Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,219
CVE-linked
1,854
Programs
342
New This Week
9
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
RPC service DOS
Monero Uncontrolled Resource Consumption (CWE-400)
Medium
2025-05-23
Shopify Partners Invitation Process Allows Privilege Escalation Without Email Verification
Shopify Improper Access Control - Generic (CWE-284)
Medium
2025-05-15
[Xenoblade Chronicles X: Definitive Edition] Improper validation of names allows injecting formatting tags and bypassing profanity filter
Nintendo
Medium
2025-05-15
Users Data Exposure via Insecure Endpoint
Mars Information Disclosure (CWE-200)
Medium
2025-05-12
massive PII leakage for ███████
Mars Insecure Storage of Sensitive Information (CWE-922)
Medium
2025-05-12
Race condition on add 1 free domain
Automattic Business Logic Errors (CWE-840)
Medium
2025-05-09
Ability to access policy and updates for unauthorized program
HackerOne Improper Access Control - Generic (CWE-284)
Medium
2025-05-08
BAC – Bypass chatbot restrictions via unauthorized mention injection
Dust
Medium
2025-05-06
Privilege Persistence via Cloned Agent
Dust Improper Access Control - Generic (CWE-284)
Medium
2025-04-30
Improper Session Invalidation – Auto Sign-In Without Credentials After Logout (Affects Chrome & Firefox)
Dust Insufficient Session Expiration (CWE-613)
Medium
2025-04-29
User Limit Bypass via Pending Invitations in Workspace System
Dust Business Logic Errors (CWE-840)
Medium
2025-04-29
Race Condition in Folder Creation Allows Bypassing Folder Limit
Dust Business Logic Errors (CWE-840)
Medium
2025-04-29
Denial of Service by memory exhaustion in net/imap
Internet Bug Bounty Allocation of Resources Without Limits or Throttling (CWE-770)
Medium
2025-04-27
[CVE-2025-27219] Denial of Service in CGI::Cookie.parse
Internet Bug Bounty Uncontrolled Resource Consumption (CWE-400)CVE-2025-27219
Medium
2025-04-27
Possible DoS by memory exhaustion in net/imap
Internet Bug Bounty Uncontrolled Resource Consumption (CWE-400)
Medium
2025-04-27
Non-Production API Endpoint for the ElastiCache Service Fails to Log to CloudTrail Resulting in Silent Permission Enumeration
AWS VDP Insufficient Logging (CWE-778)
Medium
2025-04-25
Non-Production API Endpoints for the cloudwatch Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
AWS VDP Insufficient Logging (CWE-778)
Medium
2025-04-25
Non-Production API Endpoints for the Glue Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
AWS VDP Insufficient Logging (CWE-778)
Medium
2025-04-25
Non-Production API Endpoints for the ssm Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration
AWS VDP Insufficient Logging (CWE-778)
Medium
2025-04-24
UI flaw allows unauthorized users to add documents to restricted folders
Dust Improper Access Control - Generic (CWE-284)
Medium
2025-04-23
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl439—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239 $9,895