HackerOne Disclosed Reports - 2026-10-14

hashXploiter · hashXploiter Yesterday, 12:30 PM Administrator

High
resolved

[Switch] Remote stack buffer overflow in the LDN/LP2P DHCP server leads to control-flow hijack

Bug reported by moe_hw was disclosed at October 15, 2026, 1:14 am | Stack Overflow

A stack-based buffer overflow vulnerability was discovered in local wireless networking functionality. The vulnerability could be exploited through crafted network traffic to execute arbitrary code using return-oriented programming techniques.

Medium
resolved

Unauthenticated self-registration on ████████ grants full access to internal supplier procurement portal and vendor data

Bug reported by Oussama was disclosed at October 14, 2026, 12:32 pm | Missing Authentication for Critical Function

An unauthenticated self-registration endpoint was discovered on an internal supplier procurement portal. The registration form was fully functional and accessible without any invitation, approval code, or affiliation verification. A test account was successfully created and confirmed via email. Upon login, the account was granted access to live vendor data including vendor numbers and names through automatic API calls. The account was not sandboxed and returned real procurement system records rather than empty or restricted data.

Low
resolved

Uncaught RecursionError crash in translation-finder (deep directory tree DoS)

Bug reported by 0xsumit was disclosed at October 14, 2026, 11:53 am | Uncontrolled Resource Consumption

A denial of service vulnerability was discovered in a translation discovery tool where uncaught recursion errors could crash processing during repository scanning. The issue occurred when scanning directories nested approximately 1000 levels deep, which exceeded the Python recursion limit and resulted in an unhandled RecursionError exception. The vulnerability affected the discovery function used for import, update, and webhook operations. The error was not caught by existing exception handlers, causing the entire discovery call to fail repeatedly. The issue was caused by recursive directory traversal without depth limiting or proper exception handling. A fix was implemented by adding RecursionError to the exception handler to gracefully skip problematic subtrees instead of crashing.

High
resolved

Stored XSS on the public Pontoon dashboards: the latest-activity tooltip re-parses a contributor's account address as HTML

Bug reported by Tim Haines was disclosed at October 14, 2026, 8:12 am | Cross-site Scripting (XSS) - Stored

A stored cross-site scripting vulnerability was discovered in public dashboards where contributor-supplied data values were concatenated into markup without proper encoding. An attacker could register an account with a malicious script in the email address field, which would then execute in the browser sessions of users who interacted with the affected tooltip. The vulnerability was patched through multiple updates that disabled local signup, restored content security policies, and refactored the tooltip to use DOM nodes instead of string concatenation.

Low
resolved

HackerOne Disclosed Reports - 2026-10-14

hashXploiter

[Switch] Remote stack buffer overflow in the LDN/LP2P DHCP server leads to control-flow hijack

Unauthenticated self-registration on ████████ grants full access to internal supplier procurement portal and vendor data

Uncaught RecursionError crash in translation-finder (deep directory tree DoS)

Stored XSS on the public Pontoon dashboards: the latest-activity tooltip re-parses a contributor's account address as HTML

CVE-2026-107928: info leak uploading over WebSockets with GnuTLS

CVE-2026-107929: local interface connection reuse mixup

CVE-2026-86415: auto client cert connection reuse mixup

CVE-2026-86414: leaking host credentials to HTTP proxy

CVE-2026-87866: wolfSSL public-key pinning bypass

CVE-2026-87865: knownhost callback mismatches key as missing

CVE-2026-87861: cross-origin reuse of a Negotiate connection

CVE-2026-92392: HTTP/2 upload Use-After-Free