Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,217
CVE-linked
1,854
Programs
342
New This Week
12
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Program filter: portswigger✕
Out of scope: Improper Input Validation Order on /api-internal/login via password field leads to unnecessary resource consumption
PortSwigger Web Security
Low
2026-05-05
HTML Injection in DAST Trial Request Form Confirmation Email – PortSwigger
PortSwigger Web Security
Low
2026-02-26
The role "CI-driven scan initiator" provides excessive read access
PortSwigger Web Security Privilege Escalation (CAPEC-233)
Low
2026-01-02
DNS Rebinding SSRF in Burp Suite MCP Server Enables Internal Network Access via send_http1_request Tool
PortSwigger Web Security Server-Side Request Forgery (SSRF) (CWE-918)
None
2025-10-08
cgi scripts wordlist entry for windmail.exe has payload that sends arbitrary file read result to third-party
PortSwigger Web Security Information Disclosure (CWE-200)
Low
2025-03-13
Burp Suite extensions can execute arbitrary code
PortSwigger Web Security
High
2025-02-26
A user with only [MODIFY_SETTINGS] permmision could takeover any user accounts
PortSwigger Web Security Improper Access Control - Generic (CWE-284)
Low
2024-05-20
Changing the administrator password via admin console does not invalidate other sessions
PortSwigger Web Security Improper Authentication - Generic (CWE-287)
Low
2024-05-20
Incorrect logic when buy one more license which may lead to extend the expire date of existing license
PortSwigger Web Security Business Logic Errors (CWE-840)
Unknown
2024-04-16
[portswigger.net] Path Traversal al /cms/audioitems
PortSwigger Web Security Path Traversal (CWE-22)
High
2024-04-04
CSP Bypass and escalation of https://hackerone.com/reports/2279346
PortSwigger Web Security Business Logic Errors (CWE-840)
High
2024-02-23
CSP bypass on PortSwigger.net using Google script resources
PortSwigger Web Security Cross-site Scripting (XSS) - Reflected (CWE-79)
Medium
2024-02-18
Title: Deceptive Manipulation of HTTP to HTTPS with VPN in Burp Suite
PortSwigger Web Security Cleartext Transmission of Sensitive Information (CWE-319)
Medium
2023-10-31
RCE of Burp Scanner / Crawler via Clickjacking
PortSwigger Web Security Command Injection - Generic (CWE-77)
High
2023-10-10
Business Logic, currency arbitrage - Possibility to pay less than the price in USD
PortSwigger Web Security Business Logic Errors (CWE-840)
Medium
2022-10-26
Redirection in Repeater & Intruder Tab
PortSwigger Web Security Open Redirect (CWE-601)CVE-2022-35406
Low
2022-08-11
Information disclosure on error message
PortSwigger Web Security Information Exposure Through an Error Message (CWE-209)
Low
2021-11-15
No Rate Limit On Regenerate Password on Portswigger
PortSwigger Web Security
None
2021-09-13
RCE in 'Copy as Node Request' BApp via code injection
PortSwigger Web Security Code Injection (CWE-94)
None
2021-04-22
HTML Injection in Swing can disclose netNTLM hash or cause DoS
PortSwigger Web Security Information Disclosure (CWE-200)CVE-2021-29416
Medium
2021-03-29
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl439—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239 $9,895