Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,262
CVE-linked
1,866
Programs
343
New This Week
0
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 658 Improper Authentication - Generic 654 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Attacker can Add itself as admin user and can also change privileges of Existing Users [█████████]
U.S. Dept Of Defense Improper Authentication - Generic (CWE-287)
Critical
2024-03-22
Persistent Unauthorized Administrative Access on All Organization Repositories via RC in User Conversion to Organization
GitHub Improper Authentication - Generic (CWE-287)CVE-2023-46649
Medium
2024-03-15
Improper Authentication on Alertmanager instance
IBM Improper Authentication - Generic (CWE-287)
Medium
2024-02-29
Jenkins server access due to weak password
IBM Improper Authentication - Generic (CWE-287)
High
2024-02-29
Vulnerability Report: NO RATE LIMIT Password RESET
Trellix Improper Authentication - Generic (CWE-287)
Low
2024-02-02
default credentials at https://52.42.105.71/
Trellix Improper Authentication - Generic (CWE-287)
Critical
2024-02-01
Critical Unauthenticated Access to Sensitive Employee and Customer Data Including Invoice Details at ████
Mars Improper Authentication - Generic (CWE-287)
Critical
2024-01-30
Unauthenticated Jenkins instance exposed information related to █████
U.S. Dept Of Defense Improper Authentication - Generic (CWE-287)
High
2024-01-26
Weak Email Verification: Newly Registered Users Can Bypass Email Verification Step and Log In
Enjin Improper Authentication - Generic (CWE-287)
Medium
2024-01-19
App PIN code can be bypassed in Files iOS
Nextcloud Improper Authentication - Generic (CWE-287)CVE-2023-49790
Low
2023-12-18
access to profile & reset password page without authentication
Tennessee Valley Authority Improper Authentication - Generic (CWE-287)
Medium
2023-11-30
Full account takeover of any user through reset password
U.S. Dept Of Defense Improper Authentication - Generic (CWE-287)
Medium
2023-11-17
Accessing apps protected via ZT's Access when user account is deleted/disabled even after clearing user session/seat
Cloudflare Public Bug Bounty Improper Authentication - Generic (CWE-287)
High
2023-10-25
authentication bypass
U.S. Dept Of Defense Improper Authentication - Generic (CWE-287)
Medium
2023-09-29
No Rate Limit On Forgot Password on https://apps.nextcloud.com
Nextcloud Improper Authentication - Generic (CWE-287)
Unknown
2023-09-26
Unprotected Atlantis Server at https://132.226.█.█
8x8 Improper Authentication - Generic (CWE-287)
Medium
2023-09-15
bypass two-factor authentication.
LinkedIn Improper Authentication - Generic (CWE-287)
Medium
2023-08-01
Bypass for forced re-authentication upon biometrics change
Bitwarden Improper Authentication - Generic (CWE-287)
Medium
2023-07-19
Improper Authentication inside the Rockstar Games Launcher which leads to Account takeover to some extend
Rockstar Games Improper Authentication - Generic (CWE-287)
High
2023-07-05
Ability to join an arbitrary workspace by utilizing a proxy to manipulate invite links
Slack Improper Authentication - Generic (CWE-287)
Critical
2023-06-23
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817 $2,257
HackerOne609—
Nextcloud584—
Shopify465—
curl464—
Node.js third-party modules307—
GitLab258—
X / xAI250 $7,000
Uber239—