Dark C0d3rs - Research Papers/Vulnerability reports

HackerOne Disclosed Reports - 2026-09-20

Mon, 21 Sep 2026 07:00:03 +0000

Low
resolved

Improper input validation in emoji field leads to sidebar UI denial of service

Bug reported by _dha was disclosed at September 20, 2026, 10:04 am | Business Logic Errors

A vulnerability was discovered in the Collectives app version 4.0.0 where the emoji field in the page emoji update endpoint did not properly validate user input. An attacker could have submitted an excessively long string including newline characters instead of a valid emoji, causing the sidebar layout to become broken.

HackerOne Disclosed Reports - 2026-09-18

Sat, 19 Sep 2026 07:00:02 +0000

Medium
resolved

files_lock: a write-share collaborator can place a TYPE_TOKEN lock that permanently denies the file owner, survives share revocation and account delet

Bug reported by rz1027 was disclosed at September 18, 2026, 3:36 pm | Improper Access Control - Generic

A vulnerability was discovered in files_lock 33.0.4 on Nextcloud 33.0.3 that allowed a user with write-share permissions on a file to place a permanent lock on the file that could not be removed by the file owner or an administrator. The lock was stored in the database and persisted even after the collaborator's account was deleted or recreated. The only way to remove the lock was through direct database access, which was not documented in the application's administrative tools.

Critical
resolved

Unauthenticated API allows reading, writing to and deleting any user's private chat history on ████████

Bug reported by Juan Agustin Niccolini was disclosed at September 18, 2026, 6:04 am | Misconfiguration

An unauthenticated API was discovered that allowed reading, writing to, and deleting any user's private chat history on the organization's internal chatbot application. The API had no authentication mechanism in place, allowing an attacker to list all conversations, retrieve the complete message history of any conversation, create new conversations, and delete any conversation. The deletion of a conversation was incomplete, as the underlying messages remained retrievable even after the conversation was removed from the listing.

HackerOne Disclosed Reports - 2026-09-17

Fri, 18 Sep 2026 07:00:03 +0000

Critical
resolved

Unauthenticated API allows reading, writing to and deleting any user's private chat history on ████████

Bug reported by Juan Agustin Niccolini was disclosed at September 18, 2026, 6:04 am | Misconfiguration

Medium
resolved

SSRF with bypass leads to client side hosting / vulnerabilities ( XSS and others )

Bug reported by Daniel Ferreira was disclosed at September 17, 2026, 10:54 pm | Server-Side Request Forgery (SSRF)

The web application was found to be vulnerable to server-side request forgery (SSRF). The SSRF vulnerability was discovered through testing with an HTTP interception proxy. The vulnerability allowed an attacker to make arbitrary HTTP requests from the server, which could potentially lead to unauthorized access or data exposure.

High
resolved

sign_multisig crashes monero-wallet-rpc on a malformed but decryptable multisig txset

Bug reported by 0xbro was disclosed at September 17, 2026, 5:45 pm |

The vulnerability in `monero-wallet-rpc`'s `sign_multisig` function allowed a malformed but decryptable multisig transaction set to cause a process crash instead of returning an error. The issue was resolved in version 0.18.5.0.

Medium
resolved

Restricted ZMQ RPC bypasses HTTP restricted-mode resource checks

Bug reported by 0xbro was disclosed at September 17, 2026, 5:42 pm |

The restricted ZMQ RPC in monerod did not enforce the same request restrictions as the restricted HTTP RPC. The ZMQ RPC relied primarily on a small method blocklist, allowing several allowed methods to accept requests that the restricted HTTP RPC explicitly rejected or capped. This issue was resolved in version 0.18.5.0.

Medium
resolved

ZMQ get_output_distribution duplicate amount DoS

Bug reported by 0xbro was disclosed at September 17, 2026, 5:38 pm |

The ZMQ `get_output_distribution` RPC was vulnerable to a memory exhaustion denial-of-service attack. The method accepted an unbounded `amounts` array and returned a separate distribution for each entry, allowing a small request to expand into a very large response by repeatedly including the amount `0`. The issue was also reachable with `--restricted-zmq-rpc` because ZMQ lacked the stricter validation applied by restricted HTTP RPC. The vulnerability was resolved in You are not allowed to view links. Register or Login to view. and v0.18.5.0.

