🎯 New Report #3619287: RCE Supply Chain Attack via pull request target in content-scope-scripts/semver-label.yml — Affects All DuckDuckGo Browsers
🔺Severity: Critical
👽 Reporter: 6r1ff1n
⭐️ Reputation: 94
🛠 State: resolved
💼 Team: DuckDuckGo
💵 Bounty: null
🕐 Submitted: 2026-03-21
⏰ Disclosed: 2026-06-11 14:28:34
📝 Summary: A vulnerability was discovered in the DuckDuckGo content-scope-scripts repository's GitHub Actions workflow. The workflow used the pull request target trigger without access controls, allowing untrusted code from fork pull requests to be checked out and executed. This could have led to remote code execution and the potential exfiltration of sensitive information, such as API keys, on the runner. The vulnerability also could have been exploited to manipulate the automated release pipeline, potentially compromising all DuckDuckGo browsers and extensions across multiple platforms.
📂 Report JSON File: 3619287
@hackeronereports

🎯 New Report #3558713: Command Injection via Unsanitized Bundling Options in `aws-cdk-lib/aws-lambda-nodejs`
🔺Severity: High
👽 Reporter: inkerton
⭐️ Reputation: 87
🛠 State: resolved
💼 Team: AWS VDP
💵 Bounty: null
🕐 Submitted: 2026-02-17
⏰ Disclosed: 2026-06-11 16:54:20
📝 Summary: null
📂 Report JSON File: 3558713
@hackeronereports

🎯 New Report #3781015: Incomplete Fix for CVE-2026-21637: OCSPRequest and resumeSession Events Crash Node.js TLS Server via Unhandled Synchronous Exceptions
🔺Severity: High
👽 Reporter: shinchan 69
⭐️ Reputation: 240
🛠 State: informative
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-06-04
⏰ Disclosed: 2026-06-12 09:46:19
📝 Summary: null
📂 Report JSON File: 3781015
@hackeronereports

🎯 New Report #3712279: Burp Suite Professional: browser-powered crawl can write attacker-controlled files through file input handling
🔺Severity: High
👽 Reporter: kawakatz
⭐️ Reputation: 594
🛠 State: resolved
💼 Team: PortSwigger Web Security
💵 Bounty: 5000
🕐 Submitted: 2026-05-04
⏰ Disclosed: 2026-06-14 08:08:52
📝 Summary: A vulnerability was discovered in Burp Suite Professional 2026.3.3 on Windows. When Burp Scanner's browser-powered crawler crawled an attacker-controlled website, the website could force Burp to write an attacker-controlled file to an attacker-controlled local path. The issue was caused by Burp's handling of file input fields, where Burp created a local upload file from page-controlled attributes but did not prevent path traversal in the generated filename.
📂 Report JSON File: 3712279
@hackeronereports

🎯 New Report #3717354: UI Consent Bypass via Comma Injection in `addAutoApproveTarget` — User-Approval Dialog and Persistence Layer Disagree on Target Scope, Yielding Authen
🔺Severity: None
👽 Reporter: hacker-kartel
⭐️ Reputation: 84
🛠 State: resolved
💼 Team: PortSwigger Web Security
💵 Bounty: null
🕐 Submitted: 2026-05-06
⏰ Disclosed: 2026-06-15 09:21:46
📝 Summary: A vulnerability was discovered in Burp Suite MCP Server BApp v1.2.1 where the addAutoApproveTarget function failed to validate the hostnames passed to it. This allowed a malicious MCP client to inject a comma-separated hostname, which was then persisted as multiple independent allow-list entries. As a result, the user-approval dialog and the persistence layer disagreed on the target scope, leading to a consent bypass.
📂 Report JSON File: 3717354
@hackeronereports

🎯 New Report #3664261: Reflected Cross-Site Scripting (XSS) found on IBM.com domain
🔺Severity: null
👽 Reporter: entrovyx
⭐️ Reputation: 123
🛠 State: resolved
💼 Team: IBM
💵 Bounty: null
🕐 Submitted: 2026-04-10
⏰ Disclosed: 2026-06-15 15:42:13
📝 Summary: A reflected Cross-Site Scripting (XSS) vulnerability was found on the IBM.com domain. The vulnerability was reported to IBM, analyzed, and remediated. The external researcher who reported the issue was acknowledged.
📂 Report JSON File: 3664261
@hackeronereports

