CPU-based Denial of Service in translation-finder via O(N²) per-result wildcard mask matching
🔹 Severity: Medium
🔹 Weakness: Uncontrolled Resource Consumption
🔹 Reported To: Weblate
🔹 Reported By: robin-sabhaya
🔹 State: 🟢 Resolved
🔹 Disclosed: November 5, 2026, 9:51am (UTC)
🐞 Source: HackerOne
A CPU-based denial of service vulnerability was identified in a translation file discovery library. The vulnerability resulted from inefficient algorithmic complexity in wildcard mask matching operations. When processing directories or archives containing multiple files sharing the same suffix, the discovery function performed on the order of N squared fnmatch operations. This was caused by bucket-scanning logic…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Uncontrolled Resource Consumption
🔹 Reported To: Weblate
🔹 Reported By: robin-sabhaya
🔹 State: 🟢 Resolved
🔹 Disclosed: November 5, 2026, 9:51am (UTC)
🐞 Source: HackerOne
A CPU-based denial of service vulnerability was identified in a translation file discovery library. The vulnerability resulted from inefficient algorithmic complexity in wildcard mask matching operations. When processing directories or archives containing multiple files sharing the same suffix, the discovery function performed on the order of N squared fnmatch operations. This was caused by bucket-scanning logic…
👉 Read full report
Unauthenticated private CSV export of Meetup organizer PII via broken authz check in WordCamp Reports
🔹 Severity: High
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: WordPress
🔹 Reported By: 0xbs0d27
🔹 State: 🟢 Resolved
🔹 Disclosed: November 5, 2026, 1:59pm (UTC)
🐞 Source: HackerOne
A broken authorization check in a WordCamp plugin allowed unauthenticated attackers to export a private CSV file containing organizer personally identifiable information. The vulnerability was caused by an inverted logic operator in the security gate that verified nonce validity and user capabilities, resulting in the protection being bypassed for users without authentication or valid nonces. The exported data…
👉 Read full report
🔹 Severity: High
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: WordPress
🔹 Reported By: 0xbs0d27
🔹 State: 🟢 Resolved
🔹 Disclosed: November 5, 2026, 1:59pm (UTC)
🐞 Source: HackerOne
A broken authorization check in a WordCamp plugin allowed unauthenticated attackers to export a private CSV file containing organizer personally identifiable information. The vulnerability was caused by an inverted logic operator in the security gate that verified nonce validity and user capabilities, resulting in the protection being bypassed for users without authentication or valid nonces. The exported data…
👉 Read full report
Instamojo CampTix: fail-open MAC + webhook Credit without binding payment to order
🔹 Severity: High
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: WordPress
🔹 Reported By: 0xbs0d27
🔹 State: 🟢 Resolved
🔹 Disclosed: November 5, 2026, 2:18pm (UTC)
🐞 Source: HackerOne
A payment binding vulnerability was identified in the Instamojo payment gateway addon for a ticketing system. The gateway failed to verify and bind Instamojo payments to specific ticket orders. Three attack paths were present: a draft order could be marked pending using only a payment token without Instamojo API verification, invalid webhook signatures were accepted and still marked orders as pending instead of…
👉 Read full report
🔹 Severity: High
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: WordPress
🔹 Reported By: 0xbs0d27
🔹 State: 🟢 Resolved
🔹 Disclosed: November 5, 2026, 2:18pm (UTC)
🐞 Source: HackerOne
A payment binding vulnerability was identified in the Instamojo payment gateway addon for a ticketing system. The gateway failed to verify and bind Instamojo payments to specific ticket orders. Three attack paths were present: a draft order could be marked pending using only a payment token without Instamojo API verification, invalid webhook signatures were accepted and still marked orders as pending instead of…
👉 Read full report
wordpress.org Rosetta: invite stores unvalidated role — Editor can assign site Administrator despite editable_roles
🔹 Severity: High
