Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,262
CVE-linked
1,866
Programs
343
New This Week
0
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 658 Improper Authentication - Generic 654 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Program filter: security✕
Any one can view collaborater email address via path /reports/<id>/participants
HackerOne Improper Access Control - Generic (CWE-284)
Low
2023-06-01
Program managers can see draft reports using Export Reports feature
HackerOne Business Logic Errors (CWE-840)
Low
2023-05-18
HTML injection in email at https://www.hackerone.com/
HackerOne Code Injection (CWE-94)
Low
2023-05-12
adding h1_analyst_* to username for normal users
HackerOne Business Logic Errors (CWE-840)
Low
2023-04-12
information disclosure of another company bug on video.
HackerOne Information Disclosure (CWE-200)
Low
2023-03-12
HTML injection that may lead to XSS on HackerOne.com through H1 Triage Wizard Chrome Extension
HackerOne Cross-site Scripting (XSS) - Stored (CWE-79)
Low
2023-02-14
HackerOne Undisclosed Report Leak via PoC of Full Disclosure on Hacktivity
HackerOne Information Disclosure (CWE-200)
Low
2023-02-10
Race condition in joining CTF group
HackerOne Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
Low
2023-01-08
HTML Injection in email via Name field
HackerOne Cross-site Scripting (XSS) - Generic (CWE-79)
Low
2022-09-18
Private invitation links/tokens leak to third-party analytics site
HackerOne Information Disclosure (CWE-200)
Low
2022-04-05
Attachment references in markdown don't warn before downloading
HackerOne Open Redirect (CWE-601)
Low
2022-02-25
HackerOne Staging uses Production data for testing
HackerOne Privacy Violation (CWE-359)
Low
2021-11-05
User's who are banned from program can still be invited to the new reports as collaborators
HackerOne Business Logic Errors (CWE-840)
Low
2021-09-22
Temporary banned user (from platform) is able to make submissions via embedded submission forms
HackerOne Business Logic Errors (CWE-840)
Low
2021-09-22
Race condition allows to send multiple times feedback for the hacker
HackerOne Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (CWE-362)
Low
2021-09-22
Hacker can bypass minimum bounty amount restrictions in "invitation preferences" setting via UpdateInvitationPreferencesMutation GraphQL operation
HackerOne Client-Side Enforcement of Server-Side Security (CWE-602)
Low
2021-09-20
Enumerating HackerOne Pentests
HackerOne Misconfiguration (CWE-16)
Low
2021-08-25
Hackers can reveal the names of private programs that have an external link and Enterprise Product Edition
HackerOne Information Disclosure (CWE-200)
Low
2021-08-24
Hackers can reveal the names of private programs that have an external link
HackerOne Information Disclosure (CWE-200)
Low
2021-08-24
The possibility of disrupting the normal operation of frontend using markdown
HackerOne Uncontrolled Resource Consumption (CWE-400)
Low
2021-08-24
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817 $2,257
HackerOne609—
Nextcloud584—
Shopify465—
curl464—
Node.js third-party modules307—
GitLab258—
X / xAI250 $7,000
Uber239—