Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,219
CVE-linked
1,854
Programs
342
New This Week
14
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Program filter: curl✕
Account/Repository Takeover via Abandoned GitHub Username in curl's href_extractor.c
curl LLM05: Supply Chain Vulnerabilities
Medium
2025-08-12
Insecure WebSocket Usage in curl Documentation and Examples (CWE-319: Cleartext Transmission of Sensitive Information)
curl Cleartext Transmission of Sensitive Information (CWE-319)
High
2025-08-12
Unsafe Global IFS Modification in OS400 Shell Script Enables Command Injection and Parsing Flaws (CWE-78/CWE-20)
curl Improper Input Validation (CWE-20)
High
2025-08-12
Exposure of Hard-coded Private Keys and Credentials in curl Source Repository (CWE-321)
curl Use of Hard-coded Cryptographic Key (CWE-321)
Critical
2025-08-12
Title: Remote Code Execution (RCE) via Arbitrary Library Loading in `--engine` option
curl Code Injection (CWE-94)
Critical
2025-08-10
Path Traversal in SFTP QUOTE command leads to Arbitrary File Write and potential RCE
curl Relative Path Traversal (CWE-23)
Critical
2025-08-10
Vulnerability Report: Local File Disclosure via file:// Protocol in cURL
curl Path Traversal (CWE-22)
Medium
2025-08-10
Heap Buffer Overflow in Curl_memdup0() via CURLOPT_COPYPOSTFIELDS/CURLOPT_POSTFIELDSIZE Mismatch
curl Buffer Over-read (CWE-126)
High
2025-08-09
Use After Free (that leads to arbitrary Write for some versions)
curl Use After Free (CWE-416)
Unknown
2025-08-06
Integer Overflow in schannel.c TLS Data Transmission
curl Integer Overflow (CWE-190)
Medium
2025-08-02
Stack use-after-scope in HTTP/3 POST request processing via CURLOPT_POSTFIELDS
curl Use After Free (CWE-416)
High
2025-07-31
OpenSSL HTTP/3 bogus CURLINFO_TLS_SSL_PTR
curl Use After Free (CWE-416)
Unknown
2025-07-28
Vulnerability Report: Public Exposure of Security Audit File
curl Information Disclosure (CWE-200)
Medium
2025-07-27
Security check up
curl Allocation of Resources Without Limits or Throttling (CWE-770)
Low
2025-07-24
Use after free (or assert triggered) with failed allocations in openssl
curl Use After Free (CWE-416)
Unknown
2025-07-24
Exposure of Private RSA Private Key in curl GitHub Repository
curl Insecure Storage of Sensitive Information (CWE-922)
Unknown
2025-07-23
GnuTLS CURLINFO_TLS_SESSION / CURLINFO_TLS_SSL_PTR type confusion
curl Type Confusion (CWE-843)
Unknown
2025-07-23
on the implications of permitting procedural culling
curl Use of Insufficiently Random Values (CWE-330)
Low
2025-07-22
curl ASSERTs when accessing an LDAP URL
curl Business Logic Errors (CWE-840)
Unknown
2025-07-22
Disk Space Exhaustion leading to a Denial of Service (DoS)
curl LLM04: Model Denial of Service
Medium
2025-07-14
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl439—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239 $9,895