Medium
resolved

Cross-User Lock/Unlock via Absolute DAV Path

Bug reported by Balvant Chavda was disclosed at September 17, 2026, 1:09 pm | Improper Authentication - Generic

A vulnerability was discovered in the files_lock app for Nextcloud. The vulnerability allowed any authenticated user to lock or unlock files they did not own by targeting absolute WebDAV paths of other users. This was possible because the DAV plugin resolved files from the absolute request URI without verifying that the user ID path segment matched the authenticated session user. This enabled cross-user manual locks and lock token disclosure, which allowed unauthorized callers to remove token-based locks of other users.

Medium
resolved

Shared smart albums in the Photos app can expose files outside the album owner's configured source folders

Bug reported by Joseph Semaan was disclosed at September 17, 2026, 10:48 am | Improper Access Control - Generic

A vulnerability was discovered in a file manager component of a file sharing application. The vulnerability allowed an attacker to access files outside of the intended shared folder by configuring more permissive search paths than the victim intended. This resulted in unauthorized information disclosure, as the system used the attacker's configuration to determine the search scope in the victim's folder. The vulnerability was caused by insufficient validation of the search paths provided by the attacker.

Medium
resolved

Critical broken access control: API-only delegated admin can enumerate all Team Folders and grant access to arbitrary groups

Bug reported by qloo was disclosed at September 17, 2026, 10:41 am | Improper Access Control - Generic

A critical broken access control vulnerability was discovered in Nextcloud's Group Folders app. The vulnerability allowed an API/REST only delegated admin to bypass folder-level authorization and gain access to any Team Folder by abusing the POST /index.php/apps/groupfolders/folders/{id}/groups endpoint. This was possible because the folder IDs were predictable, allowing the attacker to enumerate all Team Folders and mass-assign their own group, resulting in full access to organization-wide data.

Medium
resolved

Approval app's file-freshness check can be bypassed by omitting the etag parameter, allowing approval of unreviewed file changes

Bug reported by Dang Hung Vi was disclosed at September 17, 2026, 10:34 am | Business Logic Errors

A vulnerability was discovered in the approval app's file-freshness check. The vulnerability allowed bypassing the check by omitting the etag parameter, enabling approval of unreviewed file changes. This broke the integrity of the approval process, as the approver could approve a different file state than the one they reviewed.

Medium
resolved

Arbitrary Board Preference Injection via Deck Config API

Bug reported by Dang Hung Vi was disclosed at September 17, 2026, 10:20 am | Improper Access Control - Generic

A vulnerability was discovered in the Deck Config API of the Nextcloud application that allowed authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating the user's ownership or permission to manage the referenced board.

Low
resolved

Public collectives allow to create pages

Bug reported by _dha was disclosed at September 17, 2026, 10:16 am | Improper Access Control - Generic

A vulnerability was discovered in the Nextcloud Collectives application that allowed non-members accessing a public collective to create new pages through the backend API, bypassing the collective-level permission settings configured to restrict editing to administrators only. The vulnerability was caused by inconsistent permission enforcement between the user interface, collective settings, and backend API.

Medium
resolved

Unauthenticated blind SSRF in Circles signature verification bypasses Nextcloud local-address protections

Bug reported by Balvant Chavda was disclosed at September 17, 2026, 6:22 am | Server-Side Request Forgery (SSRF)

A blind SSRF vulnerability was discovered in the Circles app for Nextcloud. The vulnerability allowed unauthenticated users to force the server to fetch internal URLs, bypassing local-address protections in Nextcloud. The vulnerability was caused by the Circles app's signature verification process, which fetched an attacker-provided URL before trust was established.

Low
resolved

Team membership information returned on API level based on ID

Bug reported by Melanie was disclosed at September 17, 2026, 5:49 am | Insecure Direct Object Reference (IDOR)

A vulnerability was discovered in the Nextcloud Circles app that allowed any authenticated user to access membership information for any circle and user combination, regardless of their authorization. The issue stemmed from a lack of permission checks in the affected service and request classes, as well as the public exposure of the vulnerable functionality through an API endpoint. This vulnerability could have led to the disclosure of sensitive organizational data, including private circle memberships, inheritance relationships, and user identification details.

