Bug Bounty Channel

🏦 HackerOne Report 🔥 Title: IDOR allows user to access report details via reference.json endpoint 🔍 Reporter: sm41ldrag0n79_mbbank (sm41ldrag0n_mbbank) 📋 Details: └ 📊 Status: resolved └ ⚡ Severity: Critical └ 🎯 CWE: Insecure Direct Object Reference \(IDOR\) └ 🔢 CVE: None ⏰ Timeline: └ 🔓 Disclosed: 2026-10-01 01:27:40 UTC └ 📝 Created: 2026-07-14 10:18:10 UTC

🏦 Nextcloud Report ⚡ Title: SSRF via User-Controlled Push proxyServer in Notifications Push Registration 🔍 Reporter: yoyomiski (_dha) 📋 Details: └ 📊 Status: resolved └ ⚡ Severity: Medium └ 🎯 CWE: Server-Side Request Forgery \(SSRF\) └ 🔢 CVE: None ⏰ Timeline: └ 🔓 Disclosed: 2026-09-30 15:43:58 UTC └ 📝 Created: 2026-03-23 15:28:26 UTC

🏦 MariaDB Report ❓ Title: Connector/C Out-of-bounds read in \`unpack\_fields\(\)\` from short metadata field 🔍 Reporter: mschorm (Michal Schorm) 📋 Details: └ 📊 Status: resolved └ ⚡ Severity: Not Specified └ 🎯 CWE: Out-of-bounds Read └ 🔢 CVE: None ⏰ Timeline: └ 🔓 Disclosed: 2026-09-30 10:29:05 UTC └ 📝 Created: 2026-07-28 15:42:04 UTC

🏦 MariaDB Report ⚡ Title: Connector/J: malicious server crashes client JVM via unbounded result-set field-count allocation in ClientMessage.readPacket 🔍 Reporter: fg0x0 (Yalguun Tumenkhuu) 📋 Details: └ 📊 Status: resolved └ ⚡ Severity: Medium └ 🎯 CWE: Uncontrolled Resource Consumption └ 🔢 CVE: None ⏰ Timeline: └ 🔓 Disclosed: 2026-09-30 08:00:19 UTC └ 📝 Created: 2026-07-18 08:55:21 UTC

🏦 WordPress Report ⚡ Title: Unauthenticated disclosure of draft/private/pending post titles & IDs via Secure Custom Fields nopriv AJAX field-query handlers \(post\_object/relations 🔍 Reporter: jakubk (Jakub Kozub) 📋 Details: └ 📊 Status: resolved └ ⚡ Severity: Medium └ 🎯 CWE: Improper Access Control - Generic └ 🔢 CVE: None ⏰ Timeline: └ 🔓 Disclosed: 2026-09-28 11:14:24 UTC └ 📝 Created: 2026-07-27 14:35:29 UTC

🏦 curl Report ⚡ Title: Missing applicability validation allows non-applicable HTTPS RR to reach ECH processing 🔍 Reporter: m4nray (Muhammad Rizky Dermawan) 📋 Details: └ 📊 Status: not-applicable └ ⚡ Severity: Medium └ 🎯 CWE: Business Logic Errors └ 🔢 CVE: None ⏰ Timeline: └ 🔓 Disclosed: 2026-09-26 08:35:38 UTC └ 📝 Created: 2026-09-23 09:05:06 UTC

🏦 curl Report ⚠️ Title: \[HIGH\ CWE-22 — Path Traversal in FTP Wildcard Download via Unencoded `.` in Escaped Filenames](https://hackerone.com/reports/4057637) 🔍 Reporter: mrtomato (Fernando Gallardo) 📋 Details: └ 📊 Status: informative └ ⚡ Severity: High └ 🎯 CWE: Path Traversal └ 🔢 CVE: None ⏰ Timeline: └ 🔓 Disclosed: 2026-09-26 08:35:51 UTC └ 📝 Created: 2026-09-24 21:11:41 UTC

🏦 curl Report 📋 Title: Windows filename sanitizer misses Unicode COM/LPT reserved device names 🔍 Reporter: giant_anteater (Anteater) 📋 Details: └ 📊 Status: informative └ ⚡ Severity: None └ 🎯 CWE: Not Specified └ 🔢 CVE: None ⏰ Timeline: └ 🔓 Disclosed: 2026-09-24 14:02:27 UTC └ 📝 Created: 2026-09-18 18:05:43 UTC

🏦 HackerOne Report 📝 Title: HackerOne Code sends live password-reset tokens to Segment in automatic page events 🔍 Reporter: 1rhino2 (1rhino2) 📋 Details: └ 📊 Status: resolved └ ⚡ Severity: Low └ 🎯 CWE: Insufficiently Protected Credentials └ 🔢 CVE: None ⏰ Timeline: └ 🔓 Disclosed: 2026-09-24 11:29:38 UTC └ 📝 Created: 2026-09-05 04:29:54 UTC

🏦 Nextcloud Report 📝 Title: Improper input validation in emoji field leads to sidebar UI denial of service 🔍 Reporter: yoyomiski (_dha) 📋 Details: └ 📊 Status: resolved └ ⚡ Severity: Low └ 🎯 CWE: Business Logic Errors └ 🔢 CVE: None ⏰ Timeline: └ 🔓 Disclosed: 2026-09-20 10:04:20 UTC └ 📝 Created: 2026-03-12 08:39:51 UTC