Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,221
CVE-linked
1,854
Programs
342
New This Week
8
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Stored XSS on new Calling plugin (spreed)
Nextcloud Cross-site Scripting (XSS) - Generic (CWE-79)
High
2016-12-13
[now.informatica.com] Reflective XSS
Informatica Cross-site Scripting (XSS) - Generic (CWE-79)
High
2016-12-09
Public profile is vulnerable to stored XSS / Facebook Token can be stolen
DigitalSellz Cross-site Scripting (XSS) - Generic (CWE-79)
High
2016-11-27
[now.informatica.com] Reflective Xss
Informatica Cross-site Scripting (XSS) - Generic (CWE-79)
High
2016-05-19
Stored XSS On Statement
Gratipay Cross-site Scripting (XSS) - Generic (CWE-79)
High
2015-09-03
JSON keys are not properly escaped
Ruby on Rails Cross-site Scripting (XSS) - Generic (CWE-79)CVE-2015-3226
High
2015-06-16
Markdown parsing issue enables insertion of malicious tags and event handlers
HackerOne Cross-site Scripting (XSS) - Generic (CWE-79)
High
2015-04-07
Improperly validated fields allows injection of arbitrary HTML via spoofed React objects
HackerOne Cross-site Scripting (XSS) - Generic (CWE-79)
High
2015-03-18
Vulnerability with the way \ escaped characters in <http://danlec.com> style links are rendered
HackerOne Cross-site Scripting (XSS) - Generic (CWE-79)
High
2015-02-03
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl440—
Node.js third-party modules307—
GitLab258 $13,950
X / xAI250 $2,500
Uber239 $9,895