🎯 New Report #3857258: Reachable assertion in node:zlib sync API crashes the entire process via spoofed TypedArray byteLength (all 11 *Sync functions affected)
🔺Severity: Medium
👽 Reporter: byvini
⭐️ Reputation: 109
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-07-11
⏰ Disclosed: 2026-08-28 14:16:19
📝 Summary: A flaw was discovered in the synchronous Node.js zlib APIs that allowed a spoofed TypedArray byteLength to trigger a reachable assertion, causing the entire process to crash. All 11 synchronous zlib functions were affected.
📂 Report JSON File: 3857258
@hackeronereports

🎯 New Report #3795657: dns.resolveAny() Aborts the Node.js Process When a DNS Response Contains More Than 256 A Records
🔺Severity: Medium
👽 Reporter: cantina-security
⭐️ Reputation: 2422
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-06-11
⏰ Disclosed: 2026-08-28 14:16:02
📝 Summary: A flaw in Node.js was discovered where the dns.resolveAny() function aborted the Node.js process when a DNS response contained more than 256 A records.
📂 Report JSON File: 3795657
@hackeronereports

🎯 New Report #3795900: node:sqlite SQLTagStore Iterator Replay Lets Attacker Re-Execute Victim-Bound Writes Indefinitely
🔺Severity: Medium
👽 Reporter: cantina-security
⭐️ Reputation: 2422
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-06-11
⏰ Disclosed: 2026-08-28 14:15:57
📝 Summary: A flaw was discovered in the node:sqlite package for Node.js that allowed a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it had been reset and rebound with new parameters. The vulnerability was caused by the SQLTagStore feature resetting cached statements using sqlite3 reset() directly, bypassing the iterator invalidation mechanism introduced in recent releases. This issue affected Node.js versions 22.x, 24.x, and 26.x.
📂 Report JSON File: 3795900
@hackeronereports

🎯 New Report #3833629: Re-entrant `nghttp2 session mem send()` during `nghttp2 session mem recv()` causes heap-use-after-free in Node.js HTTP/2
🔺Severity: High
👽 Reporter: hahahkim
⭐️ Reputation: 130
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-06-30
⏰ Disclosed: 2026-08-28 14:15:35
📝 Summary: A flaw was discovered in the Node.js HTTP/2 implementation that allowed the nghttp2 session mem send() function to be called re-entrantly while nghttp2 session mem recv() was executing, resulting in a heap-use-after-free vulnerability. This issue affected Node.js versions 26.x, 24.x, and 22.x.
📂 Report JSON File: 3833629
@hackeronereports

🎯 New Report #3846922: HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion
🔺Severity: High
👽 Reporter: leduckhuong
⭐️ Reputation: 131
🛠 State: resolved
💼 Team: Node.js
💵 Bounty: null
🕐 Submitted: 2026-07-06
⏰ Disclosed: 2026-08-28 14:15:33
📝 Summary: A flaw in Node.js HTTP/2 handling was discovered that could cause HTTP/2 retained header blocks to evade the maxSessionMemory setting and enable remote memory exhaustion.
📂 Report JSON File: 3846922
@hackeronereports

🎯 New Report #3931777: Author → arbitrary file deletion anywhere on disk (site takeover) via `POST /wp/v2/media/<id>/finalize` poisoning ` wp attachment metadata`
🔺Severity: Critical
👽 Reporter: jakubk
⭐️ Reputation: 222
🛠 State: resolved
💼 Team: WordPress
💵 Bounty: null
🕐 Submitted: 2026-08-11
⏰ Disclosed: 2026-08-28 16:39:48
📝 Summary: A vulnerability was discovered in the WordPress media processing functionality. This vulnerability allowed an authenticated author to delete arbitrary files on the server. The vulnerability was caused by insufficient input validation in the finalize item() function, which allowed an attacker to control the file paths stored in the attachment metadata. This resulted in the wp delete attachment files() function deleting files outside of the expected upload directory. The vulnerability was present in WordPress versions 7.0.2 and trunk revisions up to 7.1-beta3-62852.
📂 Report JSON File: 3931777
@hackeronereports

🎯 New Report #3931771: Author → stored XSS in wp-admin: unescaped sub-size filename from attachment metadata breaks out of the `src` attribute in `get media item()`
🔺Severity: Critical
👽 Reporter: jakubk
⭐️ Reputation: 222
🛠 State: resolved
💼 Team: WordPress
💵 Bounty: null
🕐 Submitted: 2026-08-11
⏰ Disclosed: 2026-08-28 16:38:57
📝 Summary: A vulnerability was discovered in the WordPress media upload and finalize endpoints. An author could upload a crafted image with a malicious filename, which was then stored verbatim by the endpoint and rendered without proper escaping in the WordPress admin media library. This could allow the execution of arbitrary JavaScript in the context of an administrator's browser session.
📂 Report JSON File: 3931771
@hackeronereports

