Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1020 CNY

100%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,245
CVE-linked
1,864
Programs
343
New This Week
23
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 658 Improper Authentication - Generic 653 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
HackerOne customer submitted sensitive link to VirusTotal, exposing confidential information
HackerOne Information Disclosure (CWE-200)
None
2018-07-26
Information leakage - Private reports cached by Google
HackerOne Information Disclosure (CWE-200)
Unknown
2018-07-23
Team object exposes amount of participants in a private program to non-invited users
HackerOne Information Disclosure (CWE-200)
Medium
2018-07-20
Directory Listing on https://promo-services-staging.brave.com
Brave Software Information Disclosure (CWE-200)
Unknown
2018-07-09
Просмотр приватных видео записей у Пользователей
VK.com Information Disclosure (CWE-200)
Low
2018-07-06
Team object in GraphQL that have a published external program may expose existence of a private program
HackerOne Information Disclosure (CWE-200)
None
2018-07-04
De-anonymization by visiting specially crafted bookmark.
Tor Information Disclosure (CWE-200)
High
2018-07-03
ImageMagick GIF coder vulnerability leading to memory disclosure
Valve Information Disclosure (CWE-200)
Medium
2018-07-02
User object in GraphQL exposes number of trial reports for External Programs that also have a Private Program
HackerOne Information Disclosure (CWE-200)
None
2018-06-27
People who interviewed for HackerOne security analyst position can be enumerated and their personal email address may be exposed
HackerOne Information Disclosure (CWE-200)
Low
2018-06-25
The session token in the URL
Nextcloud Information Disclosure (CWE-200)
Medium
2018-06-19
Просмотр любых записей на стене
VK.com Information Disclosure (CWE-200)
High
2018-06-18
Publicly Accessible Datadog link
Shopify Information Disclosure (CWE-200)
None
2018-06-15
Disclosed Version of PORTS SSH|HTTP|SSL
Nextcloud Information Disclosure (CWE-200)
Low
2018-06-14
Leak of Platform Authentication credentials via Repeater
PortSwigger Web Security Information Disclosure (CWE-200)
Low
2018-06-13
Exposing hackerone users personally identifiable information by abusing sandbox with swag reward enabled
HackerOne Information Disclosure (CWE-200)
None
2018-06-07
Lack of cross-origin request blocking allows leaking of sensitive information on several endpoints
HackerOne Information Disclosure (CWE-200)
Unknown
2018-06-07
Exploiting JSONP callback on /username/charts.json endpoint leads to information disclosure despite user's privacy settings
Liberapay Information Disclosure (CWE-200)
Medium
2018-06-05
Получение предложенных фотографий паблику
VK.com Information Disclosure (CWE-200)
Medium
2018-05-30
SSRF when importing a project from a git repo by URL
GitLab Information Disclosure (CWE-200)
Unknown
2018-05-29
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817 $2,257
HackerOne609—
Nextcloud584—
Shopify464—
curl457—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239—