Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,219
CVE-linked
1,854
Programs
342
New This Week
10
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Program filter: curl✕
CVE-2021-22945: UAF and double-free in MQTT sending
curl Double Free (CWE-415)CVE-2021-22945
Medium
2021-09-15
CVE-2021-22925: TELNET stack contents disclosure again
curl Information Disclosure (CWE-200)CVE-2021-22925CVE-2021-22898
Low
2021-07-21
CVE-2021-22924: Bad connection reuse due to flawed path name checks
curl Improper Input Validation (CWE-20)CVE-2021-22924
High
2021-07-21
CVE-2021-22926: CURLOPT_SSLCERT mixup with Secure Transport
curl Business Logic Errors (CWE-840)CVE-2021-22926
Medium
2021-07-21
CVE-2021-22923: Metalink download sends credentials
curl Cleartext Transmission of Sensitive Information (CWE-319)CVE-2021-22923
Medium
2021-07-21
CVE-2021-22922: Wrong content via metalink not discarded
curl Business Logic Errors (CWE-840)CVE-2021-22922
Medium
2021-07-21
CVE-2021-22901: TLS session caching disaster
curl Use After Free (CWE-416)CVE-2021-22901
High
2021-05-26
CVE-2021-22898: TELNET stack contents disclosure
curl Information Disclosure (CWE-200)CVE-2021-22898
Medium
2021-05-26
CVE-2021-22897: schannel cipher selection surprise
curl Business Logic Errors (CWE-840)CVE-2021-22897
Low
2021-05-26
CVE-2021-22890: TLS 1.3 session ticket proxy host mixup
curl Man-in-the-Middle (CWE-300)CVE-2021-22890
Low
2021-04-30
CVE-2021-22876: Automatic referer leaks credentials
curl CVE-2021-22876
Low
2021-04-30
Proxy-Authorization header carried to a new host on a redirect
curl Cleartext Transmission of Sensitive Information (CWE-319)CVE-2018-1000007
Medium
2021-03-08
Inadequate Cryptographic Key Size and Insecure Cryptographic Mode. File Name :- curl_ntlm_core.c
curl Use of a Broken or Risky Cryptographic Algorithm (CWE-327)
High
2021-03-08
CVE-2020-8284: trusting FTP PASV responses
curl Information Disclosure (CWE-200)CVE-2020-8284
Low
2021-02-09
huge COLUMNS causes progress-bar to buffer overflow
curl Classic Buffer Overflow (CWE-120)
Low
2021-02-08
Integer overflow at line 1603 in the src/operator.c file
curl Integer Overflow (CWE-190)
Low
2021-02-08
Buffer write overflow when forming dns over http request
curl Classic Buffer Overflow (CWE-120)
Low
2021-02-08
Resource leak when using a normal site as DOH server
curl
None
2021-02-08
Potential invocation of qsort on uninitialized memory during cookie save
curl Memory Corruption - Generic (CWE-119)
Low
2021-02-08
use after free in cookie.c
curl Use After Free (CWE-416)
Low
2021-02-08
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl439—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239 $9,895