/

Community

Findings

Vulnerabilities published by researchers. Private and unlisted work never appears here.

[CRITICAL] · P1 · Web application · Resolved

How I Found Two Critical PII Exposure Vulnerabilities on a HackerOne Public Program Using Pure Recon

0xbatot · 14 hours ago · 3

[MEDIUM] · ████████ · Accepted

Privilege Escalation Attack Chain: Executive-to-Admin KYC Pipeline Compromise

0xbatot · 14 hours ago · 1

[MEDIUM] · MEDIUM · ████████ · Resolved

Unauthorized Group Membership Removal via Group Member Invitation leads to Horizontal Privilege Escalation

z3rob · 1 day ago

[MEDIUM] · P3 · Web application · Unresolved Duplicate

Race Condition Allows Bypassing free Plan Member Limit

z3rob · 1 day ago · 1

[LOW] · P4 · Web application · Unresolved

Broken Access Control – Low-Privilege Custom Role Can Access Test Settings via Unauthorized API Endpoint

z3rob · 1 day ago

[MEDIUM] · P3 · Web application · Unresolved

BOLA Exposes Full Org Data to Access-Only Users

z3rob · 1 day ago · 2

[HIGH] · P2 · www.example.com · Accepted

Broken Authentication in Password Change Endpoint – current_password Verification Can Be Bypassed with null

0xnotnull · 1 day ago · 1

[LOW] · P4 · twilio.com · Resolved

Broken Access Control – Billing Manager Can Access Owner-Only Organization Endpoint

0xnotnull · Twilio · 1 day ago · 1

[LOW] · P4 · ████████ · Unresolved

MFA Enrollment Policy Bypass via Direct POST to /idp/idx/skip

z3rob · 1 day ago · 2

[HIGH] · CVE-2026-61979 · Disclosed

Unauthenticated privilege escalation in SAML SP Single Sign On (WordPress) up to 5.4.3

3id · Patchstack · 5 days ago · 1

[HIGH] · CVE-2026-54844 · Disclosed

Unauthenticated broken access control in CheckView Automated Testing (WordPress) up to 2.1.0

3id · Patchstack · 1 month ago · 1

[CRITICAL] · CVE-2026-48886 · Disclosed

Unauthenticated SQL injection in JS Help Desk (WordPress) up to 3.0.9

3id · Patchstack · 2 months ago · 1