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: WordPress
🔹 Reported By: 0xbs0d27
🔹 State: 🟢 Resolved
🔹 Disclosed: November 5, 2026, 2:18pm (UTC)
🐞 Source: HackerOne
A privilege escalation vulnerability was found in a wordpress.org custom mu-plugin used on locale team sites. The vulnerability allowed authenticated editors to assign the administrator role to users during the account invitation process, despite administrator being explicitly removed from the editable roles list. The role parameter was accepted directly from user input without validation against the permitted…
👉 Read full report
🔹 Severity: High
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: WordPress
🔹 Reported By: 0xbs0d27
🔹 State: 🟢 Resolved
🔹 Disclosed: November 5, 2026, 2:18pm (UTC)
🐞 Source: HackerOne
A privilege escalation vulnerability was found in a wordpress.org custom mu-plugin used on locale team sites. The vulnerability allowed authenticated editors to assign the administrator role to users during the account invitation process, despite administrator being explicitly removed from the editable roles list. The role parameter was accepted directly from user input without validation against the permitted…
👉 Read full report
WordCamp Meta gpre: password-protected event RSVP list readable without password via /gpre/v1/.../rsvp-responses
🔹 Severity: Medium
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: WordPress
🔹 Reported By: 0xbs0d27
🔹 State: 🟢 Resolved
🔹 Disclosed: November 5, 2026, 2:18pm (UTC)
🐞 Source: HackerOne
A password protection bypass was identified in a REST API wrapper for recurring events. The wrapper endpoint exposed RSVP attendee roster data without verifying password authentication, while the core API correctly enforced password gates. Unauthenticated requests could retrieve attendee names, user IDs, profile information, and comment details for password-protected events. The vulnerability was caused by the…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: WordPress
🔹 Reported By: 0xbs0d27
🔹 State: 🟢 Resolved
🔹 Disclosed: November 5, 2026, 2:18pm (UTC)
🐞 Source: HackerOne
A password protection bypass was identified in a REST API wrapper for recurring events. The wrapper endpoint exposed RSVP attendee roster data without verifying password authentication, while the core API correctly enforced password gates. Unauthenticated requests could retrieve attendee names, user IDs, profile information, and comment details for password-protected events. The vulnerability was caused by the…
👉 Read full report
Unauthenticated Disclosure of Private, Draft, and Password-Protected Post Content via Core Read-Permission Bypass in SCF Reference Fields
🔹 Severity: High
🔹 Weakness: Information Disclosure
🔹 Reported To: WordPress
🔹 Reported By: 0x200notfound
🔹 State: 🟢 Resolved
🔹 Disclosed: November 5, 2026, 7:56pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in a WordPress plugin's reference field functionality that allowed unauthenticated users to access non-public post content through a permission bypass. The issue existed in the post retrieval function, which did not enforce read permission checks when retrieving posts with any status, including private, draft, and password-protected posts. Sensitive post data including full content…
👉 Read full report
🔹 Severity: High
🔹 Weakness: Information Disclosure
🔹 Reported To: WordPress
🔹 Reported By: 0x200notfound
🔹 State: 🟢 Resolved
🔹 Disclosed: November 5, 2026, 7:56pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in a WordPress plugin's reference field functionality that allowed unauthenticated users to access non-public post content through a permission bypass. The issue existed in the post retrieval function, which did not enforce read permission checks when retrieving posts with any status, including private, draft, and password-protected posts. Sensitive post data including full content…
👉 Read full report
Blind SSRF in `/api/img` on blua.bupa.com.au — internal host discovery & port scanning of `*.internal.bupa.com.au`
🔹 Severity: Medium
🔹 Reported To: Bupa Australia Vulnerability Disclosure Engagement
🔹 Reported By: x3c
🔹 State: 🟢 Resolved
