Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1110 CNY

100%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,247
CVE-linked
1,864
Programs
343
New This Week
25
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 658 Improper Authentication - Generic 653 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Access to requests and approvals via /█████ allows sensitive information gathering
U.S. Dept Of Defense Information Disclosure (CWE-200)
High
2021-02-18
PII Leak via /██████
U.S. Dept Of Defense Information Disclosure (CWE-200)
High
2021-02-18
PII Leak via /████████
U.S. Dept Of Defense Information Disclosure (CWE-200)
High
2021-02-18
PII Leak via /███████
U.S. Dept Of Defense Information Disclosure (CWE-200)
High
2021-02-18
Dashboard sharing enables code injection into ████ emails
U.S. Dept Of Defense Code Injection (CWE-94)
High
2021-02-18
Arbitrary file upload and stored XSS via ███ support request
U.S. Dept Of Defense Violation of Secure Design Principles (CWE-657)
High
2021-02-18
Support incident can be opened for any user via /███████ and PII leak via █████████ field
U.S. Dept Of Defense Improper Access Control - Generic (CWE-284)
High
2021-02-18
Improper Access Controls Allow PII Leak via ████
U.S. Dept Of Defense Privacy Violation (CWE-359)
High
2021-02-18
Stored XSS in wordpress.com
Automattic Cross-site Scripting (XSS) - Stored (CWE-79)
High
2021-02-17
Administrative access to development deployment of web service due to auto-filled credentials
Acronis Improper Authentication - Generic (CWE-287)
High
2021-02-16
Found multiple SAP NetWeaver vulnerable services
Acronis CVE-2020-6286CVE-2020-6287
High
2021-02-16
External SSRF and Local File Read via video upload due to vulnerable FFmpeg HLS processing
TikTok Server-Side Request Forgery (SSRF) (CWE-918)
High
2021-02-15
DNS Misconfiguration (Subdomain Takeover) ███.wavecell.com
8x8 Privilege Escalation (CAPEC-233)
High
2021-02-15
Stored XSS in Intense Debate comment system
Automattic Cross-site Scripting (XSS) - Stored (CWE-79)
High
2021-02-14
Camera adoption DoS - UniFi Protect
Ubiquiti Inc. Uncontrolled Resource Consumption (CWE-400)CVE-2021-22882
High
2021-02-12
DNS Misconfiguration (Subdomain Takeover) ███████.8x8.com
8x8 Privilege Escalation (CAPEC-233)
High
2021-02-12
Password authentication when changing information bypass. Bypass of report #721341
Khan Academy Unverified Password Change (CWE-620)
High
2021-02-11
Lack of rate limitation on careers site allows the attacker to brute force the verification code
TikTok Improper Restriction of Authentication Attempts (CWE-307)
High
2021-02-11
Stored XSS via 64(?) vulnerable fields in ███ leads to credential theft/account takeover
U.S. Dept Of Defense Cross-site Scripting (XSS) - Stored (CWE-79)
High
2021-02-10
Insecure ███████ credentials on staging app at ████ leads to application takeover
U.S. Dept Of Defense Insufficiently Protected Credentials (CWE-522)
High
2021-02-10
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817 $2,257
HackerOne609—
Nextcloud584—
Shopify464—
curl457—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239—