Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,219
CVE-linked
1,854
Programs
342
New This Week
11
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Program filter: security✕
GraphQL sessions aren't immediately invalidated when user password is changed
HackerOne Violation of Secure Design Principles (CWE-657)
Unknown
2017-11-30
Introspection query leaks sensitive graphql system information.
HackerOne Violation of Secure Design Principles (CWE-657)
Unknown
2017-11-22
Issue with password change in Disabled Account
HackerOne Violation of Secure Design Principles (CWE-657)
Low
2017-11-16
Homograph fix Bypass
HackerOne Violation of Secure Design Principles (CWE-657)
Medium
2017-10-16
Stealing contact form data on www.hackerone.com using Marketo Forms XSS with postMessage frame-jumping and jQuery-JSONP
HackerOne Violation of Secure Design Principles (CWE-657)
Unknown
2017-08-29
www.hackerone.com website CSP "script-src" includes "unsafe-inline"
HackerOne Violation of Secure Design Principles (CWE-657)
None
2017-05-23
javascript: and mailto: links are allowed in JIRA integration settings
HackerOne Violation of Secure Design Principles (CWE-657)
Low
2017-04-10
Example HackerOne security@ forward domain is not registered
HackerOne Violation of Secure Design Principles (CWE-657)
Unknown
2017-04-10
Google Analytics could be used as CSP bypass for data exfiltration on hackerone.com
HackerOne Violation of Secure Design Principles (CWE-657)
Low
2017-03-26
Report redaction doesn't apply to report title update activities
HackerOne Violation of Secure Design Principles (CWE-657)
Low
2017-02-25
Bypass rate limiting on /users/password (possibly site-wide rate limit bypass?)
HackerOne Violation of Secure Design Principles (CWE-657)
None
2016-12-08
Hacker.One Subdomain Takeover
HackerOne Violation of Secure Design Principles (CWE-657)
Low
2016-09-20
Able to remove the admin access of my program
HackerOne Violation of Secure Design Principles (CWE-657)
Unknown
2016-07-06
Manipulate report timeline activity by using null byte.
HackerOne Violation of Secure Design Principles (CWE-657)
Unknown
2016-07-01
Content Spoofing via reports
HackerOne Violation of Secure Design Principles (CWE-657)
Unknown
2016-05-25
Redirection Page throwing error instead of redirecting to site
HackerOne Violation of Secure Design Principles (CWE-657)
Unknown
2016-05-25
Spamming any user from Reset Password Function
HackerOne Violation of Secure Design Principles (CWE-657)
Unknown
2016-05-03
SECURITY: Referencing previous Reports attachment_IDs on new Reports via Draft_Sync DELETES Attachments
HackerOne Violation of Secure Design Principles (CWE-657)
Unknown
2016-04-30
Race Conditions Exist When Accepting Invitations
HackerOne Violation of Secure Design Principles (CWE-657)
Unknown
2016-04-26
Reflected File Download
HackerOne Violation of Secure Design Principles (CWE-657)
Unknown
2016-04-25
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl439—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239 $9,895