目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告
12,262
关联 CVE
1,866
参与项目数
343
近 7 天新增
0
严重度: All Critical High Medium Low
类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 658 Improper Authentication - Generic 654 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
项目筛选：curl ✕
CVE-2025-15079: libssh global knownhost override
curl Improper Validation of Certificate with Host Mismatch (CWE-297) CVE-2025-15079
Low
2026-01-07
CVE-2025-15224: libssh key passphrase bypass without agent set
curl CVE-2025-15224
Low
2026-01-07
MQTT: Missing upper bound on incoming Remaining Length allows server-controlled long wait
curl Uncontrolled Resource Consumption (CWE-400)
Low
2026-01-06
Telnet Suboption Buffer Pointer Underflow in lib/telnet.c leads to Out-of-Bounds Read
curl Buffer Under-read (CWE-127)
Low
2025-12-29
Security hardening: missing integer overflow check in curl_load_library()
curl Integer Overflow (CWE-190)
Low
2025-12-27
Integer Overflow in `curl_easy_escape()` may lead to heap buffer overflow and stack memory disclosure on 32-bit platforms
curl Integer Overflow (CWE-190)
Low
2025-12-25
Functional Regression in Digest Authentication: Failure to handle optional spaces and escaped quotes
curl Improper Input Validation (CWE-20)
Low
2025-12-21
A logic error in detect_proxy caused truncation of environment variable names for long protocol schemes.
curl Business Logic Errors (CWE-840)
Low
2025-12-21
Terminal Output Not Great
curl Improper Neutralization of Escape, Meta, or Control Sequences (CWE-150)
Low
2025-12-11
Arbitrary free in curl's config file parsing.
curl
Low
2025-11-23
Incorrect sizeof() in Rustls Backend Memory Allocation
curl Incorrect Calculation of Buffer Size (CWE-131)
Low
2025-11-15
CVE-2025-10966: missing SFTP host verification with wolfSSH
curl Improper Certificate Validation (CWE-295) CVE-2025-10966
Low
2025-11-05
Memory leak in Curl_auth_create_ntlm_type3_message
curl Uncontrolled Resource Consumption (CWE-400)
Low
2025-10-28
libcurl MQTT PUBLISH length overflow (heap overflow)
curl Heap Overflow (CWE-122)
Low
2025-10-28
OpenSSL backend: X509 peer certificate not freed in ossl_get_channel_binding causes per-request memory leak (DoS risk for long-lived clients)
curl Uncontrolled Resource Consumption (CWE-400)
Low
2025-10-08
Inconsistent URL Parsing in curl Leading to Potential SSRF and Access Control Bypass
curl Improper Input Validation (CWE-20)
Low
2025-09-26
int overflow in krb5_read_data() leads to (possible) massive `recv()` write
curl Integer Overflow (CWE-190)
Low
2025-09-18
CVE-2025-9086: Out of bounds read for cookie path
curl Buffer Over-read (CWE-126) CVE-2025-9086
Low
2025-09-10
CVE-2025-10148: predictable WebSocket mask
curl Reusing a Nonce, Key Pair in Encryption (CWE-323) CVE-2025-10148
Low
2025-09-10
Security check up
curl Allocation of Resources Without Limits or Throttling (CWE-770)
Low
2025-07-24
高频漏洞类型
最活跃项目
项目 报告数 最高赏金
U.S. Dept Of Defense 896 —
Internet Bug Bounty 817 $2,257
HackerOne 609 —
Nextcloud 584 —
Shopify 465 —
curl 464 —
Node.js third-party modules 307 —
GitLab 258 —
X / xAI 250 —
Uber 239 —