🔹 Disclosed: November 6, 2026
🐞 Source: Bugcrowd
👉 Read full report
🔹 Severity: Medium
🔹 Reported To: Bupa Australia Vulnerability Disclosure Engagement
🔹 Reported By: x3c
🔹 State: 🟢 Resolved
🔹 Disclosed: November 6, 2026
🐞 Source: Bugcrowd
👉 Read full report
1-click Remote Code Execution via Link Embed
🔹 Severity: Critical
🔹 Reported To: Asana
🔹 Reported By: JayTaelien
🔹 State: 🟢 Resolved
🔹 Disclosed: November 6, 2026
🐞 Source: Bugcrowd
👉 Read full report
🔹 Severity: Critical
🔹 Reported To: Asana
🔹 Reported By: JayTaelien
🔹 State: 🟢 Resolved
🔹 Disclosed: November 6, 2026
🐞 Source: Bugcrowd
👉 Read full report
Unescaped consent-prompt renderer (HTML()) enables concealed-approval OS command injection in strands-agents/tools use_computer — RCE
🔹 Severity: Medium
🔹 Weakness: OS Command Injection
🔹 Reported To: AWS VDP
🔹 Reported By: hope_no_dupe
🔹 State: 🟢 Resolved
🔹 Disclosed: November 6, 2026, 2:33pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in an agent tool framework where user consent prompts were rendered without proper escaping. Markup embedded in tool arguments was interpreted rather than displayed, allowing attackers to conceal malicious commands within prompts that appeared benign to operators. When combined with unsanitized command execution sinks in the application focus feature, this enabled arbitrary operating…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: OS Command Injection
🔹 Reported To: AWS VDP
🔹 Reported By: hope_no_dupe
🔹 State: 🟢 Resolved
🔹 Disclosed: November 6, 2026, 2:33pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in an agent tool framework where user consent prompts were rendered without proper escaping. Markup embedded in tool arguments was interpreted rather than displayed, allowing attackers to conceal malicious commands within prompts that appeared benign to operators. When combined with unsanitized command execution sinks in the application focus feature, this enabled arbitrary operating…
👉 Read full report
Billion laughs entity expansion in Qt .ts discovery: a crafted ~950 KB file forces ~55 MB of XML expansion per parse, cost scales with crafted file c
🔹 Severity: Medium
🔹 Weakness: XML Entity Expansion
🔹 Reported To: Weblate
🔹 Reported By: sumit-sabhaya
🔹 State: 🟢 Resolved
🔹 Disclosed: November 7, 2026, 7:46am (UTC)
🐞 Source: HackerOne
An XML entity expansion vulnerability was discovered in the Qt translation discovery backend of a software component. The vulnerability existed in a function that parsed Qt .ts files using default entity processing without proper restrictions. An attacker could craft malicious .ts files with internal entity declarations that, while staying within the parser's amplification ratio limits, could force significant XML…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: XML Entity Expansion
🔹 Reported To: Weblate
🔹 Reported By: sumit-sabhaya
🔹 State: 🟢 Resolved
🔹 Disclosed: November 7, 2026, 7:46am (UTC)
🐞 Source: HackerOne
An XML entity expansion vulnerability was discovered in the Qt translation discovery backend of a software component. The vulnerability existed in a function that parsed Qt .ts files using default entity processing without proper restrictions. An attacker could craft malicious .ts files with internal entity declarations that, while staying within the parser's amplification ratio limits, could force significant XML…
👉 Read full report
curl 8.23.0 keeps sending requests to an HTTP/3 backend after Alt-Svc: clear
🔹 Severity: High
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: curl
🔹 Reported By: arizonya
🔹 State: ⚪️ Informative
🔹 Disclosed: November 7, 2026, 10:37pm (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: High
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: curl
🔹 Reported By: arizonya
🔹 State: ⚪️ Informative
🔹 Disclosed: November 7, 2026, 10:37pm (UTC)
🐞 Source: HackerOne
👉 Read full report
MariaDB CLI Utility Issues
🔹 Severity: No Rating
🔹 Weakness: SQL Injection
🔹 Reported To: MariaDB
🔹 Reported By: vortfu
🔹 State: 🟢 Resolved
🔹 Disclosed: November 8, 2026, 11:41am (UTC)
🐞 Source: HackerOne
