Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,219
CVE-linked
1,854
Programs
342
New This Week
14
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
another liberapay member team twitter account broken Link Hijacking via Expired Twitter Account Link
Liberapay Open Redirect (CWE-601)
None
2026-05-09
Liberapay member team twitter account broken Link Hijacking via Expired Twitter Account Link
Liberapay Open Redirect (CWE-601)
Unknown
2026-05-09
Private circle can be added to another circle via API despite visibility restriction
Nextcloud Insecure Direct Object Reference (IDOR) (CWE-639)
Low
2026-05-08
Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner
Nextcloud Insecure Direct Object Reference (IDOR) (CWE-639)
Low
2026-05-08
View-only guests could see deleted Collectives pages in the trashbin
Nextcloud Improper Access Control - Generic (CWE-284)
Low
2026-05-08
mbedTLS private-key blob null-termination asymmetry in lib/vtls/mbedtls.c (mbed_load_privkey)
curl Improper Null Termination (CWE-170)
Unknown
2026-05-07
ActiveStorage Disk Service Path Traversal via Custom Blob Key Injection
Ruby on Rails Path Traversal (CWE-22)
Medium
2026-05-07
Critical Deadlock Vulnerability in Monero RPC Leading to Complete Node Paralysis
Monero Uncontrolled Resource Consumption (CWE-400)
Critical
2026-05-06
Connection Count Bug in Monero Node Enables Outbound Peer Reset Attack
Monero Privacy Violation (CWE-359)
Unknown
2026-05-06
wcurl treats some URL operands after -- as curl options
curl Improper Neutralization of Value Delimiters (CWE-142)
Medium
2026-05-06
Out of scope: Improper Input Validation Order on /api-internal/login via password field leads to unnecessary resource consumption
PortSwigger Web Security
Low
2026-05-05
Potential Resource Leak in tool_parsecfg.c at line 279 during fileerror
curl Uncontrolled Resource Consumption (CWE-400)
Low
2026-05-05
libcurl 8.20.0 incomplete fix for CVE-2026-7168: changing only CURLOPT_PROXYPORT leaks stale Proxy Digest auth to a different proxy
curl CVE-2026-7168
Medium
2026-05-05
MQTT CONNACK Packet Type Bypass leads to RCE via Malicious Broker
curl ASI05: Unexpected Code Execution (RCE)
Critical
2026-05-05
Improper input validation On Exported deep-link handler crashes `FileDisplayActivity` on crafted external URL — Denial-of-Service
Nextcloud Improper Null Termination (CWE-170)
None
2026-05-01
Double fdrop on a socket through sys_netcontrol
PlayStation Double Free (CWE-415)
High
2026-05-01
MQTT state machine confusion: PINGRESP/DISCONNECT with non-zero remaining_length dispatches to stale nextstate
curl Improper Input Validation (CWE-20)
Medium
2026-04-29
Use-After-Free in SMB connection reuse (req->path dangling pointer after needle destruction)
curl Use After Free (CWE-416)
High
2026-04-29
Negotiate connection reuse with wrong credentials when using CURLAUTH_ANY
curl Authentication Bypass by Primary Weakness (CWE-305)CVE-2026-1965
Medium
2026-04-29
Negotiate Authentication Premature on Connection Reuse
curl Improper Authentication - Generic (CWE-287)
High
2026-04-29
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl439—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239 $9,895