🏦 curl Report
⚡ Title: OpenSSL \`--cert-status\` accepts indefinitely stale GOOD OCSP staples
🔍 Reporter: stze (No name)

📋 Details:
└ 📊 Status: not-applicable
└ ⚡ Severity: Medium
└ 🎯 CWE: Improper Check for Certificate Revocation
└ 🔢 CVE: CVE-2020-8286, CVE-2024-8096, CVE-2026-7009, CVE-2026-93493

⏰ Timeline:
└ 🔓 Disclosed: 2026-10-26 12:50:37 UTC
└ 📝 Created: 2026-10-18 17:47:33 UTC

🏦 curl Report
⚡ Title: GnuTLS + Apple SecTrust discards authenticated OCSP failure
🔍 Reporter: stze (No name)

📋 Details:
└ 📊 Status: not-applicable
└ ⚡ Severity: Medium
└ 🎯 CWE: Improper Certificate Validation
└ 🔢 CVE: CVE-2024-8096, CVE-2026-7009

⏰ Timeline:
└ 🔓 Disclosed: 2026-10-26 12:50:21 UTC
└ 📝 Created: 2026-10-18 06:33:58 UTC

🏦 curl Report
📝 Title: OpenSSL+Apple SecTrust: SecTrust accepts certificates that the app's CURLOPT\_SSL\_CTX\_FUNCTION trust store or verify callback rejected
🔍 Reporter: sujitjaunjal (Sujit Jaunjal)

📋 Details:
└ 📊 Status: not-applicable
└ ⚡ Severity: Low
└ 🎯 CWE: Improper Certificate Validation
└ 🔢 CVE: CVE-2026-82208

⏰ Timeline:
└ 🔓 Disclosed: 2026-10-26 12:50:13 UTC
└ 📝 Created: 2026-10-17 20:21:28 UTC

🏦 curl Report
📝 Title: Cross-protocol redirect to imap:// or smtp:// uploads the -F/MIMEPOST form and the custom Authorization/Cookie headers to the redirect target
🔍 Reporter: sujitjaunjal (Sujit Jaunjal)

📋 Details:
└ 📊 Status: not-applicable
└ ⚡ Severity: Low
└ 🎯 CWE: Information Exposure Through Sent Data
└ 🔢 CVE: CVE-2025-14524, CVE-2018-1000007, CVE-2022-27776

⏰ Timeline:
└ 🔓 Disclosed: 2026-10-26 12:50:04 UTC
└ 📝 Created: 2026-10-17 22:05:53 UTC

🏦 Node.js Report
📝 Title: Permission Model filesystem over-grant via wildcard radix lookup
🔍 Reporter: malikhamzaiqbal (Malik)

📋 Details:
└ 📊 Status: resolved
└ ⚡ Severity: Low
└ 🎯 CWE: Improper Access Control - Generic
└ 🔢 CVE: CVE-2026-106071

⏰ Timeline:
└ 🔓 Disclosed: 2026-10-27 07:06:06 UTC
└ 📝 Created: 2026-09-04 10:41:58 UTC

🏦 curl Report
📝 Title: Incomplete IDN hostname check on the transfer path can lead to credential disclosure to an unintended host
🔍 Reporter: christos_eth (christos_eth)

📋 Details:
└ 📊 Status: informative
└ ⚡ Severity: Low
└ 🎯 CWE: Not Specified
└ 🔢 CVE: None

⏰ Timeline:
└ 🔓 Disclosed: 2026-10-27 07:53:09 UTC
└ 📝 Created: 2026-10-26 14:11:54 UTC

🏦 Nextcloud Report
⚠️ Title: Unauthenticated Persistent Denial-of-Service via Federated Share Injection
🔍 Reporter: ncsc_nl (No name)

📋 Details:
└ 📊 Status: resolved
└ ⚡ Severity: High
└ 🎯 CWE: Uncontrolled Resource Consumption
└ 🔢 CVE: CVE-2026-77167

⏰ Timeline:
└ 🔓 Disclosed: 2026-10-27 10:43:59 UTC
└ 📝 Created: 2026-04-17 07:17:16 UTC

🏦 Nextcloud Report
⚡ Title: No password confirmation required when using apptoken on sensitive endpoint
🔍 Reporter: npc (Nicholas Carlini)

📋 Details:
└ 📊 Status: resolved
└ ⚡ Severity: Medium
└ 🎯 CWE: Improper Privilege Management
└ 🔢 CVE: None

⏰ Timeline:
└ 🔓 Disclosed: 2026-10-27 10:40:47 UTC
└ 📝 Created: 2026-02-21 10:04:19 UTC

🏦 Nextcloud Report
⚡ Title: Files Confidential tagging can be bypassed with # in filename
🔍 Reporter: xavlimsg (XavLimSG)

📋 Details:
└ 📊 Status: resolved
└ ⚡ Severity: Medium
└ 🎯 CWE: Improper Access Control - Generic
└ 🔢 CVE: CVE-2026-77173

⏰ Timeline:
└ 🔓 Disclosed: 2026-10-27 11:00:19 UTC
└ 📝 Created: 2026-04-18 16:44:29 UTC

🏦 Nextcloud Report
⚡ Title: Public shares remain accessible via alternate endpoints after owner account is disabled
🔍 Reporter: blinkyyy (hamza)

📋 Details:
└ 📊 Status: resolved
└ ⚡ Severity: Medium
└ 🎯 CWE: Improper Access Control - Generic
└ 🔢 CVE: CVE-2026-114601

