Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,219
CVE-linked
1,854
Programs
342
New This Week
10
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
CSRF leads to Account takeover
U.S. Dept Of Defense Cross-Site Request Forgery (CSRF) (CWE-352)
High
2024-12-18
CSRF leads to Account takeover
U.S. Dept Of Defense Cross-Site Request Forgery (CSRF) (CWE-352)
High
2024-12-18
CSRF Attack on changing security questions leads to full Account TakeOver
U.S. Dept Of Defense Cross-Site Request Forgery (CSRF) (CWE-352)
High
2024-12-18
Argo CD CSRF leads to Kubernetes cluster compromise
Internet Bug Bounty Cross-Site Request Forgery (CSRF) (CWE-352)
High
2024-01-29
Cross-Site Request Forgery
ownCloud Cross-Site Request Forgery (CSRF) (CWE-352)
High
2023-11-05
Improper CSRF token validation allows attackers to access victim's accounts linked to Hackerone
HackerOne Cross-Site Request Forgery (CSRF) (CWE-352)
High
2023-06-19
CSRF to delete accounts [HtUS]
U.S. Dept Of Defense Cross-Site Request Forgery (CSRF) (CWE-352)
High
2023-05-15
CSRF to ATO at https://█████/user/account [HtUS]
U.S. Dept Of Defense Cross-Site Request Forgery (CSRF) (CWE-352)
High
2023-01-06
CSRF Account Takeover
TikTok Cross-Site Request Forgery (CSRF) (CWE-352)
High
2022-08-16
CSRF protection bypass in GitHub Enterprise management console
GitHub Cross-Site Request Forgery (CSRF) (CWE-352)CVE-2022-23732
High
2022-04-13
0-day Cross Origin Request Forgery vulnerability in Grafana 8.x .
Aiven Ltd Cross-Site Request Forgery (CSRF) (CWE-352)CVE-2022-21703
High
2022-03-16
Widespread CSRF on authenticated POST endpoints
UPchieve Cross-Site Request Forgery (CSRF) (CWE-352)
High
2022-02-13
CSRF in Account Deletion feature (https://www.flickr.com/account/delete)
Flickr Cross-Site Request Forgery (CSRF) (CWE-352)
High
2021-09-14
CSRF on /api/graphql allows executing mutations through GET requests
GitLab Cross-Site Request Forgery (CSRF) (CWE-352)
High
2021-08-02
Slack integration setup lacks CSRF protection
HackerOne Cross-Site Request Forgery (CSRF) (CWE-352)
High
2021-07-07
Japan - CSRF in webapp.starbucks.co.jp with user interaction could leak an access token if the user was not using Chrome
Starbucks Cross-Site Request Forgery (CSRF) (CWE-352)
High
2021-05-18
SocialClub Account Take Over Through Import Friends feature
Rockstar Games Cross-Site Request Forgery (CSRF) (CWE-352)
High
2021-04-01
[socket.io] Cross-Site Websocket Hijacking
Node.js third-party modules Cross-Site Request Forgery (CSRF) (CWE-352)
High
2021-01-31
███████mill is vulnerable to cross site request forgery that leads to full account take over.
U.S. Dept Of Defense Cross-Site Request Forgery (CSRF) (CWE-352)
High
2021-01-25
[CSRF] TikTok Careers Portal Account Takeover
TikTok Cross-Site Request Forgery (CSRF) (CWE-352)
High
2020-12-15
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl439—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239 $9,895