Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,219
CVE-linked
1,854
Programs
342
New This Week
7
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
IDOR in TalentMAP API can be abused to enumerate personal information of all the users
U.S. Department of State Insecure Direct Object Reference (IDOR) (CWE-639)
High
2023-04-11
Ruby's CGI library has HTTP response splitting (HTTP header injection), leaking confidential information
Internet Bug Bounty CVE-2021-33621
High
2023-04-09
Use of Cryptographically Weak Pseudo-Random Number Generator in WebCrypto keygen
Internet Bug Bounty CVE-2022-35255
High
2023-04-09
Synthetics Recorder: Code injection when recording website with malicious content
Elastic Code Injection (CWE-94)
High
2023-04-08
Cache Deception Allows Account Takeover
Expedia Group Bug Bounty Use of Cache Containing Sensitive Information (CWE-524)
High
2023-04-01
Cache Poisoning Allows Stored XSS Via hav Cookie Parameter (To Account Takeover)
Expedia Group Bug Bounty Cross-site Scripting (XSS) - Stored (CWE-79)
High
2023-04-01
Unauthorized User can View Subscribers of Other Users Newsletters
LinkedIn Insecure Direct Object Reference (IDOR) (CWE-639)
High
2023-03-29
PHP Object injection -> Building Custom Gadget chain -> RCE
ExpressionEngine Command Injection - Generic (CWE-77)
High
2023-03-28
Arbitrary read of all SVG files on a Nextcloud server
Nextcloud Path Traversal (CWE-22)
High
2023-03-26
Accessing unauthorized administration pages and seeing admin password - speakerkit.state.gov
U.S. Department of State Improper Access Control - Generic (CWE-284)
High
2023-03-25
Path traversal leads to reading of local files on ███████ and ████
U.S. Dept Of Defense Path Traversal (CWE-22)
High
2023-03-24
Stealing Users OAuth authorization code via redirect_uri
pixiv Improper Authorization (CWE-285)
High
2023-03-22
Permissions policies can be bypassed via process.mainModule
Node.js Privilege Escalation (CAPEC-233)CVE-2023-23918
High
2023-03-19
Snowflake server: Leak of TLS packets from other clients
Tor Information Disclosure (CWE-200)
High
2023-03-15
Delete anyone's content spotlight remotely.
Snapchat Insecure Direct Object Reference (IDOR) (CWE-639)
High
2023-03-06
SQL Injection in CVE Discovery Search
HackerOne SQL Injection (CWE-89)
High
2023-03-06
Argo CD reconciles apps outside configured namespaces when sharding is enabled
Internet Bug Bounty Improper Access Control - Generic (CWE-284)CVE-2023-22736
High
2023-03-05
[█████] Bug Reports allow for Unrestricted File Upload
U.S. Dept Of Defense Violation of Secure Design Principles (CWE-657)
High
2023-02-24
Sensitive Data Exposure at https://█████████
U.S. Dept Of Defense Information Disclosure (CWE-200)
High
2023-02-24
Upload and delete files in debug page without access control.
U.S. Dept Of Defense Improper Access Control - Generic (CWE-284)
High
2023-02-24
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl439—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239 $9,895