Unauthenticated Persistent Denial-of-Service via Federated Share Injection
HackerOneNextcloud2026-10-27
Web, Cloud
High
BUG BOUNTY WRITEUPS
Cloud writeups
AWS, GCP, Azure and Kubernetes findings: open buckets, metadata access, IAM mistakes and leaked cloud keys.
271 reports and writeups from 2024 to 2026. 184 carry a severity from the disclosing platform, 32 of them rated High or Critical. Last updated 2026-10-30.
Latest Cloud reports
Search and filter all writeupsUsers with read-only access to a Nextcloud Table can enumerate its share recipients via the Tables API
HackerOneNextcloud2026-10-27
Web, API, Cloud
Low
No password confirmation required when using apptoken on sensitive endpoint
HackerOneNextcloud2026-10-27
Web, API, Cloud
Medium
Tables application does not respect sharing limitations set by admin
HackerOneNextcloud2026-10-27
Web, Cloud
Medium
Unauthorized users can enumerate internal team resources via the Teams API when a team is visible to everyone
HackerOneNextcloud2026-10-27
Web, API, Cloud
Medium
Public shares remain accessible via alternate endpoints after owner account is disabled
HackerOneNextcloud2026-10-27$270 bounty
Web, API, Cloud
Medium
SSRF on Nextcloud Whiteboard Application via Recordings to Unauthorised Access to Whiteboards
HackerOneNextcloud2026-10-27$250 bounty
Web, Cloud
Medium
Unauthorised access with hidden public link creation when sharing to a Team External Member
HackerOneNextcloud2026-10-27$100 bounty
Web, Cloud
Low
FederationController::remoteWopiToken() returns full Wopi entity without token type validation
HackerOneNextcloud2026-10-27
Web, Cloud
Low
Files Confidential tagging can be bypassed with # in filename
HackerOneNextcloud2026-10-27
Web, Cloud
Medium
Blind SSRF Isn’t Blind If You Build the Channel Back
Researcher blog2026-10-24
Web, Cloud
Not rated
Code injection allows unprivileged local attacker to execute arbitrary code in Nextcloud's OAuth/web renderer process
HackerOneNextcloud2026-10-24
Web, Cloud
Low
Cross-room signaling injection enabling unauthorized force-mute
HackerOneNextcloud2026-10-21
Web, Cloud
Low
OAuth Redirect URI Manipulation via X-Forwarded-Host Injection
Medium2026-10-20
Web, Cloud
Not rated
Deck app: Invalid tag color is accepted by API and breaks frontend UI
HackerOneNextcloud2026-10-20
Web, API, Cloud
Low
Application Data Hiding via Invalid `iconName` Causing Frontend Crash in Nextcloud Tables
HackerOneNextcloud2026-10-20
Web, Cloud
Low
SMTP header injection via C-escape `\r` in the recipient display name
HackerOneNextcloud2026-10-18
Web, Cloud
Not rated
Unauthenticated go-httpbin servers : Leads to Cookie Tossing on *.aws.dev and Open Redirect
HackerOneAWS VDP2026-10-16
Web, Cloud
Medium
How a Public S3 Bucket Exposed Sensitive Data
Medium2026-10-16
Web, Cloud
Not rated
RCE in AWS Amplify CLI via Prototype Chain Traversal in amplify-velocity-template
HackerOneAWS VDP2026-10-13
Web, Cloud
High
Web, Cloud
Not rated
SSRF via User-Controlled Push proxyServer in Notifications Push Registration
HackerOneNextcloud2026-09-30
Web, Cloud
Medium
Improper input validation in emoji field leads to sidebar UI denial of service
HackerOneNextcloud2026-09-20
Web, Cloud
Low
files_lock: a write-share collaborator can place a TYPE_TOKEN lock that permanently denies the file owner, survives share revocation and account delet
HackerOneNextcloud2026-09-18
Web, Cloud
Medium
Persistent SMTP header injection via identity `organization` / `name`
HackerOneNextcloud2026-09-18
Web, Cloud
Not rated
Team membership information returned on API level based on ID
HackerOneNextcloud2026-09-17$200 bounty
Web, API, Cloud
Low
Public collectives allow to create pages
HackerOneNextcloud2026-09-17
Web, Cloud
Low
Shared smart albums in the Photos app can expose files outside the album owner's configured source folders
HackerOneNextcloud2026-09-17
Web, Cloud
Medium
Cross-User Lock/Unlock via Absolute DAV Path
HackerOneNextcloud2026-09-17
Web, Cloud
Medium
Unauthenticated blind SSRF in Circles signature verification bypasses Nextcloud local-address protections
