目標達成 すべての支援者に感謝 — 100%達成しました！

目標: 1000 CNY · 調達済み: 1336 CNY

100%
コーヒーを一杯おごる

漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告
12,262
关联 CVE
1,866
参与项目数
343
近 7 天新增
0
严重度: All CriticalHighMediumLow
类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 658 Improper Authentication - Generic 654 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
POST /api/bitcoinWithdrawalFees returns financial data without authentication despite being documented as a USER OPERATION (private endpoint)
CoinMate.io Improper Authentication - Generic (CWE-287)
Medium
2026-05-20
HMAC signature verification omits endpoint and payload allowing request forgery on CoinMate API
CoinMate.io Missing Required Cryptographic Step (CWE-325)
Low
2026-05-20
HTTP/3 paused transfer buffers incoming data without bound up to ~1 GiB
curl Allocation of Resources Without Limits or Throttling (CWE-770)
Unknown
2026-05-19
Schannel custom-CA path skips Extended Key Usage enforcement
curl Business Logic Errors (CWE-840)
Unknown
2026-05-19
Connection reuse ignores haproxyprotocol and HAPROXY_CLIENT_IP settings, allowing PROXY context to persist across transfers
curl Incorrect Authorization (CWE-863)CVE-2026-4873CVE-2026-5545CVE-2026-5773CVE-2026-6429CVE-2026-6253CVE-2026-7168CVE-2026-3784CVE-2026-3805
None
2026-05-19
SSL session-cache peer key omits signature_algorithms: strict-sigalg handle silently resumes a permissive sibling's session
curl Improper Certificate Validation (CWE-295)CVE-2020-8231
Unknown
2026-05-19
CURLOPT_PROXY_CAINFO_BLOB silently activates native CA store on Apple builds
curl Business Logic Errors (CWE-840)
None
2026-05-19
TLS peer-verification bypass via mid-transfer ssl_config mutation
curl Business Logic Errors (CWE-840)
Unknown
2026-05-19
TLS verifyhost bypass in rustls, mbedTLS, and wolfSSL when verifypeer=0
curl Business Logic Errors (CWE-840)CVE-2013-4545CVE-2014-0139
Unknown
2026-05-19
HTTP/2 proxy CONNECT tunnel unbounded 1xx chain (missing Curl_bump_headersize cap in cf-h2-proxy.c)
curl Allocation of Resources Without Limits or Throttling (CWE-770)CVE-2023-38039
None
2026-05-19
Cross-repository IDOR in `/settings/security_analysis/bypass_reviewers` allows unauthorized delegated bypass reviewer modification
GitHub Insecure Direct Object Reference (IDOR) (CWE-639)CVE-2026-3307
Medium
2026-05-19
CURLOPT_HSTS_CTRL disables shared HSTS without share guard — use-after-free and double-free
curl Use After Free (CWE-416)CVE-2018-16840CVE-2023-27537
Unknown
2026-05-18
cookie: case-insensitive path comparison in replace_existing() allows cookie eviction across distinct paths
curl Business Logic Errors (CWE-840)
Unknown
2026-05-18
libssh SFTP initialization ignores CURLOPT_TIMEOUT, hangs indefinitely
curl Allocation of Resources Without Limits or Throttling (CWE-770)
Unknown
2026-05-18
rustls backend silently ignores CURLOPT_CRLFILE when native CA store is active
curl Business Logic Errors (CWE-840)
Unknown
2026-05-18
HSTS multi-trailing-dot bypass-ish: possible incomplete fix for CVE-2022-30115
curl Cleartext Transmission of Sensitive Information (CWE-319)CVE-2022-30115
Medium
2026-05-18
Unauthenticated File Upload to CDN
Enjin Improper Access Control - Generic (CWE-284)
Medium
2026-05-18
IDOR: autotranslate.translateMessage Full Message Content Leak
Rocket.Chat Insecure Direct Object Reference (IDOR) (CWE-639)
Medium
2026-05-18
Trailing-dot IPv4 URL bypasses IP-address guard, allows wildcard DNS SAN match
curl Business Logic Errors (CWE-840)CVE-2022-30115
None
2026-05-17
NULL pointer dereference in libcurl URL API redirect_url() with CURLU_DEFAULT_SCHEME
curl NULL Pointer Dereference (CWE-476)
None
2026-05-17
高频漏洞类型
最活跃项目
项目报告数最高赏金
U.S. Dept Of Defense896—
Internet Bug Bounty817 $2,257
HackerOne609—
Nextcloud584—
Shopify465—
curl464—
Node.js third-party modules307—
GitLab258—
X / xAI250 $7,000
Uber239—