Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1310 CNY

100%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,250
CVE-linked
1,864
Programs
343
New This Week
6
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 658 Improper Authentication - Generic 653 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Subdomain Takeover due to ████████ NS records at us-east4.37signals.com
Basecamp Information Disclosure (CWE-200)
Medium
2021-09-17
Sensitive data exposure via https://███████/jira//secure/QueryComponent!Default.jspa - CVE-2020-14179
U.S. Dept Of Defense Information Disclosure (CWE-200)CVE-2020-14179
Medium
2021-09-09
Information disclosure -> 2fa bypass -> POST exploitation
Algolia Information Disclosure (CWE-200)
Medium
2021-09-08
Attachment object in GraphQL continues to grant access to files, even if they are removed from rendering
HackerOne Information Disclosure (CWE-200)
Medium
2021-08-24
CUI labled and ████ and ██████ Restricted ██████ intelligence
U.S. Dept Of Defense Information Disclosure (CWE-200)
Medium
2021-08-19
Possible LDAP username and password disclosed on Github
Acronis Information Disclosure (CWE-200)
Medium
2021-08-17
Bypass of privacy filter / tracking pixel blocker
Nextcloud Information Disclosure (CWE-200)CVE-2021-32707
Medium
2021-08-11
Partial report contents leakage - via HTTP/2 concurrent stream handling
HackerOne Information Disclosure (CWE-200)
Medium
2021-08-05
Private application files can be uploaded to Slack via malicious uploader
Slack Information Disclosure (CWE-200)
Medium
2021-08-04
Multiple server ssh usernames leaked in your github repository
Ian Dunn Information Disclosure (CWE-200)
Medium
2021-07-19
Exposed Prometheus instance at prometheus.qa.r3.com
R3 Information Disclosure (CWE-200)
Medium
2021-07-12
Elmah.axd is publicly accessible leaking Error Log
U.S. Dept Of Defense Information Disclosure (CWE-200)
Medium
2021-06-15
CVE-2019-3403 on https://████/rest/api/2/user/picker?query=
U.S. Dept Of Defense Information Disclosure (CWE-200)CVE-2019-3403
Medium
2021-06-03
CVE-2021-22898: TELNET stack contents disclosure
curl Information Disclosure (CWE-200)CVE-2021-22898
Medium
2021-05-26
private passenger information is exposed to the Uber Driver app during ride dispatch ("Ping") events
Uber Information Disclosure (CWE-200)
Medium
2021-05-14
Members Personal Information Leak Due to IDOR
U.S. Dept Of Defense Information Disclosure (CWE-200)
Medium
2021-05-11
[h1-2102] [Yaworski's Broskis] Low privilege user can read POS PINs via graphql and elevate his privilege
Shopify Information Disclosure (CWE-200)
Medium
2021-04-08
HTML Injection in Swing can disclose netNTLM hash or cause DoS
PortSwigger Web Security Information Disclosure (CWE-200)CVE-2021-29416
Medium
2021-03-29
Bumble API exposes read status of chat messages
Bumble Information Disclosure (CWE-200)
Medium
2021-03-13
stack trace exposed on https://receipts.uber.com/
Uber Information Disclosure (CWE-200)
Medium
2021-02-25
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817 $2,257
HackerOne609—
Nextcloud584—
Shopify464—
curl459—
Node.js third-party modules307—
GitLab258—
X / xAI250 $7,000
Uber239—