HackerOneNextcloud2026-09-17
Web, Cloud
Medium
Approval app's file-freshness check can be bypassed by omitting the etag parameter, allowing approval of unreviewed file changes
HackerOneNextcloud2026-09-17$150 bounty
Web, Cloud
Medium
Critical broken access control: API-only delegated admin can enumerate all Team Folders and grant access to arbitrary groups
HackerOneNextcloud2026-09-17
Web, API, Cloud
Medium
Arbitrary Board Preference Injection via Deck Config API
HackerOneNextcloud2026-09-17$200 bounty
Web, API, Cloud
Medium
Incomplete Input Sanitization in CodeInterpreter install_packages Allows Command Injection via pip Flags
HackerOneAWS VDP2026-09-16
Web, Cloud
High
HTTP Request Smuggling via Unsanitized Hop-by-Hop Headers
HackerOneCloudflare Public Bug Bounty2026-09-14$1,500 bounty
Web, Cloud
High
08: CVE-2026-7009 fix incomplete for AWS-LC: `--cert-status` bypass on SecTrust path
HackerOnecurl2026-09-08
Web, Cloud
Not rated
Missing Duplicate Check allowing Multiple Retention Rules per System Tag
HackerOneNextcloud2026-09-05
Web, Cloud
Low
Email Enumeration via Password-Protected Share Identity Verification
HackerOneNextcloud2026-09-05$100 bounty
Web, Cloud
Low
Unauthenticated testing endpoint of notify_push expose internal IP
HackerOneNextcloud2026-09-05$150 bounty
Web, API, Cloud
Medium
Activity app does not verify federated file activity received from remote servers
HackerOneNextcloud2026-09-05$150 bounty
Web, Cloud
Low
Improper Input Validation and Integer Overflow in timeamount parameter of files_retention app
HackerOneNextcloud2026-09-05
Web, Cloud
Low
Mail contact autocomplete bypasses administrator-configured user enumeration restrictions and expose member information outside the intended scope
HackerOneNextcloud2026-09-04$250 bounty
Web, Cloud
Medium
@jitsi/docker-jitsi-meet: `/colibri-relay-ws/` unsafe nginx regex (OCTO relay configuration)
HackerOne8x82026-08-25
Web, Cloud
Low
Path Traversal in Nextcloud Talk Android Exposes User Credentials and Private Data via FileProvider
HackerOneNextcloud2026-08-24
Android, Cloud
Medium
TaskProcessing callback authorization bypass allows ex-members to post as Assistant Talk Bot
HackerOneNextcloud2026-08-14
Web, Cloud
Medium
GitHub Retired UsernameTakeover From [aws/████████]
HackerOneAWS VDP2026-08-03
Web, Cloud
Low
Sandbox User Can Inject Rogue CA Certificate into OS Trust Store via Sudo-Allowed deploy-certificates.sh
HackerOneAWS VDP2026-07-28
Cloud, Linux
Medium
Non-Production API Endpoints for the Amazon Cloudwatch Fails to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2026-07-27
Web, API, Cloud
Medium
AWS *.a2z.com | Unauthenticated Clickhouse UI : Database access + SSRF
HackerOneAWS VDP2026-07-22
Web, Cloud
High
Bedrock AgentCore Starter Toolkit Creates Gateway IAM Roles Without Confused Deputy Protections
HackerOneAWS VDP2026-07-15
Web, Cloud
Medium
bedrock-mantle.api.aws accepts Bedrock API keys outside the IAM Deny, CloudTrail signal, and invocation logging AWS publishes for Bedrock keys
HackerOneAWS VDP2026-07-14
Web, API, Cloud
Medium
Kiro IDE Stores Auth Tokens with World-Readable Permissions (0644)
HackerOneAWS VDP2026-07-09
Web, Cloud
Medium
OS Command Injection in `aws-cdk-lib` NodejsFunction via Unsanitized `OsCommand` Helper (Supply Chain RCE)
HackerOneAWS VDP2026-07-06
Web, Cloud, Source Code
High
Non-Production API Endpoints for the Amazon S3 Tables Service Fails to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2026-07-02
Web, API, Cloud
Medium
Content-Type Override to Stored XSS on Public Objects
Researcher blog2026-06-30
Web, Cloud
Not rated
Command Injection via Unsanitized Bundling Options in `aws-cdk-lib/aws-lambda-nodejs`
HackerOneAWS VDP2026-06-11
Web, Cloud
High
Firecracker Out-of-bounds Read/Write Local Privilege Escalation Vulnerability
HackerOneAWS VDP2026-06-11
Web, Cloud
Not rated
Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC
HackerOneNextcloud2026-06-07$2,500 bounty
Web, Cloud
High
PIN bypass in PassCodeActivity via back button
HackerOneNextcloud2026-06-07$150 bounty
Web, Cloud
Medium
