wordpress.org/openverse/: unauthenticated open redirect — `str_replace()`'s 4th arg is a count, not a limit; bypasses WordPress.org SSO allow-list

🔹 Severity: Medium
🔹 Weakness: Open Redirect
🔹 Reported To: WordPress
🔹 Reported By: jakubk
🔹 State: 🟢 Resolved
🔹 Disclosed: October 30, 2026, 9:41pm (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in the open redirect feature of a WordPress theme that serves a subdirectory site. The vulnerability was caused by incorrect use of a string replacement function where the fourth argument, intended to limit replacements to one occurrence, was actually interpreted as an output parameter rather than a limit. This caused all instances of the path prefix to be removed instead of just the…

👉 Read full report

CampTix [camptix_private]: the view token is derived from the requester's own IP, so naming any attendee's e-mail unlocks the gated content

🔹 Severity: Medium
🔹 Weakness: Improper Authentication - Generic
🔹 Reported To: WordPress
🔹 Reported By: jakubk
🔹 State: 🟢 Resolved
🔹 Disclosed: October 30, 2026, 9:41pm (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in CampTix where the view token used to gate private content was derived from an attendee's email address and the requester's IP address. This allowed an attacker who knew an attendee's email address to gain access to gated content without possessing a valid ticket. The token generation process was performed using data controlled by the requester, making it guessable. Additionally…

👉 Read full report

Unauthenticated SQL injection *.nasa.gov

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: Sleibe
🔹 State: 🟢 Resolved
🔹 Disclosed: November 2, 2026
🐞 Source: Bugcrowd

👉 Read full report

`monero-wallet-rpc::rescan_spent` accepts daemon-supplied spent-status from an untrusted daemon, enabling ring-intersection attack on transactions

🔹 Severity: Medium
🔹 Weakness: Information Disclosure
🔹 Reported To: Monero
🔹 Reported By: offsetmd
🔹 State: 🟢 Resolved
🔹 Disclosed: November 2, 2026, 6:43pm (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in the wallet RPC server's rescan spent handler, which failed to verify daemon trustworthiness before accepting spent-status information. The handler invoked the rescan spent function without checking the is_trusted_daemon flag, unlike all other callers of the same function. This allowed a malicious daemon to return incorrect spent status for outputs, causing the wallet to mark…

👉 Read full report

Re-entrant curl_easy_pause UAF in cw-pause

🔹 Severity: Low
🔹 Weakness: Use After Free
🔹 Reported To: curl
🔹 Reported By: gube-dev
🔹 State: 🔴 N/A
🔹 Disclosed: November 3, 2026, 1:06pm (UTC)
🐞 Source: HackerOne

👉 Read full report

`Vary` cache-key conflation of absent and empty request fields

🔹 Severity: Low
🔹 Reported To: Django
🔹 Reported By: dogeshark
🔹 State: 🟢 Resolved
🔹 Disclosed: November 3, 2026, 6:51pm (UTC)
🐞 Source: HackerOne

A cache-key generation vulnerability was identified in Django's cache middleware that conflated absent and empty request fields nominated by Vary headers. When a request header was absent versus present with an empty value, the same cache key was generated, causing responses intended for one request state to be returned for the other. This behavior violated HTTP caching standards that require absent nominated…

👉 Read full report

Unauthenticated access to Checkout Blocks employee-only endpoints exposed merchant metadata

🔹 Severity: Medium | 💰 3,100 USD
🔹 Weakness: Missing Authentication for Critical Function
🔹 Reported To: Shopify
🔹 Reported By: cafecito
🔹 State: 🟢 Resolved
🔹 Disclosed: November 3, 2026, 9:22pm (UTC)
🐞 Source: HackerOne

A missing authentication vulnerability was discovered in an employee-only internal API endpoint. The endpoint was protected by an edge rule that only checked the URL path, but the underlying framework served the same content at an alternate URL structure that bypassed this protection. Unauthenticated users could access merchant installation data including store identifiers, installation dates, and feature flags…

👉 Read full report

Connector/C++ string escaper re-escapes its own output, enabling SQL injection

🔹 Severity: Medium
🔹 Weakness: SQL Injection
🔹 Reported To: MariaDB
🔹 Reported By: fg0x0
🔹 State: 🟢 Resolved
🔹 Disclosed: November 4, 2026, 11:39am (UTC)
🐞 Source: HackerOne

