Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,219
CVE-linked
1,854
Programs
342
New This Week
11
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Program filter: ibb✕
OpenSSL vulnerable to the Marvin Attack (CVE-2022-4304)
Internet Bug Bounty Information Exposure Through Timing Discrepancy (CWE-208)CVE-2022-4304
Medium
2023-12-21
Misconfiguration in AWS CloudFront CDN configuration makes rubygems.org serve (and cache) content from a unclaimed S3-bucket
Internet Bug Bounty Misconfiguration (CWE-16)
Medium
2023-12-07
Integrity checks according to policies can be circumvented in Node.js 20 and Node.js 18
Internet Bug Bounty Insufficient Verification of Data Authenticity (CWE-345)CVE-2023-38552
Medium
2023-11-30
CVE-2023-46695: Potential denial of service vulnerability in UsernameField on Windows
Internet Bug Bounty Uncontrolled Resource Consumption (CWE-400)CVE-2023-46695
Medium
2023-11-29
Secrets can be unmasked in the "Rendered Template"
Internet Bug Bounty Information Disclosure (CWE-200)CVE-2023-40712
Medium
2023-11-29
(CVE-2023-32006) Permissions policies can impersonate other modules in using module.constructor.createRequire()
Internet Bug Bounty CVE-2023-32006
Medium
2023-10-08
Context isolation bypass via nested unserializable return value
Internet Bug Bounty Privilege Escalation (CAPEC-233)CVE-2023-29198
Medium
2023-10-07
OpenSSL engines can be used to bypass and/or disable the Node.js permission model
Internet Bug Bounty Privilege Escalation (CAPEC-233)CVE-2023-30586
Medium
2023-10-07
[curl] CVE-2023-38039: HTTP header allocation DOS
Internet Bug Bounty Allocation of Resources Without Limits or Throttling (CWE-770)CVE-2023-38039
Medium
2023-09-27
SSRF Vulnerability through Connection test feature
Internet Bug Bounty Server-Side Request Forgery (SSRF) (CWE-918)CVE-2023-37379
Medium
2023-09-12
Dependency Policy Bypass via process.binding
Internet Bug Bounty Privilege Escalation (CAPEC-233)
Medium
2023-09-09
Argocd's web terminal session doesn't expire
Internet Bug Bounty Insufficient Session Expiration (CWE-613)
Medium
2023-09-09
CVE-2023-40195: Apache Airflow Spark Provider Deserialization Vulnerability RCE
Internet Bug Bounty Deserialization of Untrusted Data (CWE-502)CVE-2023-40195
Medium
2023-09-08
[CVE-2023-23913] DOM Based Cross-site Scripting in rails-ujs for contenteditable HTML Elements
Internet Bug Bounty Cross-site Scripting (XSS) - DOM (CWE-79)CVE-2023-23913
Medium
2023-09-07
HTTP Request Smuggling via Empty headers separated by CR
Internet Bug Bounty HTTP Request Smuggling (CWE-444)CVE-2023-30589
Medium
2023-08-28
odbc apache airflow provider code execution vulnerability
Internet Bug Bounty Privilege Escalation (CAPEC-233)
Medium
2023-08-26
CVE-2023-36617: ReDoS vulnerability in URI (Ruby)
Internet Bug Bounty CVE-2023-36617
Medium
2023-08-15
[CVE-2023-27539] Possible Denial of Service Vulnerability in Rack’s header parsing
Internet Bug Bounty CVE-2023-27539
Medium
2023-08-15
[curl] CVE-2023-32001: fopen race condition
Internet Bug Bounty Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)CVE-2023-32001
Medium
2023-07-27
CVE-2023-28710 Apache Airflow Spark Provider Arbitrary File Read via JDBC
Internet Bug Bounty Improper Input Validation (CWE-20)CVE-2023-28710
Medium
2023-07-12
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl439—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239 $9,895