Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,225
CVE-linked
1,856
Programs
342
New This Week
6
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
CVE-2017-13040 The MPTCP parser in tcpdump before 4.9.2 has a buffer over-read in print-mptcp.c, several functions.
Internet Bug Bounty Buffer Over-read (CWE-126)CVE-2017-13040
High
2021-07-09
CVE-2017-13041 The ICMPv6 parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp6.c:icmp6_nodeinfo_print().
Internet Bug Bounty Buffer Over-read (CWE-126)CVE-2017-13041
High
2021-07-09
Cache Posioning leading do Denial of Service on `www.█████████`
U.S. Dept Of Defense Uncontrolled Resource Consumption (CWE-400)
High
2021-07-09
API on campus-vtc.com allows access to ~100 Uber users full names, email addresses and telephone numbers.
Uber Information Disclosure (CWE-200)
High
2021-07-08
Bypass the fix of report #1078283 due to poor validation
Khan Academy Open Redirect (CWE-601)
High
2021-07-08
DNS Leaks when using any VPN Browser extension with Brave Shield enabled
Brave Software Information Disclosure (CWE-200)CVE-2021-22916
High
2021-07-08
Slack integration setup lacks CSRF protection
HackerOne Cross-Site Request Forgery (CSRF) (CWE-352)
High
2021-07-07
IDOR while uploading ████ attachments at [█████████]
U.S. Dept Of Defense Insecure Direct Object Reference (IDOR) (CWE-639)
High
2021-06-30
Post-Auth Stored XSS with User Interaction leads to Remote Code Execution
Rocket.Chat Cross-site Scripting (XSS) - Stored (CWE-79)
High
2021-06-30
Responsible Disclosure of Privacy Leakage Issue
GitLab Privacy Violation (CWE-359)
High
2021-06-29
Server-side Template Injection in lodash.js
Node.js third-party modules Code Injection (CWE-94)
High
2021-06-28
Prototype Pollution Vulnerability in noble Package
Node.js third-party modules
High
2021-06-28
Bypass of SSRF Vulnerability
Node.js third-party modules Server-Side Request Forgery (SSRF) (CWE-918)
High
2021-06-28
Subdomain takeover of v.zego.com
Zego Externally Controlled Reference to a Resource in Another Sphere (CWE-610)
High
2021-06-26
Firebase Database Takeover in Zego Sense Android app
Zego Improper Authentication - Generic (CWE-287)
High
2021-06-23
SQL injection on admin.acronis.host development web service
Acronis SQL Injection (CWE-89)
High
2021-06-22
Brave Browser Tor Window leaks user's real IP to the external DNS server
Brave Software Information Disclosure (CWE-200)CVE-2021-22917
High
2021-06-17
Denial of service via cache poisoning on https://www.data.gov/
GSA Bounty
High
2021-06-15
XML Injection / External Service Interaction (HTTP/DNS) On https://█████████.mil
U.S. Dept Of Defense XML Injection (CWE-91)
High
2021-06-15
Cross-origin resource sharing misconfig | steal user information
UPchieve Information Disclosure (CWE-200)
High
2021-06-15
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud583—
Shopify464—
curl442—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239—