A string escaping vulnerability was discovered in the database connector's utility function that processed identifiers and literals for information schema queries. The escaper's inner loop advanced its search cursor incorrectly, causing it to re-escape characters it had already inserted. This resulted in runs of escape characters with odd lengths that left live escape characters to consume closing quotes. The…

👉 Read full report

Connector/C++ aborts client process on server session-tracking packet via std::stoi

🔹 Severity: Medium
🔹 Weakness: Uncontrolled Resource Consumption
🔹 Reported To: MariaDB
🔹 Reported By: fg0x0
🔹 State: 🟢 Resolved
🔹 Disclosed: November 4, 2026, 11:40am (UTC)
🐞 Source: HackerOne

A flaw was discovered in the Connector/C++ driver where the QueryProtocol::handleStateChange function improperly processed session-tracking packets from a server. The code attempted to parse a session variable name as an integer using std::stoi, which caused an std::invalid_argument exception to be thrown. This exception type was not caught by the driver's error handling or by standard application exception…

👉 Read full report

Connector/C++ ignores allowMultiQueries and injects savepoint names into SQL

🔹 Severity: Medium
🔹 Weakness: SQL Injection
🔹 Reported To: MariaDB
🔹 Reported By: fg0x0
🔹 State: 🟢 Resolved
🔹 Disclosed: November 4, 2026, 11:40am (UTC)
🐞 Source: HackerOne

Connector/C++ contained two SQL injection vulnerabilities in statement building. The driver ignored the allowMultiQueries configuration setting and passed a hardcoded flag to the database connection function, which caused stacked statements to be accepted on every connection regardless of the configuration. Additionally, savepoint names were concatenated directly into SQL statements without quoting or validation…

👉 Read full report

Stack buffer overflow in 9 of 10 Connector/ODBC catalog functions via unbounded name

🔹 Severity: Medium
🔹 Weakness: Stack Overflow
🔹 Reported To: MariaDB
🔹 Reported By: fg0x0
🔹 State: 🟢 Resolved
🔹 Disclosed: November 4, 2026, 12:34pm (UTC)
🐞 Source: HackerOne

A stack buffer overflow vulnerability was discovered in nine of ten catalog functions in a database connector driver. The affected functions failed to validate the length of application-supplied identifiers before escaping them into a fixed-size stack buffer. Identifiers longer than 256 bytes could overflow the 513-byte buffer with attacker-controlled data. The overflow occurred during query string assembly before…

👉 Read full report

Connector/ODBC SQLGetDescRec treats descriptor handle as statement handle, heap OOB write on every call

🔹 Severity: Medium
🔹 Weakness: Type Confusion
🔹 Reported To: MariaDB
🔹 Reported By: fg0x0
🔹 State: 🟢 Resolved
🔹 Disclosed: November 4, 2026, 12:35pm (UTC)
🐞 Source: HackerOne

A heap buffer overflow vulnerability was discovered in the ODBC driver's SQLGetDescRec and SQLGetDescRecW functions. These functions incorrectly used a statement handle macro on a descriptor handle, causing writes 13 bytes past the end of a 720-byte descriptor allocation. On standard builds, this memory corruption was sufficient to trigger heap consistency checks and crash the process. Additionally, a portion of…

👉 Read full report

Exposure of Sensitive Earthdata User and Internal Employee Credentials via Publicly Indexed Infostealer Logs

🔹 Severity: Critical
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: Piyush69
🔹 State: 🟢 Resolved
🔹 Disclosed: November 4, 2026
🐞 Source: Bugcrowd

👉 Read full report

Content Spoofing via Broken Link Hijacking on science.nasa.gov (@islivingston)

🔹 Severity: Low
🔹 Reported To: National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
🔹 Reported By: AbdulRahman-lx
🔹 State: 🟢 Resolved
🔹 Disclosed: November 4, 2026
🐞 Source: Bugcrowd

👉 Read full report

Connector/ODBC injects unquoted column names into positioned DELETE and UPDATE via MADB_DynStrGetWhere

🔹 Severity: Medium
🔹 Weakness: SQL Injection
🔹 Reported To: MariaDB
🔹 Reported By: fg0x0
🔹 State: 🟢 Resolved
🔹 Disclosed: November 4, 2026, 12:35pm (UTC)
🐞 Source: HackerOne

A SQL injection vulnerability was discovered in the ODBC connector where unquoted column names were injected into positioned DELETE and UPDATE statements. The column values were properly escaped, but the column names were appended directly without any quoting or escaping. This allowed an attacker who could control a column or table name to execute arbitrary SQL on the application's connection with its privileges…

