Search results

Vulnerability - Cloudflare Image Transformation via URL Injection

Status: Open.

#12 In cerebruminc/bug-bounty;

· securex01516 opened on Mar 1, 2026

User Enumeration via GraphQL

Status: Open.

#11 In cerebruminc/bug-bounty;

· cyberbobas opened on Feb 9, 2026

Vulnerability #1: Unauthenticated S3 Signed URL Generation

Status: Open.

#10 In cerebruminc/bug-bounty;

· cyberbobas opened on Feb 9, 2026

Missing HTTP Strict Transport Security (HSTS) Header/ CWE: 319 – Cleartext Transmission of Sensitive Information/ WASC: 15 – Application Misconfiguration

Status: Open.

#9 In cerebruminc/bug-bounty;

· zoro1081 opened on Jan 9, 2026

Server Version Information Disclosure via Server HTTP Header/ CWE: 497 – Exposure of System Data to an Unauthorized Control Sphere/ WASC: 13 – Information Leakage

Status: Open.

#8 In cerebruminc/bug-bounty;

· zoro1081 opened on Jan 9, 2026

Server Information Disclosure via X-Powered-By HTTP Header/ CWE: 200 – Information Exposure/ WASC: 13 – Information Leakage

Status: Open.

#7 In cerebruminc/bug-bounty;

· zoro1081 opened on Jan 9, 2026

Cross-Domain JavaScript Inclusion via Third-Party CDN/ CWE: 829 – Inclusion of Functionality from Untrusted Control Sphere/ WASC: 15 – Application Misconfiguration

Status: Open.

#6 In cerebruminc/bug-bounty;

· zoro1081 opened on Jan 9, 2026

Missing Clickjacking Protection Leading to UI Redress and Unauthorized User Interaction Hijacking/CWE: 1021 – Improper Restriction of Rendered UI Layers/ WASC: 15 – Application Misconfiguration

Status: Open.

#5 In cerebruminc/bug-bounty;

· zoro1081 opened on Jan 9, 2026

Overly Permissive Cross-Origin Resource Sharing (CORS) Policy / CWE: 264 – Permissions, Privileges, and Access Controls/WASC: 14 – Server Misconfiguration

Status: Open.

#4 In cerebruminc/bug-bounty;

· zoro1081 opened on Jan 9, 2026

Content Security Policy (CSP) Header Not Set at https://blog.cerebrum.com/CWE: 693 – Protection Mechanism Failure/ WASC: 15 – Application Misconfiguration

Status: Open.

#3 In cerebruminc/bug-bounty;

· zoro1081 opened on Jan 9, 2026

Medium – Content Security Policy Misconfiguration (Missing No-Fallback Directives & Overly Permissive Rules)/ CWE-693 – Protection Mechanism Failure/ WASC-15 – Application Misconfiguration

Status: Open.

#2 In cerebruminc/bug-bounty;

· zoro1081 opened on Jan 9, 2026