Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,217
CVE-linked
1,854
Programs
342
New This Week
12
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Program filter: nodejs-ecosystem✕
[dy-server2] - stored Cross-Site Scripting
Node.js third-party modules Cross-site Scripting (XSS) - Stored (CWE-79)
Medium
2021-01-14
Default behavior of Fastifys versioned routes can be used for cache poisoning when Fastify is used in combination with a http cache / CDN
Node.js third-party modules HTTP Request Smuggling (CWE-444)CVE-2020-7764
Medium
2020-12-10
[node-downloader-helper] Path traversal via Content-Disposition header
Node.js third-party modules Path Traversal (CWE-22)
Medium
2020-11-11
[expressjs-ip-control] Whitelist IP bypass leads to authorization bypass and sensitive info disclosure
Node.js third-party modules Information Disclosure (CWE-200)
Medium
2020-10-29
[ts-dot-prop] Prototype Pollution
Node.js third-party modules
Medium
2020-10-29
[nested-property] Prototype Pollution
Node.js third-party modules Modification of Assumed-Immutable Data (MAID) (CWE-471)
Medium
2020-10-27
[http-live-simulator] Application-level DoS
Node.js third-party modules Uncontrolled Resource Consumption (CWE-400)
Medium
2020-10-27
[freespace] Command Injection due to Lack of Sanitization
Node.js third-party modules Command Injection - Generic (CWE-77)
Medium
2020-10-14
[snekserve] Stored XSS via filenames HTML formatted
Node.js third-party modules Cross-site Scripting (XSS) - Stored (CWE-79)
Medium
2020-09-24
[commit-msg] RCE via insecure command formatting
Node.js third-party modules Code Injection (CWE-94)
Medium
2020-09-24
[gity] RCE via insecure command formatting
Node.js third-party modules Code Injection (CWE-94)
Medium
2020-09-24
[git-lib] RCE via insecure command formatting
Node.js third-party modules Code Injection (CWE-94)
Medium
2020-09-24
[@knutkirkhorn/free-space] - Command Injection through Lack of Sanitization
Node.js third-party modules Command Injection - Generic (CWE-77)
Medium
2020-09-18
Prototype pollution attack (lodash)
Node.js third-party modules Uncontrolled Resource Consumption (CWE-400)
Medium
2020-08-25
Arbitrary code execution via untrusted schemas in is-my-json-valid
Node.js third-party modules Code Injection (CWE-94)
Medium
2020-07-31
Fastify uses allErrors: true ajv configuration by default which is susceptible to DoS
Node.js third-party modules Uncontrolled Resource Consumption (CWE-400)CVE-2020-8192
Medium
2020-07-29
[express-cart] Wide CSRF in application
Node.js third-party modules Cross-Site Request Forgery (CSRF) (CWE-352)
Medium
2020-07-21
[crypto-js] Insecure entropy source - Math.random()
Node.js third-party modules Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CWE-338)
Medium
2020-06-04
OS Command Injection on Jison [all-parser-ports]
Node.js third-party modules OS Command Injection (CWE-78)CVE-2020-8178
Medium
2020-05-28
Pixel flood attack cause the javascript heap out of memory
Node.js third-party modules Uncontrolled Resource Consumption (CWE-400)CVE-2020-8175
Medium
2020-05-21
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl439—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239 $9,895