Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,219
CVE-linked
1,854
Programs
342
New This Week
10
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Program filter: gitlab✕
Subdomain takeover in Gitlab pages
GitLab Misconfiguration (CWE-16)
Low
2024-10-09
HTML injection possible with soft email confirmations when Administrator manually confirms attacker email address
GitLab Resource Injection (CWE-99)
Low
2024-10-08
Remove obsolete domain from handbook subdomain
GitLab Misconfiguration (CWE-16)
Low
2024-10-01
Information Disclosure - Pvt Gitlab Issue Disclosing Through GitLab Unfiltered YouTube channel.
GitLab Information Disclosure (CWE-200)
Low
2023-09-13
Arbitrary escape sequence injection in docker-machine from worker nodes
GitLab Command Injection - Generic (CWE-77)
Low
2023-06-02
Domain Takeover - gl-canary.freetls.fastly.net
GitLab Privilege Escalation (CAPEC-233)
Low
2023-05-30
Path paths and file disclosure vulnerabilities at influxdb.quality.gitlab.net
GitLab Information Disclosure (CWE-200)
Low
2022-11-04
Guest Users can create issues for Sentry errors and track their status
GitLab Improper Access Control - Generic (CWE-284)
Low
2021-09-24
A profile page of a user can be denied from loading by appending .html to the username
GitLab Violation of Secure Design Principles (CWE-657)
Low
2021-08-30
[information disclosure] Validate existence of a private project.
GitLab Information Disclosure (CWE-200)
Low
2021-03-09
View the Starred Projects in a Private Profile
GitLab Insecure Direct Object Reference (IDOR) (CWE-639)
Low
2021-02-02
[Admin Panel] CSRF to resume/pause runner
GitLab Cross-Site Request Forgery (CSRF) (CWE-352)CVE-2020-13350
Low
2020-12-01
Guest users can change the confidentiality attribute on those issues that have been assigned to them
GitLab Improper Access Control - Generic (CWE-284)
Low
2020-11-09
Instant open redirect on Live preview WEB Ide opening
GitLab Open Redirect (CWE-601)
Low
2020-11-04
Possibilty to purchase Ultimate - 1 Year (EDU or OSS)
GitLab Business Logic Errors (CWE-840)
Low
2020-11-02
EXIF metadata not stripped from JPG group logos
GitLab Information Disclosure (CWE-200)
Low
2020-09-08
No redirect_uri in the db for web-internal clientKey leads to one-click DoS on gitter.im
GitLab Uncontrolled Resource Consumption (CWE-400)
Low
2020-05-15
Double linking cause XSS (but blokeced by CSP in gitlab.com)
GitLab Cross-site Scripting (XSS) - DOM (CWE-79)
Low
2020-01-20
Head pipeline leaked to unauthorized users via blocking merge request feature
GitLab Improper Access Control - Generic (CWE-284)CVE-2019-15580
Low
2019-12-13
Private System Note Disclosure using GraphQL
GitLab Information Disclosure (CWE-200)CVE-2019-15576
Low
2019-12-13
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud582—
Shopify464—
curl439—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239 $9,895