⏰ Timeline:
└ 🔓 Disclosed: 2026-10-27 10:50:05 UTC
└ 📝 Created: 2026-03-22 00:07:27 UTC

🏦 Nextcloud Report
⚡ Title: Unauthorized users can enumerate internal team resources via the Teams API when a team is visible to everyone
🔍 Reporter: yoyomiski (_dha)

📋 Details:
└ 📊 Status: resolved
└ ⚡ Severity: Medium
└ 🎯 CWE: Improper Access Control - Generic
└ 🔢 CVE: CVE-2026-82984

⏰ Timeline:
└ 🔓 Disclosed: 2026-10-27 11:17:49 UTC
└ 📝 Created: 2026-01-16 02:58:56 UTC

🏦 Nextcloud Report
📝 Title: Unauthorised access with hidden public link creation when sharing to a Team External Member
🔍 Reporter: fadalika (No name)

📋 Details:
└ 📊 Status: resolved
└ ⚡ Severity: Low
└ 🎯 CWE: Privilege Escalation
└ 🔢 CVE: CVE-2026-45285

⏰ Timeline:
└ 🔓 Disclosed: 2026-10-27 11:10:35 UTC
└ 📝 Created: 2026-03-24 22:27:22 UTC

🏦 Nextcloud Report
⚡ Title: SSRF on Nextcloud Whiteboard Application via Recordings to Unauthorised Access to Whiteboards
🔍 Reporter: alex-elttam (alex-elttam)

📋 Details:
└ 📊 Status: resolved
└ ⚡ Severity: Medium
└ 🎯 CWE: Server-Side Request Forgery \(SSRF\)
└ 🔢 CVE: CVE-2026-87897

⏰ Timeline:
└ 🔓 Disclosed: 2026-10-27 11:26:00 UTC
└ 📝 Created: 2026-02-27 11:16:31 UTC

🏦 Nextcloud Report
⚡ Title: Tables application does not respect sharing limitations set by admin
🔍 Reporter: samin_zavarkesh (Samin Zavarkesh)

📋 Details:
└ 📊 Status: resolved
└ ⚡ Severity: Medium
└ 🎯 CWE: Improper Access Control - Generic
└ 🔢 CVE: CVE-2026-82986

⏰ Timeline:
└ 🔓 Disclosed: 2026-10-27 11:22:32 UTC
└ 📝 Created: 2026-04-01 12:04:35 UTC

🏦 Nextcloud Report
📝 Title: Users with read-only access to a Nextcloud Table can enumerate its share recipients via the Tables API
🔍 Reporter: yoyomiski (_dha)

📋 Details:
└ 📊 Status: resolved
└ ⚡ Severity: Low
└ 🎯 CWE: Information Disclosure
└ 🔢 CVE: CVE-2026-82983

⏰ Timeline:
└ 🔓 Disclosed: 2026-10-27 11:19:32 UTC
└ 📝 Created: 2026-01-26 14:35:10 UTC

🏦 Nextcloud Report
📝 Title: FederationController::remoteWopiToken\(\) returns full Wopi entity without token type validation
🔍 Reporter: bornwinnerrr (Ibrahim el zein )

📋 Details:
└ 📊 Status: resolved
└ ⚡ Severity: Low
└ 🎯 CWE: Improper Access Control - Generic
└ 🔢 CVE: None

⏰ Timeline:
└ 🔓 Disclosed: 2026-10-27 11:33:52 UTC
└ 📝 Created: 2026-02-22 16:55:34 UTC

🏦 Basecamp Report
⚠️ Title: Cross-account XSS on app.basecamp.com: oEmbed option injection chained through Turbo defeats the CSP nonce
🔍 Reporter: deivizzzz (deivizzzz)

📋 Details:
└ 📊 Status: resolved
└ ⚡ Severity: High
└ 🎯 CWE: Cross-site Scripting \(XSS\) - Generic
└ 🔢 CVE: None

⏰ Timeline:
└ 🔓 Disclosed: 2026-10-28 04:58:32 UTC
└ 📝 Created: 2026-08-30 22:00:12 UTC

🏦 Basecamp Report
🔥 Title: Launchpad file read leaks production keys
🔍 Reporter: bl0rph (Abdelmounaim Moulahcene)

📋 Details:
└ 📊 Status: resolved
└ ⚡ Severity: Critical
└ 🎯 CWE: Path Traversal
└ 🔢 CVE: None

⏰ Timeline:
└ 🔓 Disclosed: 2026-10-28 04:53:47 UTC
└ 📝 Created: 2026-08-23 11:05:24 UTC

🏦 Monero Report
⚠️ Title: Monero IPv6 /128 tracking bypasses per-IP limit, enables remote OOM
🔍 Reporter: belair (Connor Carro)

📋 Details:
└ 📊 Status: resolved
└ ⚡ Severity: High
└ 🎯 CWE: Uncontrolled Resource Consumption
└ 🔢 CVE: None

⏰ Timeline:
└ 🔓 Disclosed: 2026-10-28 20:13:57 UTC
└ 📝 Created: 2026-06-21 22:55:28 UTC

🏦 Vercel Report
⚡ Title: Revoked deployment collaborator regains access to private comments after active collaborator interaction
🔍 Reporter: qub (Domingos Toko Muanda)

📋 Details:
└ 📊 Status: resolved
└ ⚡ Severity: Medium
└ 🎯 CWE: Access Control Check Implemented After Asset is Accessed
└ 🔢 CVE: None

⏰ Timeline:
└ 🔓 Disclosed: 2026-10-29 08:25:44 UTC
└ 📝 Created: 2026-07-09 04:43:47 UTC