👉 Read full report

r2dbc-mariadb: server message accepted with no command in flight desynchronises the connection and serves one user's rows to another

🔹 Severity: Medium
🔹 Weakness: Information Disclosure
🔹 Reported To: MariaDB
🔹 Reported By: fg0x0
🔹 State: 🟢 Resolved
🔹 Disclosed: November 4, 2026, 12:35pm (UTC)
🐞 Source: HackerOne

A vulnerability was discovered in an open-source database connector library that caused desynchronization of request and response messages on database connections. When a packet arrived from the server while no command was outstanding, the driver buffered it and served it to the next unrelated statement without validating any correlation between requests and responses. This allowed an attacker positioned on the…

👉 Read full report

Connector/ODBC: SqlwcsOctetLen sizes UTF-16 with a byte-oriented helper, reading past the caller's buffer and sending client memory to the server

🔹 Severity: Medium
🔹 Weakness: Out-of-bounds Read
🔹 Reported To: MariaDB
🔹 Reported By: fg0x0
🔹 State: 🟢 Resolved
🔹 Disclosed: November 4, 2026, 12:36pm (UTC)
🐞 Source: HackerOne

A buffer over-read vulnerability was identified in a database connector library's wide character string handling function. The function incorrectly sized UTF-16 strings by using a byte-oriented helper that inspected only the low byte of each code unit, causing the cursor to advance past the intended buffer boundary. This resulted in uninitialized memory being read and transmitted to the database server as part of…

👉 Read full report

Connector/ODBC: MADB_Stmt::ArrayOffset is not reset when an exception unwinds out of MADB_StmtExecute, so the next paramset reads out of bounds

🔹 Severity: Medium
🔹 Weakness: Out-of-bounds Read
🔹 Reported To: MariaDB
🔹 Reported By: fg0x0
🔹 State: 🟢 Resolved
🔹 Disclosed: November 4, 2026, 12:36pm (UTC)
🐞 Source: HackerOne

A vulnerability was identified in the Connector/ODBC library where an exception during parameter-array execute operations left the ArrayOffset variable in a stale state. When a server-reported error interrupted a parameter array, the ArrayOffset was not reset, causing the next paramset operation on the same statement handle to read from an incorrect memory location. This resulted in out-of-bounds reads that could…

👉 Read full report

Connector/C Out-of-bounds read from unterminated GSSAPI SPN in `parse_server_packet()`

🔹 Severity: No Rating
🔹 Weakness: Out-of-bounds Read
🔹 Reported To: MariaDB
🔹 Reported By: mschorm
🔹 State: 🟢 Resolved
🔹 Disclosed: November 4, 2026, 5:31pm (UTC)
🐞 Source: HackerOne

An out-of-bounds read vulnerability was found in the GSSAPI authentication client plugin. The vulnerable code used unsafe string copying functions without proper null termination when parsing server-supplied service principal names. When a server sent a service principal name of 256 or more bytes without a null terminator, the buffer was left unterminated. Subsequent string length operations read past the allocated…

👉 Read full report

Connector/C TLS auth-switch bypass exposes plaintext password on hostname verification failure

🔹 Severity: No Rating
🔹 Weakness: Improper Certificate Validation
🔹 Reported To: MariaDB
🔹 Reported By: mschorm
🔹 State: 🟢 Resolved
🔹 Disclosed: November 4, 2026, 5:31pm (UTC)
🐞 Source: HackerOne

A logic flaw was identified in the TLS authentication verification of a database connector library. The auth-switch guard used an insufficient bitwise check that allowed hostname verification failures to bypass security controls. When a server requested a non-hashing authentication plugin after initial connection, clients with hostname verification enabled could be forced to send their database password in…

👉 Read full report

CPU-based Denial of Service in translation-finder via O(N²) per-result wildcard mask matching

🔹 Severity: Medium
🔹 Weakness: Uncontrolled Resource Consumption
🔹 Reported To: Weblate
🔹 Reported By: robin-sabhaya
🔹 State: 🟢 Resolved
🔹 Disclosed: November 5, 2026, 9:51am (UTC)
🐞 Source: HackerOne

A CPU-based denial of service vulnerability was identified in a translation file discovery library. The vulnerability resulted from inefficient algorithmic complexity in wildcard mask matching operations. When processing directories or archives containing multiple files sharing the same suffix, the discovery function performed on the order of N squared fnmatch operations. This was caused by bucket-scanning logic…

👉 Read full report