Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,219
CVE-linked
1,854
Programs
342
New This Week
14
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Program filter: ibb✕
Proxy-Authorization header is not cleared in cross-domain redirect in undici
Internet Bug Bounty Information Disclosure (CWE-200)CVE-2024-24758
Low
2024-03-12
Apache Airflow: Bypass permission verification to read code of other dags
Internet Bug Bounty Improper Access Control - Generic (CWE-284)
Low
2024-03-12
http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks
Internet Bug Bounty Uncontrolled Resource Consumption (CWE-400)CVE-2024-22019
High
2024-03-05
Command Injection using malicious hostname in expanded proxycommand
Internet Bug Bounty Code Injection (CWE-94)CVE-2023-6004
Low
2024-02-28
Request Smuggling in Apache Tomcat (Important, CVE-2023-45648)
Internet Bug Bounty HTTP Request Smuggling (CWE-444)CVE-2023-45648
High
2024-02-07
CVE-2024-21733 Apache Tomcat HTTP Request Smuggling (Client- Side Desync) (CWE: 444)
Internet Bug Bounty HTTP Request Smuggling (CWE-444)CVE-2024-21733
High
2024-01-29
Argo CD CSRF leads to Kubernetes cluster compromise
Internet Bug Bounty Cross-Site Request Forgery (CSRF) (CWE-352)
High
2024-01-29
Pickle deserialization vulnerability in XComs
Internet Bug Bounty Deserialization of Untrusted Data (CWE-502)
Low
2024-01-29
curl HSTS long file name clears contents
Internet Bug Bounty Missing Encryption of Sensitive Data (CWE-311)
Low
2024-01-20
ASAR Integrity bypass via filetype confusion
Internet Bug Bounty CVE-2023-44402
Medium
2024-01-20
Cookie headers are not cleared in cross-domain redirect in undici-fetch
Internet Bug Bounty Information Disclosure (CWE-200)CVE-2023-45143
Low
2024-01-20
Path traversal through path stored in Uint8Array in Node.js 20
Internet Bug Bounty Path Traversal (CWE-22)CVE-2023-39332
High
2024-01-20
CVE-2023-49920: Apache Airflow: Missing CSRF protection on DAG/trigger
Internet Bug Bounty Cross-Site Request Forgery (CSRF) (CWE-352)CVE-2023-49920
Medium
2024-01-09
Possibility of Request smuggling attack
Internet Bug Bounty HTTP Request Smuggling (CWE-444)
High
2023-12-22
curl cookie mixed case PSL bypass
Internet Bug Bounty Information Exposure Through Sent Data (CWE-201)CVE-2023-46218
Medium
2023-12-22
OpenSSL vulnerable to the Marvin Attack (CVE-2022-4304)
Internet Bug Bounty Information Exposure Through Timing Discrepancy (CWE-208)CVE-2022-4304
Medium
2023-12-21
Misconfiguration in AWS CloudFront CDN configuration makes rubygems.org serve (and cache) content from a unclaimed S3-bucket
Internet Bug Bounty Misconfiguration (CWE-16)
Medium
2023-12-07
Integrity checks according to policies can be circumvented in Node.js 20 and Node.js 18
Internet Bug Bounty Insufficient Verification of Data Authenticity (CWE-345)CVE-2023-38552
Medium
2023-11-30
Permission model improperly protects against path traversal in Node.js 20
Internet Bug Bounty Path Traversal (CWE-22)CVE-2023-39331
High
2023-11-30
Permissions policies can be bypassed via Module._load and require.extensions (High) (CVE-2023-30587)
Internet Bug Bounty Improper Access Control - Generic (CWE-284)CVE-2023-32002
High
2023-11-30
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl439—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239 $9,895