Several SQL injection vulnerabilities were discovered in MariaDB command-line utilities. The mariadb-show utility was found to execute malicious SQL queries when used with the --count and --verbose options, as table names retrieved from database queries were not properly escaped before being used in subsequent queries. Similar issues were identified in mariadb-dump and mariadb-convert-table-format.sh where…
👉 Read full report
🔹 Severity: No Rating
🔹 Weakness: SQL Injection
🔹 Reported To: MariaDB
🔹 Reported By: vortfu
🔹 State: 🟢 Resolved
🔹 Disclosed: November 8, 2026, 11:41am (UTC)
🐞 Source: HackerOne
Several SQL injection vulnerabilities were discovered in MariaDB command-line utilities. The mariadb-show utility was found to execute malicious SQL queries when used with the --count and --verbose options, as table names retrieved from database queries were not properly escaped before being used in subsequent queries. Similar issues were identified in mariadb-dump and mariadb-convert-table-format.sh where…
👉 Read full report
Open Email Relay on WordPress Gutenberg Plugin via formAction parameter leads to phishing and spam campaigns
🔹 Severity: No Rating
🔹 Reported To: WordPress
🔹 Reported By: zadwon
🔹 State: 🟢 Resolved
🔹 Disclosed: November 8, 2026, 6:15pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the WordPress Gutenberg plugin version 22.2.0 that exposed an unauthenticated AJAX endpoint. The experimental Form block allowed arbitrary attackers to relay emails through the WordPress site to any recipient without authentication. The vulnerability existed because the form handler was registered for both authenticated and unauthenticated requests, and the handler trusted…
👉 Read full report
🔹 Severity: No Rating
🔹 Reported To: WordPress
🔹 Reported By: zadwon
🔹 State: 🟢 Resolved
🔹 Disclosed: November 8, 2026, 6:15pm (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the WordPress Gutenberg plugin version 22.2.0 that exposed an unauthenticated AJAX endpoint. The experimental Form block allowed arbitrary attackers to relay emails through the WordPress site to any recipient without authentication. The vulnerability existed because the form handler was registered for both authenticated and unauthenticated requests, and the handler trusted…
👉 Read full report
Broken Access Control on **healthwatch.trellix.com** Leading to Unauthorized Access and Sensitive Data Exposure
🔹 Severity: Medium
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Trellix
🔹 Reported By: t4f3
🔹 State: 🟢 Resolved
🔹 Disclosed: November 8, 2026, 10:22pm (UTC)
🐞 Source: HackerOne
A broken access control vulnerability was discovered on a health monitoring platform. The vulnerability consisted of three chained security flaws: insufficient email domain validation during account registration allowed attackers to register accounts with external email addresses, a password reset mechanism could be exploited to activate accounts pending administrator approval, and an improperly secured API…
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Improper Access Control - Generic
🔹 Reported To: Trellix
🔹 Reported By: t4f3
🔹 State: 🟢 Resolved
🔹 Disclosed: November 8, 2026, 10:22pm (UTC)
🐞 Source: HackerOne
A broken access control vulnerability was discovered on a health monitoring platform. The vulnerability consisted of three chained security flaws: insufficient email domain validation during account registration allowed attackers to register accounts with external email addresses, a password reset mechanism could be exploited to activate accounts pending administrator approval, and an improperly secured API…
👉 Read full report
SQL Injection via Unsanitized Identifiers and String Literals in `@aws-cdk/aws-redshift-alpha` Custom Resource Handlers
🔹 Severity: High
🔹 Weakness: SQL Injection
🔹 Reported To: AWS VDP
🔹 Reported By: suul
🔹 State: 🟢 Resolved
🔹 Disclosed: November 9, 2026, 6:53pm (UTC)
🐞 Source: HackerOne
A SQL injection vulnerability was discovered in custom resource handlers within the AWS CDK Redshift Alpha module. The vulnerability resulted from unsanitized identifiers and string literals in SQL queries, which allowed malicious input to be executed as SQL commands. The issue was remediated following responsible disclosure coordination.