HackerOne Disclosed Reports - 2026-09-16

Thu, 17 Sep 2026 07:00:03 +0000

Medium
resolved

Unauthenticated blind SSRF in Circles signature verification bypasses Nextcloud local-address protections

Bug reported by Balvant Chavda was disclosed at September 17, 2026, 6:22 am | Server-Side Request Forgery (SSRF)

Low
resolved

Team membership information returned on API level based on ID

Bug reported by Melanie was disclosed at September 17, 2026, 5:49 am | Insecure Direct Object Reference (IDOR)

High
resolved

Incomplete Input Sanitization in CodeInterpreter install_packages Allows Command Injection via pip Flags

Bug reported by Sergio Garcia was disclosed at September 16, 2026, 8:57 pm | OS Command Injection

The Bedrock AgentCore Python SDK was found to have an incomplete input sanitization vulnerability in the `install_packages()` method. The sanitization process failed to properly handle certain pip flags, such as `--index-url`, which allowed arbitrary command execution within the Code Interpreter sandbox. This vulnerability was discovered to affect all versions of the `bedrock-agentcore-sdk-python` up to at least v1.4.8.

High
resolved

Authenticated `unsigned_txset` change spoof lets a malicious hot wallet steal cold-signer change

Bug reported by usagirabbit was disclosed at September 16, 2026, 9:16 am | Business Logic Errors

A vulnerability was discovered in Monero's wallet code that allowed a malicious or compromised hot/watch-only wallet with the victim wallet's private view key to forge an authenticated unsigned transaction. The forged transaction included an attacker-controlled output that was presented as change, and the offline signer then reconstructed and signed that output as change. This resulted in a direct loss-of-funds issue, as the resulting output was attacker-spendable and not victim-spendable.

HackerOne Disclosed Reports - 2026-09-15

Wed, 16 Sep 2026 07:00:03 +0000

High
resolved

Incomplete fix for CVE-2022-23915: Mercurial argument injection in HgRepository.get_file() leads to command execution

Bug reported by Shawky was disclosed at September 15, 2026, 8:36 am | OS Command Injection

A vulnerability was discovered in Weblate, a web-based translation tool. The vulnerability was caused by an incomplete fix for a previous issue (CVE-2022-23915). Weblate passed repository-controlled filenames to Mercurial without properly escaping them, allowing filenames beginning with "-" to be interpreted as command-line options. This could be abused by an authenticated user with project-scoped component-edit permission to inject Mercurial configuration and execute arbitrary commands as the Weblate service account. The vulnerability affected Weblate versions 4.11.1 through 2026.7.1 and was later assigned CVE-2026-86035.

HackerOne Disclosed Reports - 2026-09-14

Tue, 15 Sep 2026 07:00:03 +0000

High
resolved

HTTP Request Smuggling via Unsanitized Hop-by-Hop Headers

Bug reported by Quan Le was disclosed at September 14, 2026, 4:57 am | Improper Access Control - Generic

The vulnerability allowed forwarding of HTTP/1 h2c upgrade requests to upstream servers, bypassing request-level filters applied by the proxy. The issue was addressed in Pingora version 0.9.0, which restricted HTTP/1 upgrades to WebSocket by default.

HackerOne Disclosed Reports - 2026-09-13

Mon, 14 Sep 2026 07:00:04 +0000

High
resolved

HTTP Request Smuggling via Unsanitized Hop-by-Hop Headers

Bug reported by Quan Le was disclosed at September 14, 2026, 4:57 am | HTTP Request Smuggling

A vulnerability was found in Pingora that could allow HTTP request smuggling through improper handling of hop-by-hop headers. The issue was fixed in Pingora 0.9.0.

