目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1000 元

100.0%
请我们喝杯咖啡

漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告
12,219
关联 CVE
1,854
参与项目数
342
近 7 天新增
14
严重度: All CriticalHighMediumLow
类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
项目筛选：nodejs✕
Permission Model Bypass in realpathSync.native Allows File Existence Disclosure
Node.js Information Disclosure (CWE-200)CVE-2026-21715
Low
2026-03-30
CVE-2024-36137 Patch Bypass - FileHandle.chmod/chown
Node.js Improper Access Control - Generic (CWE-284)CVE-2026-21716
Low
2026-03-30
fs.futimes() Bypasses Read-Only Permission Model
Node.js Improper Access Control - Generic (CWE-284)CVE-2025-55132
Low
2026-01-15
Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a string.
Node.js Memory Corruption - Generic (CWE-119)CVE-2025-23165
Low
2025-05-15
Permission model improperly processes UNC paths
Node.js Privilege Escalation (CAPEC-233)CVE-2024-37372
Low
2024-07-15
fs.lstat bypasses permission model
Node.js Privilege Escalation (CAPEC-233)CVE-2024-22018
Low
2024-07-09
fs.fchown/fchmod bypasses permission model
Node.js Improper Access Control - Generic (CWE-284)CVE-2024-36137
Low
2024-07-09
Proxy-Authorization header not cleared on cross-origin redirect in undici.request
Node.js Insufficiently Protected Credentials (CWE-522)CVE-2024-30260
Low
2024-05-03
Proxy-Authorization header is not cleared in cross-domain redirect in undici
Node.js Information Disclosure (CWE-200)CVE-2024-24758
Low
2024-03-12
fs.statfs bypasses Permission Model
Node.js Improper Access Control - Generic (CWE-284)CVE-2023-32005
Low
2023-09-10
fs.mkdtemp() and fs.mkdtempSync() are missing getValidatedPath() checks.
Node.js Path Traversal (CWE-22)CVE-2023-32003
Low
2023-08-11
Regular Expression Denial of Service in Headers
Node.js Uncontrolled Resource Consumption (CWE-400)
Low
2023-03-19
Insecure loading of ICU data through ICU_DATA environment variable
Node.js CVE-2023-23920
Low
2023-03-19
Prototype pollution via console.table properties
Node.js Modification of Assumed-Immutable Data (MAID) (CWE-471)CVE-2022-21824
Low
2022-01-11
Built-in TLS module unexpectedly treats "rejectUnauthorized: undefined" as "rejectUnauthorized: false", disabling all certificate validation
Node.js Improper Certificate Validation (CWE-295)CVE-2021-22939
Low
2021-09-10
Potential HTTP Request Smuggling in nodejs
Node.js HTTP Request Smuggling (CWE-444)CVE-2020-8287
Low
2021-01-07
Slowloris, body parsing
Node.js Uncontrolled Resource Consumption (CWE-400)
Low
2020-10-17
Node.js HTTP/2 Large Settings Frame DoS
Node.js Uncontrolled Resource Consumption (CWE-400)
Low
2020-07-02
高频漏洞类型
最活跃项目
项目报告数最高赏金
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl439—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239 $9,895