Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,219
CVE-linked
1,854
Programs
342
New This Week
10
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Program filter: nextcloud✕
Messages can still be seen on conversation after expiring when cron is misconfigured
Nextcloud Privacy Violation (CWE-359)CVE-2023-26041
Low
2023-02-27
No password length restriction in reset password endpoint
Nextcloud Uncontrolled Resource Consumption (CWE-400)CVE-2023-25816
Low
2023-02-09
Mail app - blind SSRF via smtpHost parameter
Nextcloud Server-Side Request Forgery (SSRF) (CWE-918)CVE-2023-23943
Low
2023-02-06
Mail app - Blind SSRF via Sierve server fonctionnality and sieveHost parameter
Nextcloud Server-Side Request Forgery (SSRF) (CWE-918)CVE-2023-23943
Low
2023-02-06
Mail app - blind SSRF via imapHost parameter
Nextcloud Server-Side Request Forgery (SSRF) (CWE-918)CVE-2023-23943
Low
2023-02-06
Possibility to delete files attached to deck cards of other users
Nextcloud Insecure Direct Object Reference (IDOR) (CWE-639)CVE-2023-22471
Low
2023-01-09
Missing character limitation allows to put generate a database error
Nextcloud Uncontrolled Resource Consumption (CWE-400)CVE-2023-22470
Low
2023-01-09
Passcode bypass on Talk Android app
Nextcloud Improper Access Control - Generic (CWE-284)CVE-2023-22473
Low
2023-01-09
No password length limit when creating a user as an administrator
Nextcloud Uncontrolled Resource Consumption (CWE-400)CVE-2022-41969
Low
2022-12-31
Disabled download shares still allow download through preview images
Nextcloud Improper Access Control - Generic (CWE-284)CVE-2022-41970
Low
2022-12-31
nextcloudcmd incorrectly trusts bad TLS certificates
Nextcloud Improper Certificate Validation (CWE-295)CVE-2022-39334
Low
2022-12-25
Talk Android broadcast receiver is not protected by broadcastPermission allowing malicious apps to communicate
Nextcloud Improper Access Control - Generic (CWE-284)CVE-2022-4192
Low
2022-12-25
Missing length validation of user displayname allows to generate an SQL error
Nextcloud Uncontrolled Resource Consumption (CWE-400)CVE-2022-39346
Low
2022-12-20
[user_oidc] Stored XSS via Authorization Endpoint - Safari-Only
Nextcloud Cross-site Scripting (XSS) - Stored (CWE-79)CVE-2022-39338
Low
2022-12-18
[user_oidc] Unencrypted Communications
Nextcloud Cleartext Transmission of Sensitive Information (CWE-319)CVE-2022-39339
Low
2022-12-18
Exposed Log File Lead to Full Internal path disclosure at [https://nextcloud.com/wp-content/debug.log]
Nextcloud Information Disclosure (CWE-200)
Low
2022-12-15
A vulnerability classified as critical has been found in gsi-openssh-server 7.9p1 on Fedora (Connectivity Software) on server (http://95.217.64.181:22
Nextcloud CVE-2019-7639
Low
2022-12-10
Calendar name length not validated before writing to database
Nextcloud Uncontrolled Resource Consumption (CWE-400)CVE-2022-41968
Low
2022-12-01
Profile of disabled user stays accessible
Nextcloud Improper Access Control - Generic (CWE-284)CVE-2022-39329
Low
2022-11-26
XSS in Desktop Client in call notification popup
Nextcloud Resource Injection (CWE-99)CVE-2022-39333
Low
2022-11-25
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl439—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239 $9,895