Email-Triggering Abuse: Custom Content Injection & Email Bombing via Official NASA Domain due to Missing CSRF
🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: sukmaaderamdani
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd
👉 Read full report
🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: sukmaaderamdani
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026
🐞 Source: Bugcrowd
👉 Read full report
Monero IPv6 /128 tracking bypasses per-IP limit, enables remote OOM
🔹 Severity: High
🔹 Weakness: Uncontrolled Resource Consumption
🔹 Reported To: Monero
🔹 Reported By: belair
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026, 8:13pm (UTC)
🐞 Source: HackerOne
Monero's IPv6 connection tracking used individual /128 addresses, which allowed the per-IP RPC connection limit to be bypassed by using multiple IPv6 addresses. This undermined the intended connection restrictions for IPv6 clients and was resolved in version 0.18.5.3.
👉 Read full report
🔹 Severity: High
🔹 Weakness: Uncontrolled Resource Consumption
🔹 Reported To: Monero
🔹 Reported By: belair
🔹 State: 🟢 Resolved
🔹 Disclosed: October 28, 2026, 8:13pm (UTC)
🐞 Source: HackerOne
Monero's IPv6 connection tracking used individual /128 addresses, which allowed the per-IP RPC connection limit to be bypassed by using multiple IPv6 addresses. This undermined the intended connection restrictions for IPv6 clients and was resolved in version 0.18.5.3.
👉 Read full report
Revoked deployment collaborator regains access to private comments after active collaborator interaction
🔹 Severity: Medium | 💰 1,026 USD
🔹 Weakness: Access Control Check Implemented After Asset is Accessed
🔹 Reported To: Vercel
🔹 Reported By: qub
🔹 State: 🟢 Resolved
🔹 Disclosed: October 29, 2026, 8:25am (UTC)
🐞 Source: HackerOne
A revoked deployment collaborator was able to regain access to private collaboration data after an active collaborator interacted with the deployment toolbar. After a collaborator's authorization was revoked and their token became invalid, a subsequent interaction by an active collaborator caused the revoked token to become authorized again. This allowed the revoked user to access the synchronization endpoint and…
👉 Read full report
🔹 Severity: Medium | 💰 1,026 USD
🔹 Weakness: Access Control Check Implemented After Asset is Accessed
🔹 Reported To: Vercel
🔹 Reported By: qub
🔹 State: 🟢 Resolved
🔹 Disclosed: October 29, 2026, 8:25am (UTC)
🐞 Source: HackerOne
A revoked deployment collaborator was able to regain access to private collaboration data after an active collaborator interacted with the deployment toolbar. After a collaborator's authorization was revoked and their token became invalid, a subsequent interaction by an active collaborator caused the revoked token to become authorized again. This allowed the revoked user to access the synchronization endpoint and…
👉 Read full report
Translation discovery crashes on crafted filenames (regex substitution injection)
🔹 Severity: Low
🔹 Weakness: Use of Externally-Controlled Format String
🔹 Reported To: Weblate
🔹 Reported By: sumit-sabhaya
🔹 State: 🟢 Resolved
🔹 Disclosed: October 30, 2026, 5:07am (UTC)
🐞 Source: HackerOne
A translation discovery package was vulnerable to a regular expression injection attack through crafted filenames. When processing repository files, the package interpolated user-controlled filename components into regex replacement strings without proper escaping. Filenames containing backslash sequences like backslash-g-angle-bracket-99-angle-bracket were interpreted as regex backreferences, causing the regex…
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Use of Externally-Controlled Format String
🔹 Reported To: Weblate
🔹 Reported By: sumit-sabhaya
🔹 State: 🟢 Resolved
🔹 Disclosed: October 30, 2026, 5:07am (UTC)
🐞 Source: HackerOne
A translation discovery package was vulnerable to a regular expression injection attack through crafted filenames. When processing repository files, the package interpolated user-controlled filename components into regex replacement strings without proper escaping. Filenames containing backslash sequences like backslash-g-angle-bracket-99-angle-bracket were interpreted as regex backreferences, causing the regex…
👉 Read full report
wlc: Project-wide download fails part-way and leaves stale archives on disk; filesystem errors surface as raw Python tracebacks.