Valid share tokens allow to access tempory upload files of share owner
HackerOneNextcloud2026-06-07
Web, Cloud
Medium
V1Plugin.Decrypt panics on empty ciphertext (Remote DoS)
HackerOneAWS VDP2026-05-28
Web, Cloud
Medium
V2Plugin.Decrypt panics on empty ciphertext (Remote DoS)
HackerOneAWS VDP2026-05-28
Web, Cloud
Medium
Group restriction bypass via bearer token in user_oidc (SETTING_RESTRICT_LOGIN_TO_GROUPS not enforced in Backend::getCurrentUserId)
HackerOneNextcloud2026-05-21$150 bounty
Web, Cloud
Medium
SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution
HackerOneNextcloud2026-05-15
Web, Cloud
High
QuickSight Authorization Bypass: Chat Agents Accessible Despite Custom Permissions Denial
HackerOneAWS VDP2026-05-12
Web, Cloud
Not rated
View-only guests could see deleted Collectives pages in the trashbin
HackerOneNextcloud2026-05-08
Web, Cloud
Low
Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner
HackerOneNextcloud2026-05-08
Web, Cloud
Low
Private circle can be added to another circle via API despite visibility restriction
HackerOneNextcloud2026-05-08$150 bounty
Web, API, Cloud
Low
Improper input validation On Exported deep-link handler crashes `FileDisplayActivity` on crafted external URL — Denial-of-Service
HackerOneNextcloud2026-05-01
Web, Cloud
Not rated
Unquoted body background attribute enables CSS injection that bypasses remote image blocking
HackerOneNextcloud2026-04-20
Web, Cloud
Medium
position: fixed !important bypasses CSS sanitizer's fixed-position mitigation, enabling full-viewport phishing overlays.
HackerOneNextcloud2026-04-20
Web, Cloud
Medium
SVG filter primitives bypass remote image blocking, enabling email tracking without consent.
HackerOneNextcloud2026-04-20
Web, Cloud
Medium
SMIL values and by attributes bypass remote image blocking via unvalidated resource-loading animations, enabling email tracking without consent
HackerOneNextcloud2026-04-20
Web, Cloud
Medium
Stored XSS in attachment-display exploitable through SameSite
HackerOneNextcloud2026-04-19
Web, Cloud
Medium
SQL Injection Detection Bypass in AWS WAF Managed Rules (AWSManagedRulesSQLiRuleSet)
HackerOneAWS VDP2026-04-15
Web, Cloud
Not rated
[Variation of #3321406] YetAnother 1-Click Chaining of Self-XSS, Cookie Tossing and AntiCSRF Token Prediction leads to auto approval in AccessTempAuth
HackerOneCloudflare Public Bug Bounty2026-04-14
Web, Cloud
High
BOLA/IDOR in Out-of-Office API allows any authenticated user to read other users' absence data
HackerOneNextcloud2026-04-14
Web, API, Cloud
Medium
[Variation of #1554049] 1-Click Chaining of Self-XSS, Cookie Tossing and AntiCSRF Token Prediction leads to auto approval in Access Temp Auth
HackerOneCloudflare Public Bug Bounty2026-04-14
Web, Cloud
High
Credential Disclosure via Unvalidated directDownloadUrl (Missing DontAddCredentialsAttribute)
HackerOneNextcloud2026-04-13$250 bounty
Web, Cloud
Medium
Encryption context keys and values logged at INFO level
HackerOneAWS VDP2026-04-10
Web, Cloud
Not rated
IDOR on ██████ via direct photo URL leads to unauthorized access to deleted and other users' photos
HackerOneNextcloud2026-04-07
Web, Cloud
Not rated
Health check errors silently dropped when channel buffer full
HackerOneAWS VDP2026-04-07
Web, Cloud
Not rated
Unauthenticated SSRF via Public Reference API -Sharing Token Bypass
HackerOneNextcloud2026-03-31
Web, API, Cloud
Not rated
Arbitrary Code Execution via Scanner Bypass in **aws-diagram-mcp-server** `exec()` Namespace
HackerOneAWS VDP2026-03-09
Web, Cloud
Not rated
Injection in path parameter of Ingress-nginx
HackerOneKubernetes2026-03-07
Web, Cloud
High
Password Reuse Vulnerability on AWS Sign-in Page via Password Reset Flow leads to Security Policy Violation
HackerOneAWS VDP2026-02-26
Web, Cloud
Not rated
AI Playground XSS to steal user-chat messages and access to connected MCP Server
HackerOneCloudflare Public Bug Bounty2026-02-26
Web, Cloud, AI
Low
Mail stored HTML injection in subject text
HackerOneNextcloud2026-02-12
Web, Cloud
Medium
Unlimited Reuse of Coupon Code Allows Free Shipping on All Orders on ██████████
