Topic

HackerOne: news, advisories and analysis

11 articlesUpdated 18 Oct 2026

CyberSecureToday covers HackerOne across 11 articles published between 18 Oct 2026 and 18 Oct 2026. The coverage includes 10 vulnerability advisories and 1 incident or breach report. 10 advisories are rated critical or high severity.

Stories on HackerOne most often intersect with Database Security, Memory Corruption and MariaDB, with Technology, Cloud & SaaS the most affected sector. The most recent story, “Stored XSS on Mozilla Pontoon Localization Dashboards Enabled Administrative Account Takeover”, was published 18 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.

Latest coverage

ThreatsCloud & SaaSBreaking
Stored XSS on Mozilla Pontoon Localization Dashboards Enabled Administrative Account Takeover
A stored cross-site scripting flaw in Mozilla Pontoon public dashboards allowed malicious contributor addresses to execute arbitrary code in reviewer sessions.
Aisha Noor18 Oct 202613 min read
ThreatsCloud & SaaSBreaking
Critical SQL Injection in IBM Cloud Portal Infrastructure Allowed Database Exfiltration
A critical SQL injection flaw on an enterprise IBM Cloud portal enabled unauthenticated remote attackers to extract backend database records.
Daniel Okafor18 Oct 202613 min read
ThreatsCloud & SaaSBreaking
Nintendo Switch Local Wireless Multiplayer Flaw Allowed Remote Pre-Auth Stack Buffer Overflows
A remote stack buffer overflow in the Nintendo Switch LDN wireless multiplayer service allowed attackers within Wi-Fi range to hijack control flow.
Aisha Noor18 Oct 202614 min read
ThreatsCloud & SaaSHigh
MariaDB CONNECT Storage Engine Flaw Bypassed FILE Privilege and secure_file_priv Controls
Missing authorization checks in MariaDB CONNECT file UDFs allowed authenticated users with basic SELECT permissions to read and write arbitrary server files.
Daniel Okafor18 Oct 202613 min read
ThreatsBanking & FintechHigh
MariaDB DROP PACKAGE Defect Leaves Orphaned Grants in mysql.procs_priv Enabling Privilege Escalation
A catalog cleanup omission in MariaDB's PL/SQL package engine left orphaned grants in mysql.procs_priv, allowing low-privilege users to hijack administrative packages.
CST Editorial Desk18 Oct 202613 min read
ThreatsCloud & SaaSCritical
MariaDB Critical RCE Chain Exploits SYS_REFCURSOR Use-After-Free and ST_Area Over-Read
A critical exploit chain in MariaDB combined a cursor-array use-after-free with a geospatial memory disclosure to achieve command execution from low-privilege accounts.
CST Editorial Desk18 Oct 202616 min read
ThreatsCloud & SaaSCritical
WordPress REST API Flaw Exposed Hidden and Private bbPress Forum Content to Unauthenticated Scraping
A broken object authorization flaw in the WordPress core REST API enabled unauthenticated attackers to read private and hidden bbPress forum posts.
Daniel Okafor18 Oct 202613 min read
ThreatsCloud & SaaSHigh
libcurl HTTP/2 Streaming Upload Use-After-Free Flaw Exposes Client Applications to Memory Corruption
A heap use-after-free defect in libcurl's HTTP/2 streaming upload engine enabled memory corruption when paused streams were aborted or reset.
Priya Raman18 Oct 202615 min read
ThreatsCloud & SaaSHigh
AWS Amplify CLI Prototype Pollution Flaw in Velocity Template Engine Enabled Local Code Execution
A prototype chain traversal flaw in AWS Amplify's velocity template engine allowed attackers with malicious VTL files to execute arbitrary local commands.
Aisha Noor18 Oct 202614 min read
Cyber AttackBanking & Fintech
R3 Artifactory Takeover Exposes Corda Enterprise and Central Bank Digital Currency Supply Chain
A critical default join key flaw in R3's JFrog Artifactory granted full administrative control over 269 repositories, including Corda Enterprise and CBDC builds.
Daniel Okafor18 Oct 202616 min read
ThreatsCloud & SaaSHigh
RubyGems Flaw in Gem Transfer Flow Allowed Organization Admins to Hijack Owner Rights and Evict Founders
A missing authorization boundary in RubyGems.org's gem transfer workflow enabled organization admins to invite attacker-controlled owners and evict founders.
Daniel Okafor18 Oct 202611 min read