SSRF on Nextcloud Whiteboard Application via Recordings to Unauthorised Access to Whiteboards

🔹 Severity: Medium | 💰 250 USD
🔹 Weakness: Server-Side Request Forgery (SSRF)
🔹 Reported To: Nextcloud
🔹 Reported By: alex-elttam
🔹 State: 🟢 Resolved
🔹 Disclosed: October 27, 2026, 11:26am (UTC)
🐞 Source: HackerOne

👉 Read full report

FederationController::remoteWopiToken() returns full Wopi entity without token type validation

🔹 Severity: Low
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Nextcloud
🔹 Reported By: bornwinnerrr
🔹 State: 🟢 Resolved
🔹 Disclosed: October 27, 2026, 11:33am (UTC)
🐞 Source: HackerOne

👉 Read full report

Authorization flaw allows Bugcrowd staff to create customer only comments via API

🔹 Severity: Low
🔹 Reported To: Bugcrowd
🔹 Reported By: drunkrhin0
🔹 State: 🟠 Unresolved
🔹 Disclosed: October 27, 2026
🐞 Source: Bugcrowd

👉 Read full report

Launchpad file read leaks production keys

🔹 Severity: Critical
🔹 Weakness: Path Traversal
🔹 Reported To: Basecamp
🔹 Reported By: bl0rph
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026, 4:53am (UTC)
🐞 Source: HackerOne

A file-read vulnerability in a platform exposed production storage credentials. The vulnerable processing path was fixed, exposed credentials were rotated, and the old key was deleted.

👉 Read full report

Cross-account XSS on app.basecamp.com: oEmbed option injection chained through Turbo defeats the CSP nonce

🔹 Severity: High
🔹 Weakness: Cross-site Scripting (XSS) - Generic
🔹 Reported To: Basecamp
🔹 Reported By: deivizzzz
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026, 4:58am (UTC)
🐞 Source: HackerOne

A cross-account cross-site scripting vulnerability was discovered in an embed display endpoint that rendered attacker-supplied HTML verbatim on the application origin without proper authentication checks. The vulnerability could be exploited by crafting a malicious embed with injected HTML and JavaScript that would execute with the victim's privileges when the embed was accessed. The vulnerability was chained with…

👉 Read full report

GraphQL read resolvers and Metabase embed endpoint return full business data to Viewer role

🔹 Severity: Low
🔹 Reported To: Settle Vulnerability Disclosure Program
🔹 Reported By: Albinj
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

GraphQL label settings operations allow Viewer role changes

🔹 Severity: Low
🔹 Reported To: Settle Vulnerability Disclosure Program
🔹 Reported By: Albinj
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Unauthenticated Account Takeover on NASA SMCE Identity Provider (Keycloak CVE-2026-18963)

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: Shisones
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Reflected XSS in trek.nasa.gov TrekWS /rest/light endpoint via unescaped et (date) parameter

🔹 Severity: Medium
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: itz_madhusankha
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Unauthenticated remote code execution on psg.gsfc.nasa.gov via arbitrary file write from a stack overflow in the PSG continuum module (SURFACE-TYPE)

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: metantz
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

[Scan For Good] Unauthenticated Oracle SQL Injection in Solar System Treks Email Check API

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: ScanForGood
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Content Spoofing via Broken Link Hijacking on science.nasa.gov

🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: AbdulRahman-lx
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Content spoofing via Broken Link Hijacking @kwinkunks

🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: AbdulRahman-lx
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Broken Link Hijacking: Unclaimed Social Media Handle (@visualisingdata)

🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: AbdulRahman-lx
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Content Spoofing / Impersonation via Broken Link Hijacking on Science NASA Earth Observatory

🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: AbdulRahman-lx
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Content spoofing via Broken Link Hijacking on science.nasa.gov

🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: AbdulRahman-lx
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Email-Triggering Abuse: Custom Content Injection & Email Bombing via Official NASA Domain due to Missing CSRF

🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: sukmaaderamdani
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Monero IPv6 /128 tracking bypasses per-IP limit, enables remote OOM

🔹 Severity: High
🔹 Weakness: Uncontrolled Resource Consumption
🔹 Reported To: Monero
🔹 Reported By: belair
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026, 8:13pm (UTC)
🐞 Source: HackerOne

Monero's IPv6 connection tracking used individual /128 addresses, which allowed the per-IP RPC connection limit to be bypassed by using multiple IPv6 addresses. This undermined the intended connection restrictions for IPv6 clients and was resolved in version 0.18.5.3.

👉 Read full report

Revoked deployment collaborator regains access to private comments after active collaborator interaction

🔹 Severity: Medium | 💰 1,026 USD
🔹 Weakness: Access Control Check Implemented After Asset is Accessed
🔹 Reported To: Vercel
🔹 Reported By: qub
🔹 State: 🟢 Resolved
🔹 Disclosed: October 29, 2026, 8:25am (UTC)
🐞 Source: HackerOne

A revoked deployment collaborator was able to regain access to private collaboration data after an active collaborator interacted with the deployment toolbar. After a collaborator's authorization was revoked and their token became invalid, a subsequent interaction by an active collaborator caused the revoked token to become authorized again. This allowed the revoked user to access the synchronization endpoint and…

👉 Read full report

Translation discovery crashes on crafted filenames (regex substitution injection)

🔹 Severity: Low
🔹 Weakness: Use of Externally-Controlled Format String
🔹 Reported To: Weblate
🔹 Reported By: sumit-sabhaya
🔹 State: 🟢 Resolved
🔹 Disclosed: October 30, 2026, 5:07am (UTC)
🐞 Source: HackerOne

A translation discovery package was vulnerable to a regular expression injection attack through crafted filenames. When processing repository files, the package interpolated user-controlled filename components into regex replacement strings without proper escaping. Filenames containing backslash sequences like backslash-g-angle-bracket-99-angle-bracket were interpreted as regex backreferences, causing the regex…

👉 Read full report

wlc: Project-wide download fails part-way and leaves stale archives on disk; filesystem errors surface as raw Python tracebacks.

🔹 Severity: Low
🔹 Weakness: Information Exposure Through an Error Message
🔹 Reported To: Weblate
🔹 Reported By: sumit-sabhaya
🔹 State: 🟢 Resolved
🔹 Disclosed: October 30, 2026, 5:07am (UTC)
🐞 Source: HackerOne

The wlc command-line client did not properly handle filesystem errors, which caused two distinct issues. First, when project-wide downloads failed partway through, already-written archives were left on disk with no report of which components succeeded or failed, making it impossible to distinguish complete results from partial ones. Second, any filesystem error such as permission denied, file exists, or file not…

👉 Read full report