Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,219
CVE-linked
1,854
Programs
342
New This Week
9
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
debug.log File Exposure that exposes (user/████) username and password at █████████
Mars Cleartext Storage of Sensitive Information (CWE-312)
High
2023-11-15
subdomain takeover at █████████
Mars Misconfiguration (CWE-16)
High
2023-11-15
Yet Another CASB Integration Takeover of Active Integrations
Cloudflare Public Bug Bounty
High
2023-11-13
Cross-Site Request Forgery
ownCloud Cross-Site Request Forgery (CSRF) (CWE-352)
High
2023-11-05
Stored xss at https://█.8x8.com/api/█/ID
8x8 Cross-site Scripting (XSS) - Stored (CWE-79)
High
2023-10-30
RCE on ingress-nginx-controller via Ingress spec.rules.http.paths.path field
Kubernetes Code Injection (CWE-94)
High
2023-10-26
Code inject via nginx.ingress.kubernetes.io/permanent-redirect annotation
Kubernetes Code Injection (CWE-94)CVE-2023-5044
High
2023-10-25
Accessing apps protected via ZT's Access when user account is deleted/disabled even after clearing user session/seat
Cloudflare Public Bug Bounty Improper Authentication - Generic (CWE-287)
High
2023-10-25
Path traversal through path stored in Uint8Array
Node.js Path Traversal (CWE-22)CVE-2023-39332
High
2023-10-13
Permission model improperly protects against path traversal
Node.js Path Traversal (CWE-22)CVE-2023-39331
High
2023-10-13
CVE-2023-38545: socks5 heap buffer overflow
curl Heap Overflow (CWE-122)CVE-2023-38545
High
2023-10-11
RCE of Burp Scanner / Crawler via Clickjacking
PortSwigger Web Security Command Injection - Generic (CWE-77)
High
2023-10-10
XSS from Mastodon embeds
IRCCloud Cross-site Scripting (XSS) - Generic (CWE-79)
High
2023-10-09
(CVE-2023-32004) Permission model bypass by specifying a path traversal sequence in a Buffer
Internet Bug Bounty Path Traversal (CWE-22)CVE-2023-32004
High
2023-10-07
CVE-2023-30587 Process-based permissions can be bypassed with the "inspector" module.
Internet Bug Bounty Improper Access Control - Generic (CWE-284)CVE-2023-30587
High
2023-09-30
LinkedIn users primary email + full name visibilty
LinkedIn Information Disclosure (CWE-200)
High
2023-09-25
HTTP Request Smuggling (CL.0) leads to mass redirect users to attacker server without user interaction
LinkedIn HTTP Request Smuggling (CWE-444)
High
2023-09-25
AWS keys and user cookie leakage via uninitialized memory leak in outdated librsvg version in Basecamp
Basecamp Information Disclosure (CWE-200)
High
2023-09-21
Permanent CASB Integration Takeover due to Improper Access Controls+Confused Deputy Problem
Cloudflare Public Bug Bounty Improper Access Control - Generic (CWE-284)
High
2023-09-18
2FA BYPASS
Cloudflare Public Bug Bounty Improper Access Control - Generic (CWE-284)
High
2023-09-18
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl439—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239 $9,895