Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1110 CNY

100%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,248
CVE-linked
1,864
Programs
343
New This Week
17
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 658 Improper Authentication - Generic 653 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Zero click account Takeover due to Api misconfiguration 🏂🎩
UPchieve Improper Access Control - Generic (CWE-284)
Critical
2021-05-14
Full account takeover of any user through reset password
UPchieve Improper Access Control - Generic (CWE-284)
Critical
2021-05-14
RCE when removing metadata with ExifTool
GitLab Code Injection (CWE-94)
Critical
2021-05-14
https://████ is vulnerable to cve-2020-3452
U.S. Dept Of Defense Path Traversal (CWE-22)CVE-2020-3452
Critical
2021-05-11
[Portal 2] Remote Code Execution via voice packets
Valve Classic Buffer Overflow (CWE-120)
Critical
2021-05-10
Specially Crafted Closed Captions File can lead to Remote Code Execution in CS:GO and other Source Games
Valve Classic Buffer Overflow (CWE-120)
Critical
2021-05-05
GoldSrc: Buffer Overflow in DELTA_ParseDelta function leads to RCE
Valve Stack Overflow (CWE-121)
Critical
2021-05-04
[GoldSrc] Remote Code Execution using malicious WAD list in BSP file
Valve Stack Overflow (CWE-121)
Critical
2021-05-04
OOB reads in network message handlers leads to RCE
Valve Out-of-bounds Read (CWE-125)
Critical
2021-05-04
Improper data update process on UpdatePhabricatorIntegration mutation leads to leak of Phabricator Conduit API token.
HackerOne Information Disclosure (CWE-200)
Critical
2021-04-30
Any meeting chat history can be read and modified by an arbitrary user
8x8 Incorrect Authorization (CWE-863)
Critical
2021-04-29
XXE in Enterprise Search's App Search web crawler
Elastic XML External Entities (XXE) (CWE-611)
Critical
2021-04-29
Remote OS Command Execution on Oracle Weblogic server via [CVE-2017-10271]
MTN Group OS Command Injection (CWE-78)CVE-2017-10271
Critical
2021-04-25
Remote OS Command Execution on Oracle Weblogic server via [CVE-2017-3506]
MTN Group OS Command Injection (CWE-78)CVE-2017-3506
Critical
2021-04-25
[avito.ru] ImageMagick uninitialized image palette
Avito Memory Corruption - Generic (CWE-119)
Critical
2021-04-24
Cookie steal through content Uri
Brave Software Weak Password Recovery Mechanism for Forgotten Password (CWE-640)
Critical
2021-04-22
Broken parsing of Git diff allows an attacker to inject arbitrary Ruby scripts to Casks on official taps
Homebrew
Critical
2021-04-21
Administration Authentication Bypass on https://█████
U.S. Dept Of Defense Improper Authentication - Generic (CWE-287)
Critical
2021-04-20
████████ portal is open to enumeration once authenticated. Session ID's appear static. All PII available once a valid session ID is found.
U.S. Dept Of Defense Session Fixation (CWE-384)
Critical
2021-04-20
RCE via unsafe inline Kramdown options when rendering certain Wiki pages
GitLab Code Injection (CWE-94)
Critical
2021-04-20
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817 $2,257
HackerOne609—
Nextcloud584—
Shopify464—
curl457—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239—