Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,221
CVE-linked
1,854
Programs
342
New This Week
4
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Open SonarQube instance leaking internal source code
Equifax-vdp Information Disclosure (CWE-200)
Critical
2020-09-03
Sensitive Information Disclosure
Dropcontact Information Disclosure (CWE-200)
Critical
2020-08-21
[h1-2006 CTF] Payments for May have been processed!
h1-ctf Information Disclosure (CWE-200)
Critical
2020-06-19
h1-ctf writeup , finally paid the payments by chaining multiple bugs
h1-ctf Information Disclosure (CWE-200)
Critical
2020-06-18
[H1-2006 2020] H1-2006 CTF Writeup
h1-ctf Information Disclosure (CWE-200)
Critical
2020-06-18
gitlab-workhorse bypass in Gitlab::Middleware::Multipart allowing files in `allowed_paths` to be read
GitLab Information Disclosure (CWE-200)
Critical
2020-06-08
China – Limited Partner PII Regarding Work Scheduling via Unauthenticated API Endpoint
Starbucks Information Disclosure (CWE-200)
Critical
2020-04-01
sdrc.starbucks.com - Information Disclosure via unsecured attachment directory
Starbucks Information Disclosure (CWE-200)
Critical
2020-02-26
[Partial] SSN & [PII] exposed through iPERMs Presentation Slide.
U.S. Dept Of Defense Information Disclosure (CWE-200)
Critical
2019-12-02
PII leakage due to scrceenshot of health records
U.S. Dept Of Defense Information Disclosure (CWE-200)
Critical
2019-12-02
SSRF on █████████ Allowing internal server data access
U.S. Dept Of Defense Information Disclosure (CWE-200)CVE-2017-9506
Critical
2019-10-08
Public Github Repo Leaking Internal Credentials Leading To DiscoveryIQ Docker Access
Informatica Information Disclosure (CWE-200)
Critical
2019-08-06
JSON serialization of any Project model results in all Runner tokens being exposed through Quick Actions
GitLab Information Disclosure (CWE-200)
Critical
2019-04-20
AWS bucket leading to iOS test build code and configuration exposure
Slack Information Disclosure (CWE-200)
Critical
2019-02-23
Confidential data of users and limited metadata of programs and reports accessible via GraphQL
HackerOne Information Disclosure (CWE-200)
Critical
2019-02-03
[avito.ru] Утекают креды от платежных провайдеров
Avito Information Disclosure (CWE-200)
Critical
2018-12-24
Leaking sensitive information on Github lead full access to all Grab Slack channels
Grab Information Disclosure (CWE-200)
Critical
2018-09-11
Stealing Private Information in VK Android App through PlayerProxy Port Remotely
VK.com Information Disclosure (CWE-200)
Critical
2018-09-02
GitHub API Key for BrewTestBot is publicly exposed
Homebrew Information Disclosure (CWE-200)
Critical
2018-08-11
Leaking sensitive files on Github leads to internal files (python scripts,SQL files)
Starbucks Information Disclosure (CWE-200)
Critical
2018-05-17
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl440—
Node.js third-party modules307—
GitLab258 $13,950
X / xAI250 $2,500
Uber239—