HackerOne Disclosed Reports - 2026-09-12

Sun, 13 Sep 2026 07:00:03 +0000

Medium
resolved

Action Text to_markdown: / content escapes its delimiter, letting a stored body inject arbitrary Markdown



                 Bug reported by   seoafoz was disclosed at September 12, 2026, 7:08 pm   |   Cross-site Scripting (XSS) - Stored



HackerOne Disclosed Reports - 2026-09-10
Fri, 11 Sep 2026 07:00:03 +0000

                
                      
                    
                        Medium

                        resolved

                    
                
                 Conflux-queued zero-length RELAY_END triggers heap out-of-bounds read


                 Bug reported by   Brian Carpenter was disclosed at September 10, 2026, 12:10 pm   |   Out-of-bounds Read 
                 A vulnerability was discovered in Tor that could trigger a heap out-of-bounds read when a zero-length RELAY_END cell was processed on a non-open AP stream. The vulnerability was caused by the way Tor handles these cells, where the reason byte was read before checking the message length. This issue was compounded by Conflux's out-of-order delivery, which could copy the zero-length message into an exact-size heap allocation, leading to the out-of-bounds read. 
              


                
                      
                    
                        Low

                        resolved

                    
                
                  Tor onion service INTRODUCE2 invalid-MAC cells permanently grow service replay cache


                 Bug reported by   Brian Carpenter was disclosed at September 10, 2026, 12:10 pm   |   Uncontrolled Resource Consumption 
                 A vulnerability was discovered in Tor's onion service INTRODUCE2 handling. A remote client could send well-formed INTRODUCE1 cells with an invalid MAC, but a unique byte pattern. The introduction point would forward these cells as INTRODUCE2 to the onion service. The onion service would insert the attacker-controlled encrypted section into the introduction-point replay cache before verifying the INTRODUCE2 MAC. The replay cache was created with no expiration, allowing the attacker to grow it with unauthenticated data until memory pressure or out-of-memory. 
              




HackerOne Disclosed Reports - 2026-09-08
Wed, 09 Sep 2026 07:00:03 +0000

                
                      
                    
                        Critical

                        resolved

                    
                
                 Stack Buffer Overflow in mariadb-dump quote_name() Allows Malicious Server to Execute Arbitrary Code on Client


                 Bug reported by   Byte Override was disclosed at September 8, 2026, 1:30 pm   |   Stack Overflow 
                 A stack buffer overflow was discovered in the quote_name() function of the mariadb-dump client application. The overflow occurred due to a lack of length validation on table names returned by a malicious MySQL server. This allowed a server to provide an excessively long table name that would overflow the fixed-size buffer, leading to the overwriting of the return address and other control-flow data on the stack. The vulnerability was confirmed to provide full control of the instruction pointer and several general-purpose registers, enabling remote code execution against any mariadb-dump client that connected to the malicious server. 
              


                
                      
                    
                        High

                        resolved

                    
                
                 Out-of-bounds read in MariaDB .frm parsing enables RCE via vtable hijacking


                 Bug reported by   pinebudweiser was disclosed at September 8, 2026, 8:19 am   |   Out-of-bounds Read 
                 A vulnerability was discovered in MariaDB where the `key_part->fieldnr` value parsed from a crafted `.frm` file was not validated before being used as an index into the `share->field[]` array. This resulted in an out-of-bounds read, allowing an attacker to hijack the C++ virtual method call and achieve arbitrary code execution within the context of the MariaDB server process. The vulnerability was successfully reproduced on MariaDB versions 10.4.18, 11.8.8, 12.3.2, and 13.1.0 Preview. 
              




HackerOne Disclosed Reports - 2026-09-07
Tue, 08 Sep 2026 07:00:03 +0000

                
                      
                    
                        High

                        resolved

                    
                
                 MariaDB GRANT PROXY permits unauthorized authentication changes and administrator account takeover


                 Bug reported by   kevin_Mizu was disclosed at September 7, 2026, 8:07 pm   |   Improper Access Control - Generic 
                 A vulnerability was discovered in MariaDB that allowed an authenticated user with only USAGE privileges to change the password of an existing administrator account. This was achieved through the grantee clause of the GRANT PROXY statement, which permitted bypassing the authorization checks and directly modifying the target account's authentication information. The vulnerability was tested on MariaDB versions 12.3.2 and 13.1.0. 
              


