Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,221
CVE-linked
1,854
Programs
342
New This Week
7
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Full read SSRF at █████████ [HtUS]
U.S. Dept Of Defense Server-Side Request Forgery (SSRF) (CWE-918)
High
2022-09-14
Unprotected ██████ and Test site API Exposes Documents, Credentials, and Emails in ██████████ Proposal System
U.S. Dept Of Defense Improper Access Control - Generic (CWE-284)
High
2022-09-14
Directory Traversal at █████
U.S. Dept Of Defense Path Traversal (CWE-22)
High
2022-09-14
Shop - Reflected XSS With Clickjacking Leads to Steal User's Cookie In Two Domain
Meredith Cross-site Scripting (XSS) - Reflected (CWE-79)
High
2022-09-14
DOS validator nodes of blockchain to block external connections
Linux Foundation Decentralized Trust Uncontrolled Resource Consumption (CWE-400)CVE-2022-31006
High
2022-09-13
Response Manipulation leads to Admin Panel Login Bypass at https://██████/
Sony Improper Authentication - Generic (CWE-287)
High
2022-09-12
CVE-2022-21831: Possible code injection vulnerability in Rails / Active Storage
Internet Bug Bounty Code Injection (CWE-94)CVE-2022-21831
High
2022-09-10
String length restriction byepass at https://callerfeel.mtnonline.com/profile/feedback.html
MTN Group Violation of Secure Design Principles (CWE-657)
High
2022-09-07
Stored XSS at https://█████
U.S. Dept Of Defense Cross-site Scripting (XSS) - Stored (CWE-79)
High
2022-09-06
Sensitive Information Disclosure Through Config File
MTN Group Cleartext Storage of Sensitive Information (CWE-312)
High
2022-09-01
Default Admin Username and Password on remedysso.mtncameroon.net
MTN Group
High
2022-09-01
Remote denial of service in HyperLedger Fabric
Linux Foundation Decentralized Trust Uncontrolled Resource Consumption (CWE-400)CVE-2022-36023
High
2022-09-01
Pause-based desync in Apache HTTPD
Internet Bug Bounty HTTP Request Smuggling (CWE-444)
High
2022-08-25
Blind SSRF External Interaction on ████████
MTN Group Server-Side Request Forgery (SSRF) (CWE-918)
High
2022-08-21
RPC call crashes node
Monero Uncontrolled Resource Consumption (CWE-400)
High
2022-08-20
CSRF Account Takeover
TikTok Cross-Site Request Forgery (CSRF) (CWE-352)
High
2022-08-16
IDOR allowing to read another user's token on the Social Media Ads service
Semrush Improper Access Control - Generic (CWE-284)
High
2022-08-16
Ingress-nginx annotation injection allows retrieval of ingress-nginx serviceaccount token and secrets across all namespaces
Kubernetes Code Injection (CWE-94)CVE-2021-25742
High
2022-08-13
fix(security):Path Traversal Bug
Linux Foundation Decentralized Trust Path Traversal (CWE-22)
High
2022-08-11
Ability to escape database transaction through SQL injection, leading to arbitrary code execution
HackerOne SQL Injection (CWE-89)
High
2022-08-09
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl440—
Node.js third-party modules307—
GitLab258 $13,950
X / xAI250 $2,500
Uber239 $9,895