🔹 Severity: Low
🔹 Weakness: Information Exposure Through an Error Message
🔹 Reported To: Weblate
🔹 Reported By: sumit-sabhaya
🔹 State: 🟢 Resolved
🔹 Disclosed: October 30, 2026, 5:07am (UTC)
🐞 Source: HackerOne
The wlc command-line client did not properly handle filesystem errors, which caused two distinct issues. First, when project-wide downloads failed partway through, already-written archives were left on disk with no report of which components succeeded or failed, making it impossible to distinguish complete results from partial ones. Second, any filesystem error such as permission denied, file exists, or file not…
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Information Exposure Through an Error Message
🔹 Reported To: Weblate
🔹 Reported By: sumit-sabhaya
🔹 State: 🟢 Resolved
🔹 Disclosed: October 30, 2026, 5:07am (UTC)
🐞 Source: HackerOne
The wlc command-line client did not properly handle filesystem errors, which caused two distinct issues. First, when project-wide downloads failed partway through, already-written archives were left on disk with no report of which components succeeded or failed, making it impossible to distinguish complete results from partial ones. Second, any filesystem error such as permission denied, file exists, or file not…
👉 Read full report
Incomplete VCS metadata exclusion: `.svn` / `.bzr` bypass CVE-2026-61792 due to missing `VCS_METADATA_DIRS` entries.
🔹 Severity: Medium
🔹 Weakness: Path Traversal
🔹 Reported To: Weblate
🔹 Reported By: sumit-sabhaya
🔹 State: 🟢 Resolved
🔹 Disclosed: October 30, 2026, 5:08am (UTC)
🐞 Source: HackerOne
A translation management application contained incomplete VCS metadata exclusion in its ZIP download feature. The exclusion mechanism only covered Git and Mercurial metadata directories but failed to exclude Subversion and Bazaar metadata directories. This gap allowed Subversion and Bazaar metadata files, including working-copy databases and credential cache entries, to be included in downloaded archives when such…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Path Traversal
🔹 Reported To: Weblate
🔹 Reported By: sumit-sabhaya
🔹 State: 🟢 Resolved
🔹 Disclosed: October 30, 2026, 5:08am (UTC)
🐞 Source: HackerOne
A translation management application contained incomplete VCS metadata exclusion in its ZIP download feature. The exclusion mechanism only covered Git and Mercurial metadata directories but failed to exclude Subversion and Bazaar metadata directories. This gap allowed Subversion and Bazaar metadata files, including working-copy databases and credential cache entries, to be included in downloaded archives when such…
👉 Read full report
A third-party Basecamp OAuth token mints a full launchpad web session through GET /my/login_option
🔹 Severity: High
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Basecamp
🔹 Reported By: deivizzzz
🔹 State: 🟢 Resolved
🔹 Disclosed: October 30, 2026, 11:07am (UTC)
🐞 Source: HackerOne
A third-party OAuth token was able to mint a full web session through an API endpoint, allowing an integration to obtain unauthorized session access and modify account settings. The vulnerability has been patched to only accept authorized session tokens.
👉 Read full report
🔹 Severity: High
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Basecamp
🔹 Reported By: deivizzzz
🔹 State: 🟢 Resolved
🔹 Disclosed: October 30, 2026, 11:07am (UTC)
🐞 Source: HackerOne
A third-party OAuth token was able to mint a full web session through an API endpoint, allowing an integration to obtain unauthorized session access and modify account settings. The vulnerability has been patched to only accept authorized session tokens.
👉 Read full report
Cross-account webhook takeover: PUT and DELETE on /<account>/webhooks/<id>.json reach another account's webhook
🔹 Severity: High
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: Basecamp
🔹 Reported By: deivizzzz
🔹 State: 🟢 Resolved
🔹 Disclosed: October 30, 2026, 11:08am (UTC)
🐞 Source: HackerOne
A cross-account webhook takeover vulnerability was identified in Basecamp's webhook API endpoints. The PUT and DELETE operations on webhook resources were authorizing based on project visibility rather than account membership. This allowed an attacker from one account to modify and delete webhooks belonging to another account when the victim's project was configured with all-access permissions. The vulnerability…
👉 Read full report
🔹 Severity: High
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: Basecamp
🔹 Reported By: deivizzzz
🔹 State: 🟢 Resolved
🔹 Disclosed: October 30, 2026, 11:08am (UTC)
🐞 Source: HackerOne
A cross-account webhook takeover vulnerability was identified in Basecamp's webhook API endpoints. The PUT and DELETE operations on webhook resources were authorizing based on project visibility rather than account membership. This allowed an attacker from one account to modify and delete webhooks belonging to another account when the victim's project was configured with all-access permissions. The vulnerability…