👉 Read full report
🔹 Severity: High
🔹 Weakness: SQL Injection
🔹 Reported To: AWS VDP
🔹 Reported By: suul
🔹 State: 🟢 Resolved
🔹 Disclosed: November 9, 2026, 6:53pm (UTC)
🐞 Source: HackerOne
A SQL injection vulnerability was discovered in custom resource handlers within the AWS CDK Redshift Alpha module. The vulnerability resulted from unsanitized identifiers and string literals in SQL queries, which allowed malicious input to be executed as SQL commands. The issue was remediated following responsible disclosure coordination.
👉 Read full report
Mass PII Exposure: 120,000+ Consumer Email Addresses Leaked via Author Enumeration on ████████
🔹 Severity: Critical
🔹 Weakness: Information Disclosure
🔹 Reported To: Essity
🔹 Reported By: matty69v
🔹 State: 🟢 Resolved
🔹 Disclosed: November 10, 2026, 7:41am (UTC)
🐞 Source: HackerOne
A WordPress loyalty program was found to expose approximately 121,000 consumer email addresses through user enumeration. The email addresses were configured as display names and became publicly visible through author archive pages, REST API endpoints, and RSS feeds. The affected pages were not protected by noindex directives or robots.txt restrictions, making them indexable by search engines. Sequential user IDs…
👉 Read full report
🔹 Severity: Critical
🔹 Weakness: Information Disclosure
🔹 Reported To: Essity
🔹 Reported By: matty69v
🔹 State: 🟢 Resolved
🔹 Disclosed: November 10, 2026, 7:41am (UTC)
🐞 Source: HackerOne
A WordPress loyalty program was found to expose approximately 121,000 consumer email addresses through user enumeration. The email addresses were configured as display names and became publicly visible through author archive pages, REST API endpoints, and RSS feeds. The affected pages were not protected by noindex directives or robots.txt restrictions, making them indexable by search engines. Sequential user IDs…
👉 Read full report
Blind SQL Injection — IBM Training Course Search API
🔹 Severity: Critical
🔹 Weakness: SQL Injection
🔹 Reported To: IBM
🔹 Reported By: 4c1dr3aper
🔹 State: 🟢 Resolved
🔹 Disclosed: November 10, 2026, 3:05pm (UTC)
🐞 Source: HackerOne
A blind SQL injection vulnerability was identified in a training course search API. The vulnerability was reported by an external security researcher, analyzed, and subsequently remediated.
👉 Read full report
🔹 Severity: Critical
🔹 Weakness: SQL Injection
🔹 Reported To: IBM
🔹 Reported By: 4c1dr3aper
🔹 State: 🟢 Resolved
🔹 Disclosed: November 10, 2026, 3:05pm (UTC)
🐞 Source: HackerOne
A blind SQL injection vulnerability was identified in a training course search API. The vulnerability was reported by an external security researcher, analyzed, and subsequently remediated.