                
                      
                    
                        Medium

                        resolved

                    
                
                 MariaDB: heap buffer overflow in ha_tina::chain_append() lets a low-privileged user crash the server via CSV row deletion


                 Bug reported by   Vertical was disclosed at September 7, 2026, 7:59 pm   |   Heap Overflow 
                 A heap buffer overflow vulnerability was discovered in the ha_tina::chain_append() function of the MariaDB database server. The vulnerability was caused by an incorrect memory allocation during the growth of a data structure. This could allow a low-privileged user to crash the server by executing a specific SQL command involving CSV data deletion. The vulnerability was confirmed to affect both the stock Ubuntu package and a source build of MariaDB. 
              


                
                      
                    
                        Medium

                        resolved

                    
                
                 ACL cache collision lets a role inherit privileges from a same-named socket user


                 Bug reported by    was disclosed at September 7, 2026, 7:55 pm   |   Improper Authentication - Generic 
                 A vulnerability was discovered in MariaDB's database privilege cache where a role and a UNIX-socket user with the same name were not distinguished. When the socket user warmed the cache with their privileges, a different account that activated the same-named role then received the cached user privileges, even though those privileges were never granted to the role. 
              




HackerOne Disclosed Reports - 2026-09-06
Mon, 07 Sep 2026 07:00:03 +0000

                
                      
                    
                        High

                        resolved

                    
                
                 PII Exposure of Credit Applications and Social Security Numbers equifax-6070.my.salesforce-sites.com (Salesforce guest user)


                 Bug reported by   David Crees was disclosed at September 6, 2026, 10:03 am   |   Improper Authentication - Generic 
                 A Salesforce community portal belonging to Equifax was found to be leaking tens of thousands of credit reports and other sensitive financial information. The portal's Salesforce guest user profile and sharing settings granted unauthenticated access to multiple objects, including Contact, Online_Credit_Application__c, and related financial data. This exposure allowed an anonymous user to read a large number of records containing sensitive personally identifiable information. 
              




HackerOne Disclosed Reports - 2026-09-05
Sun, 06 Sep 2026 07:00:03 +0000

                
                      
                    
                        Medium

                        resolved

                    
                
                 Unauthenticated testing endpoint of notify_push expose internal IP


                 Bug reported by   chinnuy was disclosed at September 5, 2026, 2:45 pm   |   Information Disclosure 
                 The testing endpoint of the notify_push component exposed internal IP addresses to unauthenticated users. 
              


                
                      
                    
                        Low

                        resolved

                    
                
                 Email Enumeration via Password-Protected Share Identity Verification


                 Bug reported by   cybershinu was disclosed at September 5, 2026, 2:38 pm   |   Information Disclosure 
                 The vulnerability allowed email enumeration through password-protected share identity verification. Requesting a password for an email share resulted in different response messages depending on whether the email address was the intended recipient, enabling confirmation of the share recipient. 
              


                
                      
                    
                        Low

                        resolved

                    
                
                 Improper Input Validation and Integer Overflow in timeamount parameter of files_retention app


                 Bug reported by   nishant baswal was disclosed at September 5, 2026, 2:29 pm   |   Integer Overflow 
                 The timeamount parameter of the files_retention app lacked proper input validation, allowing an administrator to store an unintended long time amount as the retention period. This vulnerability could have potentially led to files never getting deleted. 
              


                
                      
                    
                        Low

                        resolved

                    
                
                 Missing Duplicate Check allowing Multiple Retention Rules per System Tag


                 Bug reported by   charankumar was disclosed at September 5, 2026, 2:23 pm   |   Business Logic Errors 
                 A bug allowed admins to create multiple retention rules for the same tag, causing potential confusion for other admins. 
              


                
                      
                    
                        Low

                        resolved

                    
                
                 Activity app does not verify federated file activity received from remote servers 


                 Bug reported by   cyebrsunita was disclosed at September 5, 2026, 2:18 pm   |   Improper Authentication - Generic 
                 The activity app stored activity content received from remote servers without verifying the content first. 
              




