Cross-account XSS on app.basecamp.com: oEmbed option injection chained through Turbo defeats the CSP nonce

🔹 Severity: High
🔹 Weakness: Cross-site Scripting (XSS) - Generic
🔹 Reported To: Basecamp
🔹 Reported By: deivizzzz
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026, 4:58am (UTC)
🐞 Source: HackerOne

A cross-account cross-site scripting vulnerability was discovered in an embed display endpoint that rendered attacker-supplied HTML verbatim on the application origin without proper authentication checks. The vulnerability could be exploited by crafting a malicious embed with injected HTML and JavaScript that would execute with the victim's privileges when the embed was accessed. The vulnerability was chained with…

👉 Read full report

GraphQL read resolvers and Metabase embed endpoint return full business data to Viewer role

🔹 Severity: Low
🔹 Reported To: Settle Vulnerability Disclosure Program
🔹 Reported By: Albinj
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

GraphQL label settings operations allow Viewer role changes

🔹 Severity: Low
🔹 Reported To: Settle Vulnerability Disclosure Program
🔹 Reported By: Albinj
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Unauthenticated Account Takeover on NASA SMCE Identity Provider (Keycloak CVE-2026-18963)

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: Shisones
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Reflected XSS in trek.nasa.gov TrekWS /rest/light endpoint via unescaped et (date) parameter

🔹 Severity: Medium
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: itz_madhusankha
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Unauthenticated remote code execution on psg.gsfc.nasa.gov via arbitrary file write from a stack overflow in the PSG continuum module (SURFACE-TYPE)

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: metantz
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

[Scan For Good] Unauthenticated Oracle SQL Injection in Solar System Treks Email Check API

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: ScanForGood
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Content Spoofing via Broken Link Hijacking on science.nasa.gov

🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: AbdulRahman-lx
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Content spoofing via Broken Link Hijacking @kwinkunks

🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: AbdulRahman-lx
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Broken Link Hijacking: Unclaimed Social Media Handle (@visualisingdata)

🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: AbdulRahman-lx
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Content Spoofing / Impersonation via Broken Link Hijacking on Science NASA Earth Observatory

🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: AbdulRahman-lx
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Content spoofing via Broken Link Hijacking on science.nasa.gov

🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: AbdulRahman-lx
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Email-Triggering Abuse: Custom Content Injection & Email Bombing via Official NASA Domain due to Missing CSRF

🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: sukmaaderamdani
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd

👉 Read full report

Monero IPv6 /128 tracking bypasses per-IP limit, enables remote OOM

🔹 Severity: High
🔹 Weakness: Uncontrolled Resource Consumption
🔹 Reported To: Monero
🔹 Reported By: belair
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026, 8:13pm (UTC)
🐞 Source: HackerOne

Monero's IPv6 connection tracking used individual /128 addresses, which allowed the per-IP RPC connection limit to be bypassed by using multiple IPv6 addresses. This undermined the intended connection restrictions for IPv6 clients and was resolved in version 0.18.5.3.

👉 Read full report

Revoked deployment collaborator regains access to private comments after active collaborator interaction

🔹 Severity: Medium | 💰 1,026 USD
🔹 Weakness: Access Control Check Implemented After Asset is Accessed
🔹 Reported To: Vercel
🔹 Reported By: qub
🔹 State: 🟢 Resolved
🔹 Disclosed: October 29, 2026, 8:25am (UTC)
🐞 Source: HackerOne

A revoked deployment collaborator was able to regain access to private collaboration data after an active collaborator interacted with the deployment toolbar. After a collaborator's authorization was revoked and their token became invalid, a subsequent interaction by an active collaborator caused the revoked token to become authorized again. This allowed the revoked user to access the synchronization endpoint and…

👉 Read full report

Translation discovery crashes on crafted filenames (regex substitution injection)