👉 Read full report
launchpad.37signals.com OAuth AS issues victim-bound credential to unverified attacker redirect → full CIA triad on Basecamp API
🔹 Severity: High
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: Basecamp
🔹 Reported By: rootaccessxvv
🔹 State: 🟢 Resolved
🔹 Disclosed: October 30, 2026, 1:40pm (UTC)
🐞 Source: HackerOne
A custom OAuth2 authorization server was found to issue victim-bound API credentials to unverified attacker-controlled redirect URIs. The authorization server accepted client registrations with self-chosen redirect URIs without performing ownership verification, ownership approval, or URI structure validation. During authorization, the server treated these unverified URIs as trusted redirect destinations. The…
👉 Read full report
🔹 Severity: High
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: Basecamp
🔹 Reported By: rootaccessxvv
🔹 State: 🟢 Resolved
🔹 Disclosed: October 30, 2026, 1:40pm (UTC)
🐞 Source: HackerOne
A custom OAuth2 authorization server was found to issue victim-bound API credentials to unverified attacker-controlled redirect URIs. The authorization server accepted client registrations with self-chosen redirect URIs without performing ownership verification, ownership approval, or URI structure validation. During authorization, the server treated these unverified URIs as trusted redirect destinations. The…
👉 Read full report
Cross-Tenant Bank Account Disclosure via `payerLocalBusinessId` in `updateReceivableInvoice`
🔹 Severity: High
🔹 Reported To: Settle Vulnerability Disclosure Program
🔹 Reported By: seamsikdernahid
🔹 State: 🟢 Resolved
🔹 Disclosed: October 30, 2026
🐞 Source: Bugcrowd
👉 Read full report
🔹 Severity: High
🔹 Reported To: Settle Vulnerability Disclosure Program
🔹 Reported By: seamsikdernahid
🔹 State: 🟢 Resolved
🔹 Disclosed: October 30, 2026
🐞 Source: Bugcrowd
👉 Read full report
wordpress.org/openverse/: unauthenticated open redirect — `str_replace()`'s 4th arg is a count, not a limit; bypasses WordPress.org SSO allow-list
🔹 Severity: Medium
🔹 Weakness: Open Redirect
🔹 Reported To: WordPress
🔹 Reported By: jakubk
🔹 State: 🟢 Resolved
🔹 Disclosed: October 30, 2026, 9:41pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the open redirect feature of a WordPress theme that serves a subdirectory site. The vulnerability was caused by incorrect use of a string replacement function where the fourth argument, intended to limit replacements to one occurrence, was actually interpreted as an output parameter rather than a limit. This caused all instances of the path prefix to be removed instead of just the…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Open Redirect
🔹 Reported To: WordPress
🔹 Reported By: jakubk
🔹 State: 🟢 Resolved
🔹 Disclosed: October 30, 2026, 9:41pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the open redirect feature of a WordPress theme that serves a subdirectory site. The vulnerability was caused by incorrect use of a string replacement function where the fourth argument, intended to limit replacements to one occurrence, was actually interpreted as an output parameter rather than a limit. This caused all instances of the path prefix to be removed instead of just the…
👉 Read full report
CampTix [camptix_private]: the view token is derived from the requester's own IP, so naming any attendee's e-mail unlocks the gated content
🔹 Severity: Medium
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: WordPress
🔹 Reported By: jakubk
🔹 State: 🟢 Resolved
🔹 Disclosed: October 30, 2026, 9:41pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in CampTix where the view token used to gate private content was derived from an attendee's email address and the requester's IP address. This allowed an attacker who knew an attendee's email address to gain access to gated content without possessing a valid ticket. The token generation process was performed using data controlled by the requester, making it guessable. Additionally…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: WordPress
🔹 Reported By: jakubk
🔹 State: 🟢 Resolved
🔹 Disclosed: October 30, 2026, 9:41pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in CampTix where the view token used to gate private content was derived from an attendee's email address and the requester's IP address. This allowed an attacker who knew an attendee's email address to gain access to gated content without possessing a valid ticket. The token generation process was performed using data controlled by the requester, making it guessable. Additionally…
👉 Read full report
Unauthenticated SQL injection *.nasa.gov
🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: Sleibe
🔹 State: 🟢 Resolved
🔹 Disclosed: November 2, 2026
🐞 Source: Bugcrowd
👉 Read full report
🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: Sleibe
🔹 State: 🟢 Resolved
🔹 Disclosed: November 2, 2026
🐞 Source: Bugcrowd
👉 Read full report
`monero-wallet-rpc::rescan_spent` accepts daemon-supplied spent-status from an untrusted daemon, enabling ring-intersection attack on transactions
🔹 Severity: Medium
🔹 Weakness: Information Disclosure
🔹 Reported To: Monero
🔹 Reported By: offsetmd
🔹 State: 🟢 Resolved
🔹 Disclosed: November 2, 2026, 6:43pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the wallet RPC server's rescan spent handler, which failed to verify daemon trustworthiness before accepting spent-status information. The handler invoked the rescan spent function without checking the is_trusted_daemon flag, unlike all other callers of the same function. This allowed a malicious daemon to return incorrect spent status for outputs, causing the wallet to mark…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Information Disclosure
🔹 Reported To: Monero
🔹 Reported By: offsetmd
🔹 State: 🟢 Resolved
🔹 Disclosed: November 2, 2026, 6:43pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the wallet RPC server's rescan spent handler, which failed to verify daemon trustworthiness before accepting spent-status information. The handler invoked the rescan spent function without checking the is_trusted_daemon flag, unlike all other callers of the same function. This allowed a malicious daemon to return incorrect spent status for outputs, causing the wallet to mark…
👉 Read full report
Re-entrant curl_easy_pause UAF in cw-pause
🔹 Severity: Low
🔹 Weakness: Use After Free
🔹 Reported To: curl
🔹 Reported By: gube-dev
🔹 State: 🔴 N/A
🔹 Disclosed: November 3, 2026, 1:06pm (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Use After Free
🔹 Reported To: curl
🔹 Reported By: gube-dev
🔹 State: 🔴 N/A
🔹 Disclosed: November 3, 2026, 1:06pm (UTC)
🐞 Source: HackerOne
👉 Read full report
`Vary` cache-key conflation of absent and empty request fields
🔹 Severity: Low
🔹 Reported To: Django
🔹 Reported By: dogeshark
🔹 State: 🟢 Resolved
🔹 Disclosed: November 3, 2026, 6:51pm (UTC)
🐞 Source: HackerOne
A cache-key generation vulnerability was identified in Django's cache middleware that conflated absent and empty request fields nominated by Vary headers. When a request header was absent versus present with an empty value, the same cache key was generated, causing responses intended for one request state to be returned for the other. This behavior violated HTTP caching standards that require absent nominated…
👉 Read full report
🔹 Severity: Low
🔹 Reported To: Django
🔹 Reported By: dogeshark
🔹 State: 🟢 Resolved
🔹 Disclosed: November 3, 2026, 6:51pm (UTC)
🐞 Source: HackerOne
A cache-key generation vulnerability was identified in Django's cache middleware that conflated absent and empty request fields nominated by Vary headers. When a request header was absent versus present with an empty value, the same cache key was generated, causing responses intended for one request state to be returned for the other. This behavior violated HTTP caching standards that require absent nominated…
👉 Read full report
Unauthenticated access to Checkout Blocks employee-only endpoints exposed merchant metadata
🔹 Severity: Medium | 💰 3,100 USD
🔹 Weakness: Missing Authentication for Critical Function
🔹 Reported To: Shopify
🔹 Reported By: cafecito
🔹 State: 🟢 Resolved
🔹 Disclosed: November 3, 2026, 9:22pm (UTC)
🐞 Source: HackerOne
A missing authentication vulnerability was discovered in an employee-only internal API endpoint. The endpoint was protected by an edge rule that only checked the URL path, but the underlying framework served the same content at an alternate URL structure that bypassed this protection. Unauthenticated users could access merchant installation data including store identifiers, installation dates, and feature flags…
👉 Read full report
🔹 Severity: Medium | 💰 3,100 USD
🔹 Weakness: Missing Authentication for Critical Function
🔹 Reported To: Shopify
🔹 Reported By: cafecito
🔹 State: 🟢 Resolved
🔹 Disclosed: November 3, 2026, 9:22pm (UTC)
🐞 Source: HackerOne
A missing authentication vulnerability was discovered in an employee-only internal API endpoint. The endpoint was protected by an edge rule that only checked the URL path, but the underlying framework served the same content at an alternate URL structure that bypassed this protection. Unauthenticated users could access merchant installation data including store identifiers, installation dates, and feature flags…
👉 Read full report
Connector/C++ string escaper re-escapes its own output, enabling SQL injection
🔹 Severity: Medium
🔹 Weakness: SQL Injection
🔹 Reported To: MariaDB
🔹 Reported By: fg0x0
🔹 State: 🟢 Resolved
🔹 Disclosed: November 4, 2026, 11:39am (UTC)
🐞 Source: HackerOne
