Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,219
CVE-linked
1,854
Programs
342
New This Week
10
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
[Grab Android/iOS] Insecure deeplink leads to sensitive information disclosure
Grab Cross-site Scripting (XSS) - Generic (CWE-79)
High
2019-03-15
POST-based XSS on apps.shopify.com
Shopify Cross-site Scripting (XSS) - Generic (CWE-79)
Low
2019-03-14
[buttle] Unsafe rendering of Markdown files
Node.js third-party modules Cross-site Scripting (XSS) - Generic (CWE-79)
Low
2019-01-06
Cross-Domain JavaScript Source File Inclusion
RubyGems Cross-site Scripting (XSS) - Generic (CWE-79)
Low
2018-12-10
Cross site scripting (content-sniffing)
Khan Academy Cross-site Scripting (XSS) - Generic (CWE-79)
Medium
2018-12-08
Cross Site Scripting
GoCD Cross-site Scripting (XSS) - Generic (CWE-79)
Unknown
2018-11-30
Reflected XSS
GoCD Cross-site Scripting (XSS) - Generic (CWE-79)
Unknown
2018-11-30
XSS in http://localhost:8153/go/admin/config/server/update
GoCD Cross-site Scripting (XSS) - Generic (CWE-79)
Unknown
2018-11-30
XSS [flow] - on www.paypal.com/paypalme/my/landing (requires user interaction)
PayPal Cross-site Scripting (XSS) - Generic (CWE-79)
Medium
2018-11-06
[Android] HTML Injection in BatterySaveArticleRenderer WebView
Brave Software Cross-site Scripting (XSS) - Generic (CWE-79)
High
2018-10-22
XSS on partners.uber.com due to no user input sanitisation
Uber Cross-site Scripting (XSS) - Generic (CWE-79)
Low
2018-10-04
POST XSS in https://www.khanacademy.org.tr/ via page_search_query parameter
Khan Academy Cross-site Scripting (XSS) - Generic (CWE-79)
Medium
2018-09-18
Reflected XSS
Informatica Cross-site Scripting (XSS) - Generic (CWE-79)
Medium
2018-09-09
Account Takeover in Periscope TV
X / xAI Cross-site Scripting (XSS) - Generic (CWE-79)
High
2018-09-06
[exceljs] Possible XSS via cell value when worksheet is displayed in browser
Node.js third-party modules Cross-site Scripting (XSS) - Generic (CWE-79)CVE-2018-16459
Medium
2018-09-01
HTML injection with AutoComplete suggestions
Nextcloud Cross-site Scripting (XSS) - Generic (CWE-79)CVE-2018-3781CVE-2018-3780
None
2018-08-10
Content spoofing and potential Cross-Site Scripting vulnerability on www.hackerone.com
HackerOne Cross-site Scripting (XSS) - Generic (CWE-79)
Medium
2018-08-04
[statics-server] XSS via injected iframe in file name when statics-server displays directory index in the browser
Node.js third-party modules Cross-site Scripting (XSS) - Generic (CWE-79)CVE-2018-3771
Medium
2018-07-14
XSS in express-useragent through HTTP User-Agent
Node.js third-party modules Cross-site Scripting (XSS) - Generic (CWE-79)CVE-2018-9863
Unknown
2018-07-06
[html-pages] Stored XSS in the filename when directories listing
Node.js third-party modules Cross-site Scripting (XSS) - Generic (CWE-79)CVE-2018-16481
High
2018-06-12
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl439—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239 $9,895