-account cross-site scripting vulnerability was discovered in an embed display endpoint that rendered attacker-supplied HTML verbatim on the application origin without proper authentication checks. The vulnerability could be exploited by crafting a malicious embed with injected HTML and JavaScript that would execute with the victim's privileges when the embed was accessed. The vulnerability was chained with…

👉 Read full report

GraphQL read resolvers and Metabase embed endpoint return full business data to Viewer role

🔹 Severity: Low
🔹 Reported To: Settle Vulnerability Disclosure Program
🔹 Reported By: Albinj
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

GraphQL label settings operations allow Viewer role changes

🔹 Severity: Low
🔹 Reported To: Settle Vulnerability Disclosure Program
🔹 Reported By: Albinj
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Unauthenticated Account Takeover on NASA SMCE Identity Provider (Keycloak CVE-2026-18963)

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: Shisones
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Reflected XSS in trek.nasa.gov TrekWS /rest/light endpoint via unescaped et (date) parameter

🔹 Severity: Medium
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: itz_madhusankha
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Unauthenticated remote code execution on psg.gsfc.nasa.gov via arbitrary file write from a stack overflow in the PSG continuum module (SURFACE-TYPE)

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: metantz
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

[Scan For Good] Unauthenticated Oracle SQL Injection in Solar System Treks Email Check API

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: ScanForGood
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Content Spoofing via Broken Link Hijacking on science.nasa.gov

🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: AbdulRahman-lx
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Content spoofing via Broken Link Hijacking @kwinkunks

🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: AbdulRahman-lx
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Broken Link Hijacking: Unclaimed Social Media Handle (@visualisingdata)

🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: AbdulRahman-lx
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Content Spoofing / Impersonation via Broken Link Hijacking on Science NASA Earth Observatory

🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: AbdulRahman-lx
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Content spoofing via Broken Link Hijacking on science.nasa.gov

🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: AbdulRahman-lx
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Email-Triggering Abuse: Custom Content Injection & Email Bombing via Official NASA Domain due to Missing CSRF

🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: sukmaaderamdani
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Monero IPv6 /128 tracking bypasses per-IP limit, enables remote OOM

🔹 Severity: High
🔹 Weakness: Uncontrolled Resource Consumption
🔹 Reported To: Monero
🔹 Reported By: belair
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026, 8:13pm (UTC)
🐞 Source: HackerOne

Monero's IPv6 connection tracking used individual /128 addresses, which allowed the per-IP RPC connection limit to be bypassed by using multiple IPv6 addresses. This undermined the intended connection restrictions for IPv6 clients and was resolved in version 0.18.5.3.

👉 Read full report

Revoked deployment collaborator regains access to private comments after active collaborator interaction

🔹 Severity: Medium | 💰 1,026 USD
🔹 Weakness: Access Control Check Implemented After Asset is Accessed
🔹 Reported To: Vercel
🔹 Reported By: qub
🔹 State: 🟢 Resolved
🔹 Disclosed: October 29, 2026, 8:25am (UTC)
🐞 Source: HackerOne

A revoked deployment collaborator was able to regain access to private collaboration data after an active collaborator interacted with the deployment toolbar. After a collaborator's authorization was revoked and their token became invalid, a subsequent interaction by an active collaborator caused the revoked token to become authorized again. This allowed the revoked user to access the synchronization endpoint and…

👉 Read full report