Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,219
CVE-linked
1,854
Programs
342
New This Week
10
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Program filter: curl✕
CVE-2025-15224: libssh key passphrase bypass without agent set
curl CVE-2025-15224
Low
2026-01-07
MQTT: Missing upper bound on incoming Remaining Length allows server-controlled long wait
curl Uncontrolled Resource Consumption (CWE-400)
Low
2026-01-06
Telnet Suboption Buffer Pointer Underflow in lib/telnet.c leads to Out-of-Bounds Read
curl Buffer Under-read (CWE-127)
Low
2025-12-29
Security hardening: missing integer overflow check in curl_load_library()
curl Integer Overflow (CWE-190)
Low
2025-12-27
Integer Overflow in `curl_easy_escape()` may lead to heap buffer overflow and stack memory disclosure on 32-bit platforms
curl Integer Overflow (CWE-190)
Low
2025-12-25
Functional Regression in Digest Authentication: Failure to handle optional spaces and escaped quotes
curl Improper Input Validation (CWE-20)
Low
2025-12-21
A logic error in detect_proxy caused truncation of environment variable names for long protocol schemes.
curl Business Logic Errors (CWE-840)
Low
2025-12-21
Terminal Output Not Great
curl Improper Neutralization of Escape, Meta, or Control Sequences (CWE-150)
Low
2025-12-11
Arbitrary free in curl's config file parsing.
curl
Low
2025-11-23
Incorrect sizeof() in Rustls Backend Memory Allocation
curl Incorrect Calculation of Buffer Size (CWE-131)
Low
2025-11-15
CVE-2025-10966: missing SFTP host verification with wolfSSH
curl Improper Certificate Validation (CWE-295)CVE-2025-10966
Low
2025-11-05
Memory leak in Curl_auth_create_ntlm_type3_message
curl Uncontrolled Resource Consumption (CWE-400)
Low
2025-10-28
libcurl MQTT PUBLISH length overflow (heap overflow)
curl Heap Overflow (CWE-122)
Low
2025-10-28
OpenSSL backend: X509 peer certificate not freed in ossl_get_channel_binding causes per-request memory leak (DoS risk for long-lived clients)
curl Uncontrolled Resource Consumption (CWE-400)
Low
2025-10-08
Inconsistent URL Parsing in curl Leading to Potential SSRF and Access Control Bypass
curl Improper Input Validation (CWE-20)
Low
2025-09-26
int overflow in krb5_read_data() leads to (possible) massive `recv()` write
curl Integer Overflow (CWE-190)
Low
2025-09-18
CVE-2025-9086: Out of bounds read for cookie path
curl Buffer Over-read (CWE-126)CVE-2025-9086
Low
2025-09-10
CVE-2025-10148: predictable WebSocket mask
curl Reusing a Nonce, Key Pair in Encryption (CWE-323)CVE-2025-10148
Low
2025-09-10
Security check up
curl Allocation of Resources Without Limits or Throttling (CWE-770)
Low
2025-07-24
on the implications of permitting procedural culling
curl Use of Insufficiently Random Values (CWE-330)
Low
2025-07-22
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl439—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239 $9,895