Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,232
CVE-linked
1,859
Programs
342
New This Week
12
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 657 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Docker Secret Disclosure via GitHub Actions Cache Poisoning
Linux Foundation Decentralized Trust Information Disclosure (CWE-200)
High
2024-04-20
Exposure of service tokens to webpack bundle
Semrush Information Disclosure (CWE-200)
High
2024-03-08
Sensitive Information Exposed at █████
Mars Information Disclosure (CWE-200)
High
2024-01-30
LinkedIn users primary email + full name visibilty
LinkedIn Information Disclosure (CWE-200)
High
2023-09-25
AWS keys and user cookie leakage via uninitialized memory leak in outdated librsvg version in Basecamp
Basecamp Information Disclosure (CWE-200)
High
2023-09-21
LDAP Anonymous Login enabled in ████
U.S. Dept Of Defense Information Disclosure (CWE-200)
High
2023-09-08
IDOR in channel ID leads to customer email disclosure on https://video.ibm.com
IBM Information Disclosure (CWE-200)
High
2023-08-11
An attacker can can view any hacker email via /SaveCollaboratorsMutation operation name
HackerOne Information Disclosure (CWE-200)
High
2023-07-04
Security token and handler name leak from window.braveBlockRequests
Brave Software Information Disclosure (CWE-200)
High
2023-06-22
Moving private messages into vision with updateMessage method
Rocket.Chat Information Disclosure (CWE-200)CVE-2023-28325
High
2023-05-09
Snowflake server: Leak of TLS packets from other clients
Tor Information Disclosure (CWE-200)
High
2023-03-15
Sensitive Data Exposure at https://█████████
U.S. Dept Of Defense Information Disclosure (CWE-200)
High
2023-02-24
Sensitive information disclosure [HtUS]
U.S. Dept Of Defense Information Disclosure (CWE-200)
High
2023-02-24
connect.8x8.com: Users with no permission can track/access restricted details/data via GET /api/v2/support/requests/<ticket number >HTTP/2
8x8 Information Disclosure (CWE-200)
High
2023-02-15
Critical sensitive information Disclosure. [HtUS]
U.S. Dept Of Defense Information Disclosure (CWE-200)
High
2023-01-13
Any organization's assets pending review can be downloaded
HackerOne Information Disclosure (CWE-200)
High
2022-11-29
User information disclosed via API
U.S. General Services Administration Information Disclosure (CWE-200)
High
2022-10-19
insecure gitlab repositories at ████████ [HtUS]
U.S. Dept Of Defense Information Disclosure (CWE-200)
High
2022-09-27
API route chat.getThreadsList leaks private message content
Rocket.Chat Information Disclosure (CWE-200)CVE-2022-32229
High
2022-09-22
getUserMentionsByChannel leaks messages with mention from private channel
Rocket.Chat Information Disclosure (CWE-200)CVE-2022-35249CVE-2022-32220
High
2022-09-22
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817 $2,257
HackerOne609 $1,500
Nextcloud583—
Shopify464—
curl447—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239—