🎯 New Report #3909372: Unauthorized vertical privilege escalation vulnerability found on ibm.com endpoint
🔺Severity: null
👽 Reporter: inventor0x01
⭐️ Reputation: 149
🛠 State: resolved
💼 Team: IBM
💵 Bounty: null
🕐 Submitted: 2026-08-02
⏰ Disclosed: 2026-08-28 18:20:00
📝 Summary: A vertical privilege escalation vulnerability was found on an ibm.com endpoint. The vulnerability was reported to IBM, analyzed, and remediated.
📂 Report JSON File: 3909372
@hackeronereports

🎯 New Report #3869124: **Unauthenticated IDOR allows modification of payment customer billing information**
🔺Severity: High
👽 Reporter: visionx7
⭐️ Reputation: 121
🛠 State: resolved
💼 Team: Weblate
💵 Bounty: null
🕐 Submitted: 2026-07-16
⏰ Disclosed: 2026-08-30 04:54:37
📝 Summary: The application contained an access control issue in the payment billing information edit functionality. An unauthenticated user was able to access the payment edit endpoint and modify the billing information associated with a payment without any authorization check. The issue occurred because the application allowed access to the edit page using only the payment identifier in the URL, and the server did not verify whether the requester was logged in or had permission to modify the customer information linked to that payment.
📂 Report JSON File: 3869124
@hackeronereports

🎯 New Report #1534465: Ticket Trick Attack allows access to Rockstar Games' workspaces
🔺Severity: High
👽 Reporter: recon ninja
⭐️ Reputation: 696
🛠 State: resolved
💼 Team: Rockstar Games
💵 Bounty: null
🕐 Submitted: 2022-04-07
⏰ Disclosed: 2026-09-01 19:03:44
📝 Summary: A vulnerability, referred to as "Ticket Trick Attack," was discovered in the support portal of Rockstar Games. The vulnerability allowed an attacker to gain unauthorized access to the company's workspaces by creating an account with an email address similar to the official support email address. This was possible because Rockstar Games did not properly validate the ownership of the email address before granting access on the support portal.
📂 Report JSON File: 1534465
@hackeronereports

🎯 New Report #3858504: connect.8x8.com: Automation Builder - Input Validation Issue in Workflow Step Outputs
🔺Severity: High
👽 Reporter: kyotozzx
⭐️ Reputation: 351
🛠 State: resolved
💼 Team: 8x8
💵 Bounty: 1337
🕐 Submitted: 2026-07-12
⏰ Disclosed: 2026-09-02 00:03:45
📝 Summary: An input validation issue was reported in the 8x8 Connect Automation Builder's API where workflow step output field names were not validated against reserved context variable names. The issue was addressed by implementing validation to reject reserved field names at workflow creation.
📂 Report JSON File: 3858504
@hackeronereports

🎯 New Report #3861550: connect.8x8.com: Deserialization Vulnerability in Automation Builder via Jint→Newtonsoft serializer coercion (TypeNameHandling)
🔺Severity: Critical
👽 Reporter: kyotozzx
⭐️ Reputation: 351
🛠 State: resolved
💼 Team: 8x8
💵 Bounty: 3000
🕐 Submitted: 2026-07-13
⏰ Disclosed: 2026-09-01 23:51:36
📝 Summary: A deserialization vulnerability was reported in the 8x8 Connect Automation Builder's HTTP request step. The vulnerability occurred when server-side template evaluation exposed Newtonsoft JSON objects directly to the Jint JavaScript engine. By providing a specially crafted JSON response, an authenticated user could coerce Jint's overload resolution to construct a JsonSerializer with attacker-controlled TypeNameHandling settings, enabling deserialization of arbitrary .NET types. The issue was addressed by projecting HTTP responses to plain JavaScript values before template evaluation, removing all Newtonsoft object exposure from the template scope.
📂 Report JSON File: 3861550
@hackeronereports

🎯 New Report #3887969: SSRF via URL Parser Differential in `normalize request url` (wlc)
🔺Severity: High
👽 Reporter: dark river
⭐️ Reputation: 179
🛠 State: resolved
💼 Team: Weblate
💵 Bounty: null
🕐 Submitted: 2026-07-24
⏰ Disclosed: 2026-09-02 07:49:35
📝 Summary: The Weblate CLI client (wlc) was found to be vulnerable to Server-Side Request Forgery (SSRF) due to a differential in URL parsing between the urllib and urllib3 libraries. The vulnerability was present in the normalize request url function, which was meant to validate that outgoing API requests stayed on the configured server's origin. However, the actual HTTP request was dispatched by the requests library, which relied on urllib3's URL parser. This allowed an attacker-controlled server to return a crafted URL that passed the origin validation but resulted in the client making a request to an arbitrary host.
📂 Report JSON File: 3887969
@hackeronereports