🎯 New Report #3687142: Unauthenticated reading of every file via livechat auth and predicting MongoDB ObjectId()
🔺Severity: Critical
👽 Reporter: aikido security
⭐️ Reputation: 225
🛠 State: resolved
💼 Team: Rocket.Chat
💵 Bounty: null
🕐 Submitted: 2026-04-21
⏰ Disclosed: 2026-06-15 23:44:12
📝 Summary: null
📂 Report JSON File: 3687142
@hackeronereports

🎯 New Report #3701692: Malicious Conflux Endpoint Can Leave Stale Global OOO Queue Accounting After Teardown
🔺Severity: Low
👽 Reporter: aptupdate
⭐️ Reputation: 120
🛠 State: resolved
💼 Team: Tor
💵 Bounty: 100
🕐 Submitted: 2026-04-28
⏰ Disclosed: 2026-06-16 07:16:47
📝 Summary: A vulnerability was discovered in Tor's Conflux OOO queue accounting. The vulnerability could cause the global OOO queue byte counter to remain inflated after a Conflux set was torn down, even though the memory had already been freed. This was due to a lack of accounting updates during the teardown process. No sensitive information was included in the report.
📂 Report JSON File: 3701692
@hackeronereports

🎯 New Report #3611837: Unauthenticated file deletion via deleteFileMessage DDP method allows permanent destruction of any uploaded file
🔺Severity: High
👽 Reporter: eldudareeno
⭐️ Reputation: 224
🛠 State: resolved
💼 Team: Rocket.Chat
💵 Bounty: null
🕐 Submitted: 2026-03-17
⏰ Disclosed: 2026-06-16 09:47:25
📝 Summary: null
📂 Report JSON File: 3611837
@hackeronereports

🎯 New Report #3694007: Authenticated Elasticsearch Painless script execution via Query.search.sort query on hackerone.com/graphql
🔺Severity: High
👽 Reporter: brumbelow
⭐️ Reputation: 753
🛠 State: resolved
💼 Team: HackerOne
💵 Bounty: 7000
🕐 Submitted: 2026-04-24
⏰ Disclosed: 2026-06-17 14:17:26
📝 Summary: The GraphQL query on hackerone.com/graphql allowed authenticated users to execute arbitrary Painless scripts through the sort query argument, without server-side validation or allowlisting. This was confirmed by submitting requests with different Painless script payloads, and observing that the script's return value determined the document ordering in the search results.
📂 Report JSON File: 3694007
@hackeronereports

🎯 New Report #2509022: Reflected XSS in AI Chat Bot Greetings at help.shopify.com via Markdown Image Rendering
🔺Severity: Medium
👽 Reporter: saltymermaid
⭐️ Reputation: 1415
🛠 State: resolved
💼 Team: Shopify
💵 Bounty: 1600
🕐 Submitted: 2024-05-16
⏰ Disclosed: 2026-06-18 12:48:02
📝 Summary: A reflected XSS vulnerability was reported in the AI chat bot greetings at help.shopify.com. The issue was caused by the rendering of a markdown image in the greeting, which allowed the attacker to inject a payload through the image URL. The vulnerability was addressed by removing the attacker-controlled greeting input path.
📂 Report JSON File: 2509022
@hackeronereports

🎯 New Report #3692858: Permission Model Bypass via `process.report.writeReport()` Path Misvalidation
🔺Severity: Low
👽 Reporter: suul
⭐️ Reputation: 1062
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-04-24
⏰ Disclosed: 2026-06-18 14:48:28
📝 Summary: A flaw was discovered in the Node.js permission model that allowed bypassing of security controls via the process.report.writeReport() path misvalidation.
📂 Report JSON File: 3692858
@hackeronereports

🎯 New Report #3658225: HTTP/2 sessions never clean up after GOAWAY on invalid protocol errors
🔺Severity: Medium
👽 Reporter: pimterry
⭐️ Reputation: 153
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-04-08
⏰ Disclosed: 2026-06-18 17:34:31
📝 Summary: A flaw in the Node.js HTTP/2 server API was discovered that could cause servers to keep accepting data even after sending a GOAWAY frame. This vulnerability affected Node.js 22 and Node.js 24.
📂 Report JSON File: 3658225
@hackeronereports

