Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1020 CNY

100%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,244
CVE-linked
1,864
Programs
343
New This Week
23
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 657 Improper Authentication - Generic 653 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
EXIF Geolocation Data Not Stripped From Uploaded Images
Hiro Information Disclosure (CWE-200)
Low
2019-09-03
Last build status and coverage leaked to unauthorized users
GitLab Information Disclosure (CWE-200)CVE-2019-5463
Low
2019-09-01
Option method enabled in kartpay Webservers
Kartpay Information Disclosure (CWE-200)
Low
2019-08-28
Program Email Nofication settings ignored when being added as an external contributor
HackerOne Information Disclosure (CWE-200)
Low
2019-08-07
Information disclosure (system username, server info) in the x-amz-meta-s3cmd-attrs response header on data.gov
GSA Bounty Information Disclosure (CWE-200)
Low
2019-08-06
Disclosure of 152 cookie names via crafted input
Automattic Information Disclosure (CWE-200)
Low
2019-08-04
Total bounties paid amount is disclosed because of redesign of the Program Profiles
HackerOne Information Disclosure (CWE-200)
Low
2019-08-02
Root user disclosure in data.gov domain though x-amz-meta-s3cmd-attrs header
GSA Bounty Information Disclosure (CWE-200)
Low
2019-07-29
Extremly simple way to bypass Nextcloud-Client PIN/Fingerprint lock
Nextcloud Information Disclosure (CWE-200)CVE-2019-5453
Low
2019-07-26
Private/confidential setting of calendar events is ignored on activity stream
Nextcloud Information Disclosure (CWE-200)
Low
2019-06-27
PHPinfo page
Starbucks Information Disclosure (CWE-200)
Low
2019-06-12
Просмотр инфы на странице пользователя или группы который тебя добавил в ЧС
VK.com Information Disclosure (CWE-200)
Low
2019-05-10
[affiliates.udemy.com] Wordpress user admin information discloure
Udemy Information Disclosure (CWE-200)
Low
2019-04-28
Emails of invited collaborators are disclosed in full in payload for report participants
HackerOne Information Disclosure (CWE-200)
Low
2019-04-09
Invited team member can disclosure slack channels
HackerOne Information Disclosure (CWE-200)
Low
2019-04-05
Using GraphQL, STAFF with NO explicit permissions on Store can retrieve Shopify Payments Balance.
Shopify Information Disclosure (CWE-200)
Low
2019-04-04
credentials leakage in public lead to view dev websites
Eternal Information Disclosure (CWE-200)
Low
2019-03-18
Snippet JS template allows attacker to read a user's private snippets
GitLab Information Disclosure (CWE-200)
Low
2019-03-03
Users able to set video url for unpublished words and able to see the name of unpublished words
Urban Dictionary Information Disclosure (CWE-200)
Low
2019-03-02
report id is exposed for undisclosed reports in Hacktivity
HackerOne Information Disclosure (CWE-200)
Low
2019-02-16
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817 $2,257
HackerOne609—
Nextcloud583—
Shopify464—
curl457—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239—