Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports

12,219

CVE-linked

1,854

Programs

342

New This Week

Severity: All Critical High Medium Low

Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375

Account Takeover via Authentication Bypass in TikTok Account Recovery

TikTok Authentication Bypass Using an Alternate Path or Channel (CWE-288)

Critical

2024-07-13

Bypassing the victim's phone number OTP in the account recovery process on the https://hackerone.com/settings/auth/setup_account_recovery

HackerOne Improper Authentication - Generic (CWE-287)

Critical

2024-07-11

Subdomain takeover ████████.mil

U.S. Dept Of Defense Improper Access Control - Generic (CWE-284)

Critical

2024-06-27

Local File Disclosure on the █████ (https://████████.edu/) leads to the full source code disclosure and credentials leak

U.S. Dept Of Defense Insecure Storage of Sensitive Information (CWE-922)

Critical

2024-06-27

[Meetup][World ID][OIDC] Insufficient Filtering of "state" Parameter in Response Mode form_post leads to XSS and ATO

Tools for Humanity Cross-Site Scripting (XSS) (CAPEC-63)

Critical

2024-06-19

[HTAF4-213] [Pre-submission] Unsafe AMF deserialization (CVE-2017-5641) in Apache Flex BlazeDS at the https://www.███████/daip/messagebroker/amf

U.S. Dept Of Defense Deserialization of Untrusted Data (CWE-502)CVE-2017-5641

Critical

2024-06-18

Subdomain Takeover via Host Header Injection on www.█████

U.S. Dept Of Defense Violation of Secure Design Principles (CWE-657)

Critical

2024-06-18

Email OTP/2FA Bypass

Drugs.com Improper Authentication - Generic (CWE-287)

Critical

2024-06-16

Insecure Direct Object Reference (IDOR) Allows Viewing Private Report Details via /bugs.json Endpoint

HackerOne Insecure Direct Object Reference (IDOR) (CWE-639)

Critical

2024-05-23

Incorrect Type Conversion in interpreting IPv4-mapped IPv6 addresses and below `curl` results in indeterminate SSRF vulnerabilities.

curl Type Confusion (CWE-843)CVE-2023-24329 CVE-2024-22243

Critical

2024-05-08

Insecure Direct Object Reference Protection bypass by changing HTTP method in IBM Your Learning endpoint.

IBM Insecure Direct Object Reference (IDOR) (CWE-639)

Critical

2024-05-01

Attachment disclosure via summary report

HackerOne Insecure Direct Object Reference (IDOR) (CWE-639)

Critical

2024-04-29

Jira Credential Disclosure within Mozilla Slack

Mozilla Information Disclosure (CWE-200)

Critical

2024-04-23

View any user email using the Team's audit log section

HackerOne Information Disclosure (CWE-200)

Critical

2024-03-26

Creation of bounties through Customer API leads to private email disclosure

HackerOne Information Disclosure (CWE-200)

Critical

2024-03-26

███ leaking PII of tour visitors (names, email addresses, phone numbers) via misconfigured record permissions

U.S. Dept Of Defense Cleartext Storage of Sensitive Information (CWE-312)

Critical

2024-03-22

Attacker can Add itself as admin user and can also change privileges of Existing Users [█████████]

U.S. Dept Of Defense Improper Authentication - Generic (CWE-287)

Critical

2024-03-22

Full Access to sonarQube and Docker

U.S. Dept Of Defense Information Disclosure (CWE-200)

Critical

2024-03-22

IDOR vulnerability reveals additional information

Semrush Insecure Direct Object Reference (IDOR) (CWE-639)

Critical

2024-03-07

Stored XSS on LinkedIn App via iframe tag in Article

LinkedIn Cross-site Scripting (XSS) - Stored (CWE-79)

Critical

2024-02-28

Top Weakness Types

Most Active Programs

Program	Reports	Max $
U.S. Dept Of Defense	896	—
Internet Bug Bounty	817	—
HackerOne	609	—
Nextcloud	582	—
Shopify	464	—
curl	439	—
Node.js third-party modules	307	—
GitLab	258	—
X / xAI	250	$2,500
Uber	239	$9,895

Goal Reached Thanks to every supporter — we hit 100%!

Bug Bounty Intelligence