A string escaping vulnerability was discovered in the database connector's utility function that processed identifiers and literals for information schema queries. The escaper's inner loop advanced its search cursor incorrectly, causing it to re-escape characters it had already inserted. This resulted in runs of escape characters with odd lengths that left live escape characters to consume closing quotes. The…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: SQL Injection
🔹 Reported To: MariaDB
🔹 Reported By: fg0x0
🔹 State: 🟢 Resolved
🔹 Disclosed: November 4, 2026, 11:39am (UTC)
🐞 Source: HackerOne
A string escaping vulnerability was discovered in the database connector's utility function that processed identifiers and literals for information schema queries. The escaper's inner loop advanced its search cursor incorrectly, causing it to re-escape characters it had already inserted. This resulted in runs of escape characters with odd lengths that left live escape characters to consume closing quotes. The…
👉 Read full report
Connector/C++ aborts client process on server session-tracking packet via std::stoi
🔹 Severity: Medium
🔹 Weakness: Uncontrolled Resource Consumption
🔹 Reported To: MariaDB
🔹 Reported By: fg0x0
🔹 State: 🟢 Resolved
🔹 Disclosed: November 4, 2026, 11:40am (UTC)
🐞 Source: HackerOne
A flaw was discovered in the Connector/C++ driver where the QueryProtocol::handleStateChange function improperly processed session-tracking packets from a server. The code attempted to parse a session variable name as an integer using std::stoi, which caused an std::invalid_argument exception to be thrown. This exception type was not caught by the driver's error handling or by standard application exception…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Uncontrolled Resource Consumption
🔹 Reported To: MariaDB
🔹 Reported By: fg0x0
🔹 State: 🟢 Resolved
🔹 Disclosed: November 4, 2026, 11:40am (UTC)
🐞 Source: HackerOne
A flaw was discovered in the Connector/C++ driver where the QueryProtocol::handleStateChange function improperly processed session-tracking packets from a server. The code attempted to parse a session variable name as an integer using std::stoi, which caused an std::invalid_argument exception to be thrown. This exception type was not caught by the driver's error handling or by standard application exception…
👉 Read full report
Connector/C++ ignores allowMultiQueries and injects savepoint names into SQL
🔹 Severity: Medium
🔹 Weakness: SQL Injection
🔹 Reported To: MariaDB
🔹 Reported By: fg0x0
🔹 State: 🟢 Resolved
🔹 Disclosed: November 4, 2026, 11:40am (UTC)
🐞 Source: HackerOne
Connector/C++ contained two SQL injection vulnerabilities in statement building. The driver ignored the allowMultiQueries configuration setting and passed a hardcoded flag to the database connection function, which caused stacked statements to be accepted on every connection regardless of the configuration. Additionally, savepoint names were concatenated directly into SQL statements without quoting or validation…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: SQL Injection
🔹 Reported To: MariaDB
🔹 Reported By: fg0x0
🔹 State: 🟢 Resolved
🔹 Disclosed: November 4, 2026, 11:40am (UTC)
🐞 Source: HackerOne
Connector/C++ contained two SQL injection vulnerabilities in statement building. The driver ignored the allowMultiQueries configuration setting and passed a hardcoded flag to the database connection function, which caused stacked statements to be accepted on every connection regardless of the configuration. Additionally, savepoint names were concatenated directly into SQL statements without quoting or validation…
👉 Read full report
Stack buffer overflow in 9 of 10 Connector/ODBC catalog functions via unbounded name
🔹 Severity: Medium
🔹 Weakness: Stack Overflow
🔹 Reported To: MariaDB
🔹 Reported By: fg0x0
🔹 State: 🟢 Resolved
🔹 Disclosed: November 4, 2026, 12:34pm (UTC)
🐞 Source: HackerOne
A stack buffer overflow vulnerability was discovered in nine of ten catalog functions in a database connector driver. The affected functions failed to validate the length of application-supplied identifiers before escaping them into a fixed-size stack buffer. Identifiers longer than 256 bytes could overflow the 513-byte buffer with attacker-controlled data. The overflow occurred during query string assembly before…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Stack Overflow
🔹 Reported To: MariaDB
🔹 Reported By: fg0x0
🔹 State: 🟢 Resolved
🔹 Disclosed: November 4, 2026, 12:34pm (UTC)
🐞 Source: HackerOne
A stack buffer overflow vulnerability was discovered in nine of ten catalog functions in a database connector driver. The affected functions failed to validate the length of application-supplied identifiers before escaping them into a fixed-size stack buffer. Identifiers longer than 256 bytes could overflow the 513-byte buffer with attacker-controlled data. The overflow occurred during query string assembly before…
👉 Read full report