HackerOneAWS VDP2026-02-09
Web, Cloud
Low
WebAuthn app was updated based on public key
HackerOneNextcloud2026-02-06
Web, Cloud
Low
Pickling the Mailbox: A Deep Dive into CVE-2025-20393
Researcher blog2026-02-05
Web, Cloud
Not rated
Command Injection on Amazon Q Developer CLI via malicious .amazonq/mcp.json leads to arbitrary code execution
HackerOneAWS VDP2026-01-16
Web, Cloud
Not rated
Can download files on Android app without permission
HackerOneNextcloud2026-01-16$250 bounty
Android, Cloud
Low
Easy way to create a new Deck board without permission
HackerOneNextcloud2026-01-16$100 bounty
Web, Cloud
Not rated
Roundcube Webmail Style Sanitizer can be bypassed using CSS Character Escapes
HackerOneNextcloud2026-01-14
Web, Cloud
Medium
Secret Access Key of AWS Firehose Disclosure
HackerOneU.S. Dept Of Defense2026-01-12
Web, Cloud
High
Non-Production API Endpoints for the AI Ops Service Fails to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2026-01-06
Web, API, Cloud
Medium
AWS Auto Scaling Service Reporting "AWS Internal" for CloudTrail Events Generated from Specific Endpoints
HackerOneAWS VDP2026-01-05
Web, API, Cloud
Medium
Information disclosure via Desktop client when attempting to lock a file inside a end-to-end encrypted directory
HackerOneNextcloud2026-01-04
Web, Cloud
Not rated
Deck app allows to spoof file extensions by using RTLO characters
HackerOneNextcloud2026-01-04$100 bounty
Web, Cloud
Medium
Users can modify tags on files that do not belong to them
HackerOneNextcloud2026-01-04$150 bounty
Web, Cloud
Medium
Predictable proposal participant tokens enable unauthorized access and vote submission
HackerOneNextcloud2026-01-04$100 bounty
Web, Cloud
Low
Stored XSS in contacts app via organisation and title field
HackerOneNextcloud2026-01-04$100 bounty
Web, Cloud
Low
tabnabbing in roundcube webmail
HackerOneNextcloud2025-12-24
Web, Cloud
Not rated
[nextcloud/mail] Blind SSRF to Internal Network via "List-Unsubscribe" SMTP Header when allow_local_remote_servers is allowed
HackerOneNextcloud2025-12-23
Web, Cloud
Medium
Second-Order XSS via javascript protocol in MCP Server Portal Apps leads to ATO
HackerOneCloudflare Public Bug Bounty2025-12-16
Web, Cloud, AI
Low
Nextcloud Tables v1 Share Enumeration Without Authorization (Regression of CVE-2024-52507)
HackerOneNextcloud2025-12-05
Web, Cloud
Low
Missing ownership check in Tables app allows moving columns into tables of other users
HackerOneNextcloud2025-12-05
Web, Cloud
Medium
Stored XSS Vulnerability via SVG File
HackerOneNextcloud2025-12-05$150 bounty
Web, Cloud
Medium
Participants were able to blindly delete poll drafts of other users by ID
HackerOneNextcloud2025-12-05
Web, Cloud
Medium
Approval app allows users to request approval for other users file
HackerOneNextcloud2025-12-05
Web, Cloud
Medium
admin_audit does not log actions on files in a group folder
HackerOneNextcloud2025-12-05
Web, Cloud
Medium
Tables app allowed users to view columns metadata information of any table
HackerOneNextcloud2025-12-05
Web, Cloud
Medium
Calendar app allowed booking appointments without the generated token
HackerOneNextcloud2025-12-05
Web, Cloud
Low
Calendar attachments of local files are offered to downloaded
HackerOneNextcloud2025-12-05
Web, Cloud
Medium
Deck app allowed user with "Can share" permission to modify permissions of other non-owners
HackerOneNextcloud2025-12-05
Web, Cloud
Medium
Existence of completed pods allows for bypass of Kubernetes NetworkPolicy
HackerOneAWS VDP2025-11-19
Web, Cloud
Medium
Bypass of Cloudflare's Cache Keys and WAF via header overflow
HackerOneCloudflare Public Bug Bounty2025-11-18
Web, Cloud
High
Responsible disclosure - public S3 bucket exposing JSON/config files
HackerOneAWS VDP2025-11-14
Web, Cloud
Low
Improper Authorization Leads to Editor can toggle admin-only workspace features (Lovable Cloud)
HackerOneLovable VDP2025-11-04
Web, Cloud
Low
Path Traversal Vulnerability in Nextcloud Tables Enables Arbitrary File Exfiltration of Any Files Supported by PhpSpreadsheet Library
HackerOneNextcloud2025-10-16
