Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,232
CVE-linked
1,859
Programs
342
New This Week
13
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 657 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Unexpected access to process open files via file:///proc/self/fd/n
curl Information Disclosure (CWE-200)
High
2021-02-08
Github Account hijack through broken link in developer.twitter.com
X / xAI Phishing (CAPEC-98)
High
2021-02-04
Stored XSS at https://www.█████████.mil
U.S. Dept Of Defense Cross-site Scripting (XSS) - Stored (CWE-79)
High
2021-02-01
Unauthenticated access to webmail at maildev.happytools.dev leading to compromised wordpress site api.happytools.dev [RCE]
Automattic Information Disclosure (CWE-200)
High
2021-02-01
[socket.io] Cross-Site Websocket Hijacking
Node.js third-party modules Cross-Site Request Forgery (CSRF) (CWE-352)
High
2021-01-31
nextcloud-snap CircleCI project has vulnerable configuration which can lead to exposing secrets
Nextcloud Insufficiently Protected Credentials (CWE-522)
High
2021-01-29
Denial of Service by requesting to reset a password
Nextcloud Uncontrolled Resource Consumption (CWE-400)CVE-2020-8295
High
2021-01-25
███████mill is vulnerable to cross site request forgery that leads to full account take over.
U.S. Dept Of Defense Cross-Site Request Forgery (CSRF) (CWE-352)
High
2021-01-25
Blind stored XSS due to insecure contact form at https://█████.mil leads to leakage of session token and
U.S. Dept Of Defense Cross-site Scripting (XSS) - Stored (CWE-79)
High
2021-01-25
Able to use 'PREMIUM TEMPLATES' in 'FREE PLAN' at [https://my.stripo.email/cabinet/#/my-templates/]
Stripo Inc Business Logic Errors (CWE-840)
High
2021-01-25
[intensedebate.com] No Rate Limit On The report Functionality Lead To Delete Any Comment When it is enabled
Automattic Business Logic Errors (CWE-840)
High
2021-01-23
Misconfiguration of Merchant id in jwt header + Weird Debug mode enabling behavior leads to exposed OTP of mobile number.
Kartpay Improper Authentication - Generic (CWE-287)
High
2021-01-20
Public and secret api key leaked in JavaScript source
Top Echelon Software Improper Access Control - Generic (CWE-284)
High
2021-01-19
Route53 Subdomain Takeover on test-cncf-aws.canary.k8s.io
Kubernetes Misconfiguration (CWE-16)
High
2021-01-16
Subdomain Takeover due to unclaimed domain pointing to Acquia Cloud
Insulet Corporation Misconfiguration (CWE-16)
High
2021-01-14
SQL Injection in www.██████████
U.S. Dept Of Defense SQL Injection (CWE-89)
High
2021-01-12
Local File Disclosure on the ████████ (https://████/) leads to the source code disclosure & DB credentials leak
U.S. Dept Of Defense Information Disclosure (CWE-200)
High
2021-01-12
SSRF in login page using fetch API exposes victims IP address to attacker controled server
U.S. Dept Of Defense Server-Side Request Forgery (SSRF) (CWE-918)
High
2021-01-12
Able to log in with default ██████g creds at https█████████████████████.mil
U.S. Dept Of Defense Information Exposure Through an Error Message (CWE-209)
High
2021-01-12
Able to authenticate as administrator by navigating to https://█████/admin/
U.S. Dept Of Defense Improper Authentication - Generic (CWE-287)
High
2021-01-12
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817 $2,257
HackerOne609—
Nextcloud583—
Shopify464—
curl447—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239—