🔹 Severity: Low
🔹 Weakness: Use of Externally-Controlled Format String
🔹 Reported To: Weblate
🔹 Reported By: sumit-sabhaya
🔹 State: 🟢 Resolved
🔹 Disclosed: October 30, 2026, 5:07am (UTC)
🐞 Source: HackerOne

A translation discovery package was vulnerable to a regular expression injection attack through crafted filenames. When processing repository files, the package interpolated user-controlled filename components into regex replacement strings without proper escaping. Filenames containing backslash sequences like backslash-g-angle-bracket-99-angle-bracket were interpreted as regex backreferences, causing the regex…

👉 Read full report

wlc: Project-wide download fails part-way and leaves stale archives on disk; filesystem errors surface as raw Python tracebacks.

🔹 Severity: Low
🔹 Weakness: Information Exposure Through an Error Message
🔹 Reported To: Weblate
🔹 Reported By: sumit-sabhaya
🔹 State: 🟢 Resolved
🔹 Disclosed: October 30, 2026, 5:07am (UTC)
🐞 Source: HackerOne

The wlc command-line client did not properly handle filesystem errors, which caused two distinct issues. First, when project-wide downloads failed partway through, already-written archives were left on disk with no report of which components succeeded or failed, making it impossible to distinguish complete results from partial ones. Second, any filesystem error such as permission denied, file exists, or file not…

👉 Read full report

Incomplete VCS metadata exclusion: `.svn` / `.bzr` bypass CVE-2026-61792 due to missing `VCS_METADATA_DIRS` entries.

🔹 Severity: Medium
🔹 Weakness: Path Traversal
🔹 Reported To: Weblate
🔹 Reported By: sumit-sabhaya
🔹 State: 🟢 Resolved
🔹 Disclosed: October 30, 2026, 5:08am (UTC)
🐞 Source: HackerOne

A translation management application contained incomplete VCS metadata exclusion in its ZIP download feature. The exclusion mechanism only covered Git and Mercurial metadata directories but failed to exclude Subversion and Bazaar metadata directories. This gap allowed Subversion and Bazaar metadata files, including working-copy databases and credential cache entries, to be included in downloaded archives when such…

👉 Read full report

A third-party Basecamp OAuth token mints a full launchpad web session through GET /my/login_option

🔹 Severity: High
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Basecamp
🔹 Reported By: deivizzzz
🔹 State: 🟢 Resolved
🔹 Disclosed: October 30, 2026, 11:07am (UTC)
🐞 Source: HackerOne

A third-party OAuth token was able to mint a full web session through an API endpoint, allowing an integration to obtain unauthorized session access and modify account settings. The vulnerability has been patched to only accept authorized session tokens.

👉 Read full report

Cross-account webhook takeover: PUT and DELETE on /<account>/webhooks/<id>.json reach another account's webhook

🔹 Severity: High
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: Basecamp
🔹 Reported By: deivizzzz
🔹 State: 🟢 Resolved
🔹 Disclosed: October 30, 2026, 11:08am (UTC)
🐞 Source: HackerOne

A cross-account webhook takeover vulnerability was identified in Basecamp's webhook API endpoints. The PUT and DELETE operations on webhook resources were authorizing based on project visibility rather than account membership. This allowed an attacker from one account to modify and delete webhooks belonging to another account when the victim's project was configured with all-access permissions. The vulnerability…

👉 Read full report

launchpad.37signals.com OAuth AS issues victim-bound credential to unverified attacker redirect → full CIA triad on Basecamp API

🔹 Severity: High
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: Basecamp
🔹 Reported By: rootaccessxvv
🔹 State: 🟢 Resolved
🔹 Disclosed: October 30, 2026, 1:40pm (UTC)
🐞 Source: HackerOne

A custom OAuth2 authorization server was found to issue victim-bound API credentials to unverified attacker-controlled redirect URIs. The authorization server accepted client registrations with self-chosen redirect URIs without performing ownership verification, ownership approval, or URI structure validation. During authorization, the server treated these unverified URIs as trusted redirect destinations. The…

👉 Read full report