Web, Cloud
Medium
AWS SigV4 Signature Disclosure via Verbose Logging in libcurl
HackerOnecurl2025-10-01
Web, Cloud
Not rated
`use-mcp`'s oauth2 process uses a window.open call with untrusted mcp server provided data allowing for code execution under the page using it
HackerOneCloudflare Public Bug Bounty2025-09-30$550 bounty
Web, Cloud, AI
Medium
Exposing debug.log file leads to server full path disclosure
HackerOneNextcloud2025-09-29
Web, Cloud
Medium
Directory Listing of publicly available assets
HackerOneNextcloud2025-09-29
Web, Cloud
Medium
Email not verified when changing afterwards on apps.nextcloud.com
HackerOneNextcloud2025-09-29
Web, Cloud
Low
elections.k8s.io uses weak session secret key, may place elections at risk
HackerOneKubernetes2025-09-19$250 bounty
Web, Cloud
High
AWS | Self Registration Internal LibreChat : Access to internal/proprietary LLMs
HackerOneAWS VDP2025-08-25
Web, Cloud
Low
Remote Code Execution in Amazon MWAA due to outdated Apache Airflow version
HackerOneAWS VDP2025-08-14
Web, Cloud
Not rated
XSS on Amazon Aquisition: elemental
HackerOneAWS VDP2025-07-22
Web, Cloud
High
Private AWS AMIs are temporarily being exposed publicly
HackerOneAWS VDP2025-05-29
Web, Cloud
Not rated
Non-Production API Endpoint for the EventBridge Service Fails to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2025-05-28
Web, API, Cloud
Medium
Non-Production API Endpoints for the Health Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2025-05-28
Web, API, Cloud
Medium
Non-Production API Endpoints for the bedrock Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2025-05-28
Web, API, Cloud
Medium
Non-Production API Endpoints for the bedrock-agent Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2025-05-28
Web, API, Cloud
Medium
Amazon Pinpoint SMS and Voice, version 2 Service Reporting "AWS Internal" for CloudTrail Events Generated from FIPS Endpoints
HackerOneAWS VDP2025-05-28
Web, API, Cloud
Medium
Non-Production API Endpoints for the Global Accelerator Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2025-05-28
Web, API, Cloud
Medium
Amazon Kendra Intelligent Ranking Service Reporting "AWS Internal" for CloudTrail Events Generated from FIPS Endpoints
HackerOneAWS VDP2025-05-28
Web, API, Cloud
Medium
Non-Production API Endpoints for the Route 53 Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2025-05-27
Web, API, Cloud
Medium
Non-Production API Endpoints for the Neptune Graph Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2025-05-27
Web, API, Cloud
Medium
Any WARP User Can Access Organization-Specific Application
HackerOneCloudflare Public Bug Bounty2025-05-19
Web, Cloud
Not rated
Bedrock Guardrails Evasion with Prompt Formatting
HackerOneAWS VDP2025-05-15
Web, Cloud
Not rated
Path Traversal Vulnerability found on IBM Cloud
HackerOneIBM2025-05-07
Web, Cloud
Critical
Non-Production API Endpoints for the cloudwatch Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2025-04-25
Web, API, Cloud
Medium
Non-Production API Endpoint for the ElastiCache Service Fails to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2025-04-25
Web, API, Cloud
Medium
Non-Production API Endpoints for the Glue Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2025-04-25
Web, API, Cloud
Medium
Non-Production API Endpoints for the ssm Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2025-04-24
Web, API, Cloud
Medium
(Part 2) Non-Production API Endpoints for the Datazone Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2025-04-08
Web, API, Cloud
Medium
Cloudflare WAF Bypass - Origin IP Exposure
HackerOneHemi VDP2025-03-27
Web, Cloud
Medium
Non-Production API Endpoints for the Forecast Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
HackerOneAWS VDP2025-03-24
Web, API, Cloud
Medium
Showing the 150 most recent of 271. See all in the searchable index.
Every entry links to the original report or article. Secure Hyperloop doesn't copy the content. Severity comes from the disclosing platform (HackerOne). Writeups without a platform rating show "Not rated". The index has 2,810 items in total.