Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,219
CVE-linked
1,854
Programs
342
New This Week
14
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Program filter: security✕
Residual Malicious Payloads on HackerOne after Vulnerability Fixes
HackerOne Improper Input Validation (CWE-20)
Medium
2026-04-16
DOS via Mutation Aliasing in GraphQL Account Recovery Phone Number Verification API
HackerOne
Unknown
2026-04-16
Lack of Validation in Reward Redemption Allows Unlimited Burp Suite License Abuse
HackerOne Improper Access Control - Generic (CWE-284)
Low
2026-03-18
Internal Access to Hackerone confluence Docs
HackerOne Misconfiguration (CWE-16)
High
2025-08-15
Account takeover of existing HackerOne accounts through SCIM provisioning
HackerOne Improper Access Control - Generic (CWE-284)
High
2025-07-17
Banned user still has access to their deleted account via HackerOne's API using their API key
HackerOne Improper Access Control - Generic (CWE-284)
Medium
2025-07-14
IDOR Vulnerability at AddTagToAssets operation name
HackerOne Insecure Direct Object Reference (IDOR) (CWE-639)
Medium
2025-06-08
Public GitHub repositories for multiple HackerOne managed triage team profiles contain private HackerOne reports information
HackerOne Information Disclosure (CWE-200)
Medium
2025-05-31
Ability to access policy and updates for unauthorized program
HackerOne Improper Access Control - Generic (CWE-284)
Medium
2025-05-08
The /reports/:id.json endpoint discloses potentially sensitive user attributes when reporter summary is present
HackerOne Information Disclosure (CWE-200)
Critical
2025-04-01
Domain highlighting on External link warning is not working on Chrome & Microsoft Edge browsers on Mobile
HackerOne Violation of Secure Design Principles (CWE-657)
Low
2025-03-13
Disclosing PolicyPageAssetGroup in Private Programs via /graphql `gid://hackerone/PolicyPageAssetGroupsIndex::PolicyPageAssetGroup/{id}`
HackerOne
Critical
2025-01-21
Access to limited confidential information of private program as a Ex-reporter, Report Participant(external user) & Ex-staff member
HackerOne Improper Access Control - Generic (CWE-284)
Low
2024-12-24
Hackerone supports accounts organitation takeover
HackerOne
Medium
2024-11-19
Takeover of hackerone.engineering via Medium
HackerOne Reliance on Reverse DNS Resolution for a Security-Critical Action (CWE-350)
Low
2024-11-14
Bypassing HackerOne 2FA due to race condition
HackerOne Business Logic Errors (CWE-840)
Medium
2024-10-30
inviting collaborator using email disclose the hackerone account related to the user
HackerOne Information Disclosure (CWE-200)
Medium
2024-09-19
Issue with VDP Program's Transition to Private Status and Missing Warning Labels on ORG Invitation
HackerOne
Medium
2024-09-19
Bypass comment restriction
HackerOne Improper Access Control - Generic (CWE-284)
Medium
2024-09-19
Private draft report exposure in a program a user is added as a viewer to
HackerOne Information Disclosure (CWE-200)
Medium
2024-09-17
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl439—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239 $9,895