👉 Read full report
❤1
Unauthenticated attacker can book appointments at arbitrary times, including outside availability and in the past
🔹 Severity: Low
🔹 Weakness: Business Logic Errors
🔹 Reported To: Nextcloud
🔹 Reported By: 0xh3llo
🔹 State: 🟢 Resolved
🔹 Disclosed: November 11, 2026, 12:50am (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the Calendar application's public appointment booking endpoint. The endpoint validated that a bookable slot existed within a requested time range, but then persisted the attacker-supplied start and end times instead of the validated slot values. This allowed unauthenticated attackers with access to the public booking link to create confirmed events on an organizer's calendar at…
👉 Read full report
🔹 Severity: Low
🔹 Weakness: Business Logic Errors
🔹 Reported To: Nextcloud
🔹 Reported By: 0xh3llo
🔹 State: 🟢 Resolved
🔹 Disclosed: November 11, 2026, 12:50am (UTC)
🐞 Source: HackerOne
A vulnerability was discovered in the Calendar application's public appointment booking endpoint. The endpoint validated that a bookable slot existed within a requested time range, but then persisted the attacker-supplied start and end times instead of the validated slot values. This allowed unauthenticated attackers with access to the public booking link to create confirmed events on an organizer's calendar at…
👉 Read full report
Blind SQL injection due to request precedence issue in global input registration
🔹 Severity: High
🔹 Weakness: SQL Injection
🔹 Reported To: Revive Adserver
🔹 Reported By: sh4d0byss
🔹 State: 🟢 Resolved
🔹 Disclosed: November 11, 2026, 10:37am (UTC)
🐞 Source: HackerOne
A blind SQL injection vulnerability was discovered in administration pages for banner zones and campaign zones. The vulnerability resulted from a request precedence issue where permission checks and database queries used different values for the same request parameter. This mismatch could have been exploited by a restricted manager to extract arbitrary database values, including password hashes and session…
👉 Read full report
🔹 Severity: High
🔹 Weakness: SQL Injection
🔹 Reported To: Revive Adserver
🔹 Reported By: sh4d0byss
🔹 State: 🟢 Resolved
🔹 Disclosed: November 11, 2026, 10:37am (UTC)
🐞 Source: HackerOne
A blind SQL injection vulnerability was discovered in administration pages for banner zones and campaign zones. The vulnerability resulted from a request precedence issue where permission checks and database queries used different values for the same request parameter. This mismatch could have been exploited by a restricted manager to extract arbitrary database values, including password hashes and session…
👉 Read full report
Access control bypass due to request precedence issue in global input registration
🔹 Severity: High
🔹 Weakness: Insecure Direct Object Reference (IDOR)
🔹 Reported To: Revive Adserver
🔹 Reported By: kushbafti
🔹 State: 🟢 Resolved
🔹 Disclosed: November 11, 2026, 10:43am (UTC)
🐞 Source: HackerOne
👉 Read full report
🔹 Severity: High
🔹 Weakness: Insecure Direct Object Reference (IDOR)
🔹 Reported To: Revive Adserver
🔹 Reported By: kushbafti
🔹 State: 🟢 Resolved
🔹 Disclosed: November 11, 2026, 10:43am (UTC)
🐞 Source: HackerOne
👉 Read full report
Reflected XSS via invocation iFrame size fields
🔹 Severity: Medium
🔹 Weakness: Cross-site Scripting (XSS) - Reflected
🔹 Reported To: Revive Adserver
🔹 Reported By: kannrisha
🔹 State: 🟢 Resolved
🔹 Disclosed: November 11, 2026, 10:46am (UTC)
🐞 Source: HackerOne
A reflected cross-site scripting vulnerability was discovered in iframe invocation options. The frame width and height parameters were included in HTML attributes without proper encoding when generating invocation tags for any-size zones. This vulnerability was resolved by implementing HTML encoding for width and height values in invocation-option form fields.
👉 Read full report
🔹 Severity: Medium
🔹 Weakness: Cross-site Scripting (XSS) - Reflected
🔹 Reported To: Revive Adserver
🔹 Reported By: kannrisha
🔹 State: 🟢 Resolved
🔹 Disclosed: November 11, 2026, 10:46am (UTC)
🐞 Source: HackerOne
A reflected cross-site scripting vulnerability was discovered in iframe invocation options. The frame width and height parameters were included in HTML attributes without proper encoding when generating invocation tags for any-size zones. This vulnerability was resolved by implementing HTML encoding for width and height values in invocation-option form fields.
👉 Read full report