🎯 New Report #3723458: 1-Click Account Takeover via Open Redirect through Regex Bypass in Domain Validation
🔺Severity: Critical
👽 Reporter: farr
⭐️ Reputation: 136
🛠 State: resolved
💼 Team: Khan Academy
💵 Bounty: null
🕐 Submitted: 2026-05-09
⏰ Disclosed: 2026-06-20 15:58:07
📝 Summary: A vulnerability was discovered in the Khan Academy platform that allowed an attacker to achieve full account takeover of any user. The vulnerability was caused by an unescaped dot flaw in the regular expression used to validate redirect URLs. This allowed the attacker to register a malicious domain that passed the validation check, causing the victim's authentication token to be sent to the attacker's server. The attacker could then use this token to gain full access to the victim's account. The issue was addressed by escaping the dots in the regular expression.
📂 Report JSON File: 3723458
@hackeronereports

🎯 New Report #3817602: Node --run POSIX positional argument escaping allows shell command injection
🔺Severity: High
👽 Reporter: yottt
⭐️ Reputation: 309
🛠 State: informative
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-06-22
⏰ Disclosed: 2026-06-23 09:53:20
📝 Summary: null
📂 Report JSON File: 3817602
@hackeronereports

🎯 New Report #3734676: Taskcluster web-server OAuth2 authorization codes are reusable and the exchange handler checks the wrong expiry column
🔺Severity: Medium
👽 Reporter: anshuman bh
⭐️ Reputation: 3737
🛠 State: resolved
💼 Team: Mozilla
💵 Bounty: 2000
🕐 Submitted: 2026-05-14
⏰ Disclosed: 2026-06-23 12:37:52
📝 Summary: The Taskcluster web-server's OAuth2 token-exchange handler did not consume authorization codes and did not enforce the authorization-code expiry. A leaked authorization code could be replayed to mint additional bridge access tokens for the original user, past the 10-minute window required by the OAuth2 standard. The expiry check in the token-exchange handler and the bridge-token-to-credentials handler read the wrong expiry column, allowing expired codes to remain usable until the daily cleanup cron deleted them.
📂 Report JSON File: 3734676
@hackeronereports

🎯 New Report #3384615: Insufficient checks in the file path parameter allow writing to unauthorized directories
🔺Severity: Low
👽 Reporter: axolot23
⭐️ Reputation: 301
🛠 State: resolved
💼 Team: SingleStore
💵 Bounty: null
🕐 Submitted: 2025-10-15
⏰ Disclosed: 2026-06-24 07:03:12
📝 Summary: A directory traversal vulnerability was identified in the file upload functionality. Authenticated users could write files to parent directories outside the intended upload location by manipulating the path parameter. The issue was classified as Low severity due to limited impact. The vulnerability has been remediated through proper path sanitization.
📂 Report JSON File: 3384615
@hackeronereports

🎯 New Report #3582376: HTTP Response Queue Poisoning via TOCTOU Race Condition in `http.Agent`
🔺Severity: Low
👽 Reporter: yushengchen
⭐️ Reputation: 123
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-03-03
⏰ Disclosed: 2026-06-25 05:03:24
📝 Summary: null
📂 Report JSON File: 3582376
@hackeronereports

🎯 New Report #3618831: Unix domain socket server bypasses --permission network restrictions (incomplete CVE-2026-21636 fix)
🔺Severity: Low
👽 Reporter: cyberjoker
⭐️ Reputation: 716
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-03-20
⏰ Disclosed: 2026-06-25 05:03:07
📝 Summary: null
📂 Report JSON File: 3618831
@hackeronereports

🎯 New Report #3688064: Node.js unicode dot separator handling can lead to tls wildcard-depth authentication bypass due to resolver and verifier hostname normalization mismat
🔺Severity: High
👽 Reporter: tmeletlidis
⭐️ Reputation: 113
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-04-21
⏰ Disclosed: 2026-06-25 05:02:01
📝 Summary: null
📂 Report JSON File: 3688064
@hackeronereports

🎯 New Report #3656869: Uppercase sni context matching can lead to mtls authorization bypass due to case-sensitive hostname matching
🔺Severity: Medium
👽 Reporter: tmeletlidis
⭐️ Reputation: 113
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-04-07
⏰ Disclosed: 2026-06-25 05:01:31
📝 Summary: null
📂 Report JSON File: 3656869
@hackeronereports