Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,219
CVE-linked
1,854
Programs
342
New This Week
10
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Program filter: curl✕
Heap‑based buffer overflow in curl -K <config_file> allows arbitrary write .
curl Heap Overflow (CWE-122)
High
2025-04-27
curl allows SSH connection even if host is not in known_hosts
curl Improper Certificate Validation (CWE-295)
High
2025-02-05
Buffer Overflow Risk in Curl_inet_ntop and inet_ntop4
curl Classic Buffer Overflow (CWE-120)
High
2024-12-08
Exploitable Format String Vulnerability in curl_mfprintf Function
curl Use of Externally-Controlled Format String (CWE-134)
High
2024-11-06
Unicode-to-ASCII conversion on Windows can lead to argument injection and more
curl Encoding Error (CWE-172)
High
2024-06-18
Buffer Overflow Vulnerability in WebSocket Handling
curl Heap Overflow (CWE-122)
High
2024-01-02
CVE-2023-38545: socks5 heap buffer overflow
curl Heap Overflow (CWE-122)CVE-2023-38545
High
2023-10-11
match
curl External Control of Critical State Data (CWE-642)
High
2022-06-09
error parse uri path in curl
curl Improper Access Control - Generic (CWE-284)
High
2022-05-13
Cookie injection from non-secure context
curl Session Fixation (CWE-384)
High
2022-05-13
CVE-2022-27774: Credential leak on redirect
curl Insufficiently Protected Credentials (CWE-522)CVE-2022-27774
High
2022-04-27
curl proceeds with unsafe connections when -K file can't be read
curl Improper Check or Handling of Exceptional Conditions (CWE-703)
High
2022-04-21
Use of Unsafe function || Strcpy
curl Classic Buffer Overflow (CWE-120)
High
2022-03-09
Remote memory disclosure vulnerability in libcurl on 64 Bit Windows
curl Information Exposure Through Sent Data (CWE-201)
High
2022-02-21
CVE-2021-22924: Bad connection reuse due to flawed path name checks
curl Improper Input Validation (CWE-20)CVE-2021-22924
High
2021-07-21
CVE-2021-22901: TLS session caching disaster
curl Use After Free (CWE-416)CVE-2021-22901
High
2021-05-26
Inadequate Cryptographic Key Size and Insecure Cryptographic Mode. File Name :- curl_ntlm_core.c
curl Use of a Broken or Risky Cryptographic Algorithm (CWE-327)
High
2021-03-08
curl on Windows can be forced to execute code via OpenSSL environment variables
curl Privilege Escalation (CAPEC-233)CVE-2019-1552CVE-2019-5443
High
2021-02-08
Unexpected access to process open files via file:///proc/self/fd/n
curl Information Disclosure (CWE-200)
High
2021-02-08
libcurl: SMTP end-of-response out-of-bounds read - CVE-2019-3823
curl Heap Overflow (CWE-122)CVE-2019-3823
High
2021-01-08
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl439—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239 $9,895