Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,219
CVE-linked
1,854
Programs
342
New This Week
10
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Memory leak in gem decode logic can allow attacker to take down Rubygems.org application
RubyGems Uncontrolled Resource Consumption (CWE-400)
Medium
2026-04-09
TLS PSK/ALPN Callback Exceptions Bypass Error Handlers, Causing DoS and FD Leak
Node.js Uncontrolled Resource Consumption (CWE-400)CVE-2026-21637
Medium
2026-02-12
Memory leak that enables remote Denial of Service against applications processing TLS client certificates
Node.js Uncontrolled Resource Consumption (CWE-400)CVE-2025-59464
Medium
2026-02-12
Unbounded memory consumption via compressed HTTP responses (gzip/brotli/zstd)
curl Uncontrolled Resource Consumption (CWE-400)
Medium
2025-12-21
Crafted smart contract can take 1.5 minutes to execute due to inefficient CODESIZE implementation
Rootstock Labs Uncontrolled Resource Consumption (CWE-400)
Medium
2025-06-12
Crafted smart contract can take ~23 seconds to execute due to immense error string construction
Rootstock Labs Uncontrolled Resource Consumption (CWE-400)
Medium
2025-06-12
RPC service DOS
Monero Uncontrolled Resource Consumption (CWE-400)
Medium
2025-05-23
[CVE-2025-27219] Denial of Service in CGI::Cookie.parse
Internet Bug Bounty Uncontrolled Resource Consumption (CWE-400)CVE-2025-27219
Medium
2025-04-27
Possible DoS by memory exhaustion in net/imap
Internet Bug Bounty Uncontrolled Resource Consumption (CWE-400)
Medium
2025-04-27
Possible ReDoS vulnerability in query parameter filtering in Action Dispatch
Internet Bug Bounty Uncontrolled Resource Consumption (CWE-400)CVE-2024-41128
Medium
2025-03-07
Uncontrolled Resource Consumption when parsing maliciously crafted XML with REXML
Ruby Uncontrolled Resource Consumption (CWE-400)CVE-2024-43398
Medium
2025-02-20
GOAWAY HTTP/2 frames cause memory leak outside heap
Node.js Uncontrolled Resource Consumption (CWE-400)CVE-2025-23085
Medium
2025-02-06
CVE-2024-49761: ReDoS vulnerability in REXML
Internet Bug Bounty Uncontrolled Resource Consumption (CWE-400)CVE-2024-49761
Medium
2024-11-30
DOS: taking down a 1k users Gitlab EE instance or multiple Sidekiq instances by importing a malicious repo from a Github EE self-hosted server
GitLab Uncontrolled Resource Consumption (CWE-400)
Medium
2024-10-09
ReDoS due to device-detector parsing user agents
GitLab Uncontrolled Resource Consumption (CWE-400)
Medium
2024-10-08
CVE-2024-41989: Denial-Of-Service vulnerability in the floatformat template filter when input string contains a big exponent in scientific notation
Internet Bug Bounty Uncontrolled Resource Consumption (CWE-400)CVE-2024-41989
Medium
2024-09-22
CVE-2024-38875: Denial-Of-Service through uncontrolled resource consumption caused by poor time complexity of strip_punctuation .
Internet Bug Bounty Uncontrolled Resource Consumption (CWE-400)CVE-2024-38875
Medium
2024-08-23
CVE-2024-27351: Potential regular expression denial-of-service in django.utils.text.Truncator.words()
Internet Bug Bounty Uncontrolled Resource Consumption (CWE-400)CVE-2024-27351
Medium
2024-04-28
Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames
Internet Bug Bounty Uncontrolled Resource Consumption (CWE-400)CVE-2024-27316
Medium
2024-04-24
HTTP/2 PUSH_PROMISE DoS
curl Uncontrolled Resource Consumption (CWE-400)
Medium
2024-03-27
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl439—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239 $9,895