目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1325 元

100%
请我们喝杯咖啡

漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告
12,262
关联 CVE
1,866
参与项目数
343
近 7 天新增
0
严重度: All CriticalHighMediumLow
类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 658 Improper Authentication - Generic 654 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
项目筛选：curl✕
Mentioned unites are at the same time .Then we have to increase the bounty.
curl Forced Browsing (CWE-425)
None
2026-06-01
TLS conn reuse and session cache ignore fsslctx callback and ssl_config_data flags ( incomplete fix variant of 7541ae569 )
curl Insufficiently Protected Credentials (CWE-522)
High
2026-06-01
lib/ldap.c follows attacker-controlled LDAP referrals and binds to a second server; WinLDAP builds leak current logon credentials (confirmed on Window
curl Insufficiently Protected Credentials (CWE-522)
Medium
2026-06-01
Use-after-free in `curl_easy_duphandle()` with HTTP/2 stream-dependency tree
curl Use After Free (CWE-416)
None
2026-06-01
Low priority HSTS bypass in curl_easy_duphandle()
curl Information Exposure Through Sent Data (CWE-201)
Low
2026-06-01
Heap-OOB read in urlapi `redirect_url()` via `CURLU_GUESS_SCHEME` + `CURLU_NO_GUESS_SCHEME` flow
curl Buffer Over-read (CWE-126)
Unknown
2026-05-25
curl GnuTLS backend accepts a clientAuth-only certificate for HTTPS server authentication
curl Improper Certificate Validation (CWE-295)
Medium
2026-05-25
curl --skip-existing has a TOCTOU race that lets a post-check symlink redirect the later download write
curl Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
Medium
2026-05-20
Credentials forwarded to HTTP after HTTPS→HTTP same-port redirect — url_set_data_creds uses scheme-blind comparator
curl CVE-2022-27774CVE-2024-11053
None
2026-05-20
HTTP/3 paused transfer buffers incoming data without bound up to ~1 GiB
curl Allocation of Resources Without Limits or Throttling (CWE-770)
Unknown
2026-05-19
Schannel custom-CA path skips Extended Key Usage enforcement
curl Business Logic Errors (CWE-840)
Unknown
2026-05-19
Connection reuse ignores haproxyprotocol and HAPROXY_CLIENT_IP settings, allowing PROXY context to persist across transfers
curl Incorrect Authorization (CWE-863)CVE-2026-4873CVE-2026-5545CVE-2026-5773CVE-2026-6429CVE-2026-6253CVE-2026-7168CVE-2026-3784CVE-2026-3805
None
2026-05-19
SSL session-cache peer key omits signature_algorithms: strict-sigalg handle silently resumes a permissive sibling's session
curl Improper Certificate Validation (CWE-295)CVE-2020-8231
Unknown
2026-05-19
CURLOPT_PROXY_CAINFO_BLOB silently activates native CA store on Apple builds
curl Business Logic Errors (CWE-840)
None
2026-05-19
TLS peer-verification bypass via mid-transfer ssl_config mutation
curl Business Logic Errors (CWE-840)
Unknown
2026-05-19
TLS verifyhost bypass in rustls, mbedTLS, and wolfSSL when verifypeer=0
curl Business Logic Errors (CWE-840)CVE-2013-4545CVE-2014-0139
Unknown
2026-05-19
HTTP/2 proxy CONNECT tunnel unbounded 1xx chain (missing Curl_bump_headersize cap in cf-h2-proxy.c)
curl Allocation of Resources Without Limits or Throttling (CWE-770)CVE-2023-38039
None
2026-05-19
CURLOPT_HSTS_CTRL disables shared HSTS without share guard — use-after-free and double-free
curl Use After Free (CWE-416)CVE-2018-16840CVE-2023-27537
Unknown
2026-05-18
cookie: case-insensitive path comparison in replace_existing() allows cookie eviction across distinct paths
curl Business Logic Errors (CWE-840)
Unknown
2026-05-18
libssh SFTP initialization ignores CURLOPT_TIMEOUT, hangs indefinitely
curl Allocation of Resources Without Limits or Throttling (CWE-770)
Unknown
2026-05-18
高频漏洞类型
最活跃项目
项目报告数最高赏金
U.S. Dept Of Defense896—
Internet Bug Bounty817 $2,257
HackerOne609—
Nextcloud584—
Shopify465—
curl464—
Node.js third-party modules307—
GitLab258—
X / xAI250 $7,000
Uber239—