Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,219
CVE-linked
1,854
Programs
342
New This Week
11
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Program filter: security✕
Hackers can find out the ID of private programs
HackerOne Information Disclosure (CWE-200)
Low
2021-08-24
Tab nabbing in Hackerone inbox.
HackerOne Open Redirect (CWE-601)
Low
2021-08-09
PII data Leakage through hackerone reports
HackerOne Information Disclosure (CWE-200)
Low
2021-08-09
Private program disclosure through notifications
HackerOne Improper Access Control - Generic (CWE-284)
Low
2021-08-05
Information disclosure - Feedback is accessible on Public profile even after 'disallowed' at https://hackerone.com/settings/feedback
HackerOne Information Disclosure (CWE-200)
Low
2021-08-03
New link opening method makes hackerone vulnerable to tabnabbing
HackerOne Open Redirect (CWE-601)
Low
2021-07-07
Report Bulk endpoint "agree-on-going-public" action may reveal Report disclosure state for invite-only programs
HackerOne Information Disclosure (CWE-200)
Low
2021-06-30
Report Duplicate Detector can match deleted and draft reports, may disclose title and vulnerability information
HackerOne Information Disclosure (CWE-200)
Low
2021-06-24
Second-order SOQL injection through email and campaign name parameter in Salesforce lead submission
HackerOne
Low
2021-06-18
Private program disclosure of `██████████` through notifications
HackerOne Improper Access Control - Generic (CWE-284)
Low
2021-06-09
Lack warning label when receiving a letter
HackerOne Phishing (CAPEC-98)
Low
2021-05-13
CSRF allows to test email forwarding
HackerOne Cross-Site Request Forgery (CSRF) (CWE-352)
Low
2021-05-13
Bypassing the External Link Warning
HackerOne Open Redirect (CWE-601)
Low
2021-05-07
Editing Pentest Summary Report Answers After Submitting Them
HackerOne Modification of Assumed-Immutable Data (MAID) (CWE-471)
Low
2021-05-06
Ability to invite a new member on Sandbox Program
HackerOne Business Logic Errors (CWE-840)
Low
2021-04-05
"Bounty splitting enabled" can discloses if public VDPs are running private VRP
HackerOne
Low
2021-03-18
Dangling cloud instance at vpn.inverselink.com
HackerOne Business Logic Errors (CWE-840)
Low
2021-03-11
Denial Of Service (Out Of Memory) on Updating Bounty Table [Urgent]
HackerOne Uncontrolled Resource Consumption (CWE-400)
Low
2021-02-02
The hacker has access to the administrative part of the management reports in publish report
HackerOne
Low
2020-12-16
Getting New Invitations without Leaving Programs
HackerOne Business Logic Errors (CWE-840)
Low
2020-10-15
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl439—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239 $9,895