🎯 New Report #3769676: Stack Overflow DoS in ST GeomFromGeoJSON Allows Any Authenticated User to Crash the Entire Server
🔺Severity: Medium
👽 Reporter: byteoverride
⭐️ Reputation: 210
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-05-29
⏰ Disclosed: 2026-09-03 22:13:55
📝 Summary: A vulnerability was discovered in the MariaDB database server's ST GeomFromGeoJSON function. Any authenticated user with basic SELECT privileges could crash the entire server by passing a deeply nested GeoJSON GeometryCollection. The crash was caused by unbounded recursion in the GeoJSON parser, which consumed the server's stack until it overflowed, leading to a SIGSEGV crash that killed all active connections and required a full server restart. The vulnerability existed since the introduction of ST GeomFromGeoJSON in MariaDB 10.2.4 and affected all versions through the current development trunk.
📂 Report JSON File: 3769676
@hackeronereports

🎯 New Report #3825141: API token sent to URL dictated by an untrusted project .weblate file
🔺Severity: Medium
👽 Reporter: type5afe
⭐️ Reputation: 157
🛠 State: resolved
💼 Team: Weblate
💵 Bounty: null
🕐 Submitted: 2026-06-25
⏰ Disclosed: 2026-09-04 08:10:51
📝 Summary: A vulnerability was discovered in the wlc Python library used to interact with the Weblate translation management system. The vulnerability allowed an untrusted .weblate file to specify the Weblate API URL, which could then receive the API token set in the environment. The API token was resolved independently and was not bound to a trusted URL source, allowing the secret to be sent to an attacker-chosen server.
📂 Report JSON File: 3825141
@hackeronereports

🎯 New Report #3898281: Unauthenticated ?q= search query causes exponential pyparsing backtracking under a process-global lock in Weblate
🔺Severity: High
👽 Reporter: type5afe
⭐️ Reputation: 157
🛠 State: resolved
💼 Team: Weblate
💵 Bounty: null
🕐 Submitted: 2026-07-29
⏰ Disclosed: 2026-09-04 08:10:22
📝 Summary: A vulnerability was discovered in Weblate, an open-source translation management system. The vulnerability was caused by the search query grammar implementation in Weblate, which was built using the pyparsing library. The grammar was ambiguous at every position and did not enable memoization, leading to exponential backtracking during parsing of search queries with nested parentheses. This resulted in a significant performance impact, with a 33-byte query string consuming 52 seconds of CPU time. The parsing was performed while holding a process-global lock, causing all other search, browse, translate, and zen page requests to stall in the same worker process.
📂 Report JSON File: 3898281
@hackeronereports

🎯 New Report #3521434: View-only guests could see deleted Collectives pages in the trashbin
🔺Severity: Low
👽 Reporter: yoyomiski
⭐️ Reputation: 1031
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2026-01-23
⏰ Disclosed: 2026-05-08 08:35:48
📝 Summary: A vulnerability was discovered where view-only guests could see deleted Collectives pages in the trashbin.
📂 Report JSON File: 3521434
@hackeronereports

🎯 New Report #3617729: Mail contact autocomplete bypasses administrator-configured user enumeration restrictions and expose member information outside the intended scope
🔺Severity: Medium
👽 Reporter: njh215
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2026-03-20
⏰ Disclosed: 2026-09-04 20:38:01
📝 Summary: A vulnerability was discovered in the Mail contact autocomplete feature of Nextcloud that allowed an authenticated user to bypass administrator-configured user enumeration restrictions and expose member information outside the intended scope. The vulnerability was present in the ContactIntegrationController::autoComplete() handler, which did not apply the stricter user enumeration controls used elsewhere in the product.
📂 Report JSON File: 3617729
@hackeronereports

🎯 New Report #3513471: Unauthenticated testing endpoint of notify push expose internal IP
🔺Severity: Medium
👽 Reporter: chinnuy935336
⭐️ Reputation: 114
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: 150
🕐 Submitted: 2026-01-16
⏰ Disclosed: 2026-09-05 14:45:39
📝 Summary: The testing endpoint of the notify push component exposed internal IP addresses to unauthenticated users.
📂 Report JSON File: 3513471
@hackeronereports

🎯 New Report #3507273: Email Enumeration via Password-Protected Share Identity Verification
🔺Severity: Low
👽 Reporter: cybershinu90
⭐️ Reputation: 92
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: 100
🕐 Submitted: 2026-01-12
⏰ Disclosed: 2026-09-05 14:38:27
📝 Summary: The vulnerability allowed email enumeration through password-protected share identity verification. Requesting a password for an email share resulted in different response messages depending on whether the email address was the intended recipient, enabling confirmation of the share recipient.
📂 Report JSON File: 3507273
@hackeronereports

🎯 New Report #3521639: Improper Input Validation and Integer Overflow in timeamount parameter of files retention app
🔺Severity: Low
👽 Reporter: nishantbaswal1996
⭐️ Reputation: 109
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2026-01-23
⏰ Disclosed: 2026-09-05 14:29:27
📝 Summary: The timeamount parameter of the files retention app lacked proper input validation, allowing an administrator to store an unintended long time amount as the retention period. This vulnerability could have potentially led to files never getting deleted.
📂 Report JSON File: 3521639
@hackeronereports