HackerOne Disclosed Reports - 2026-09-04
Sat, 05 Sep 2026 07:00:03 +0000

                
                      
                    
                        Medium

                        resolved

                    
                
                 Mail contact autocomplete bypasses administrator-configured user enumeration restrictions and expose member information outside the intended scope


                 Bug reported by   Jaeho Nam was disclosed at September 4, 2026, 8:38 pm   |   Privacy Violation 
                 A vulnerability was discovered in the Mail contact autocomplete feature of Nextcloud that allowed an authenticated user to bypass administrator-configured user enumeration restrictions and expose member information outside the intended scope. The vulnerability was present in the `ContactIntegrationController::autoComplete()` handler, which did not apply the stricter user enumeration controls used elsewhere in the product. 
              


                
                      
                    
                        Medium

                        resolved

                    
                
                 API token sent to URL dictated by an untrusted project .weblate file


                 Bug reported by   type5afe was disclosed at September 4, 2026, 8:10 am   |   Information Disclosure 
                 A vulnerability was discovered in the wlc Python library used to interact with the Weblate translation management system. The vulnerability allowed an untrusted .weblate file to specify the Weblate API URL, which could then receive the API token set in the environment. The API token was resolved independently and was not bound to a trusted URL source, allowing the secret to be sent to an attacker-chosen server. 
              


                
                      
                    
                        High

                        resolved

                    
                
                 Unauthenticated ?q= search query causes exponential pyparsing backtracking under a process-global lock in Weblate


                 Bug reported by   type5afe was disclosed at September 4, 2026, 8:10 am   |   Uncontrolled Resource Consumption 
                 A vulnerability was discovered in Weblate, an open-source translation management system. The vulnerability was caused by the search query grammar implementation in Weblate, which was built using the `pyparsing` library. The grammar was ambiguous at every position and did not enable memoization, leading to exponential backtracking during parsing of search queries with nested parentheses. This resulted in a significant performance impact, with a 33-byte query string consuming 52 seconds of CPU time. The parsing was performed while holding a process-global lock, causing all other search, browse, translate, and zen page requests to stall in the same worker process. 
              




HackerOne Disclosed Reports - 2026-09-03
Fri, 04 Sep 2026 07:00:03 +0000

                
                      
                    
                        Medium

                        resolved

                    
                
                 Stack Overflow DoS in ST_GeomFromGeoJSON Allows Any Authenticated User to Crash the Entire Server


                 Bug reported by   Byte Override was disclosed at September 3, 2026, 10:13 pm   |   Stack Overflow 
                 A vulnerability was discovered in the MariaDB database server's ST_GeomFromGeoJSON function. Any authenticated user with basic SELECT privileges could crash the entire server by passing a deeply nested GeoJSON GeometryCollection. The crash was caused by unbounded recursion in the GeoJSON parser, which consumed the server's stack until it overflowed, leading to a SIGSEGV crash that killed all active connections and required a full server restart. The vulnerability existed since the introduction of ST_GeomFromGeoJSON in MariaDB 10.2.4 and affected all versions through the current development trunk. 
              


                
                      
                    
                        Medium

                        resolved

                    
                
                 CVE-2026-19931: Negotiate ambient user conn reuse


                 Bug reported by   Martin Dukek was disclosed at September 3, 2026, 6:09 am   |   Authentication Bypass by Primary Weakness 
                  
              


                
                      
                    
                        Low

                        resolved

                    
                
                 CVE-2026-80231: native CA store conn reuse


                 Bug reported by   Anteater was disclosed at September 3, 2026, 6:08 am   |    
                  
              


                
                      
                    
                        Low

                        resolved

                    
                
                 CVE-2026-13608: OpenLDAP SASL authentication bypass


                 Bug reported by   Eunsoo Kim was disclosed at September 3, 2026, 12:35 am   |   Authentication Bypass by Primary Weakness 
                 A vulnerability was discovered in the OpenLDAP SASL authentication mechanism in libcurl. The vulnerability could allow a malicious LDAP server to bypass SASL authentication, potentially allowing the injection of arbitrary LDAP results. The vulnerable code has been present since the OpenLDAP SASL support was introduced and was unchanged in the current release.