Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1020 CNY

100%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,242
CVE-linked
1,863
Programs
343
New This Week
22
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 657 Improper Authentication - Generic 653 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Content-Injection/XSS ████
U.S. Dept Of Defense Information Disclosure (CWE-200)
Medium
2019-12-02
Critical information disclosure at https://█████████
U.S. Dept Of Defense Information Disclosure (CWE-200)
Medium
2019-12-02
Open FTP on ███
U.S. Dept Of Defense Information Disclosure (CWE-200)
Medium
2019-12-02
Disclosure of `payment_transactions` for programs via GraphQL query
HackerOne Information Disclosure (CWE-200)
Medium
2019-12-01
Kaspersky Password Manager allows websites to access user's address data
Kaspersky Information Disclosure (CWE-200)
Medium
2019-11-24
Information disclosure on sim.starbucks.com
Starbucks Information Disclosure (CWE-200)CVE-2019-3403CVE-2019-8442
Low
2019-11-13
Incorrect logic in MySQL & MariaDB protocol leads to remote SSRF/Remote file read
Internet Bug Bounty Information Disclosure (CWE-200)
Unknown
2019-11-12
Malicious Server can force read any file on clients system with default configuration in MySQL Clients
Internet Bug Bounty Information Disclosure (CWE-200)
Unknown
2019-11-12
LFI through the MySQL connection
Infogram Information Disclosure (CWE-200)
High
2019-11-12
User credentials leak and arbitrary local file read/leak due to same-origin-policy violation
Internet Bug Bounty Information Disclosure (CWE-200)
Unknown
2019-11-12
Username Enumeration
Nextcloud Information Disclosure (CWE-200)
Low
2019-11-11
WordPress Plugin Insert or Embed Articulate Content into WordPress Remote Code Execution (UNAUTHORIZED)
Nextcloud Information Disclosure (CWE-200)
Low
2019-11-11
latest_activity_id and latest_activity_at may disclose information about internal activities to unauthorized users
HackerOne Information Disclosure (CWE-200)
Low
2019-11-10
Searching from Hacktivity returns hits for words in limited disclosure reports that are not visible
HackerOne Information Disclosure (CWE-200)
Medium
2019-11-08
Shopify's SF and LA offices Dashboard Information disclosed via Public Gist
Shopify Information Disclosure (CWE-200)
Unknown
2019-11-06
Access MoPub Reports Data even after Company removed you from their MoPub Account.
X / xAI Information Disclosure (CWE-200)
High
2019-11-05
H1514 Extract information about other sites (new sites) through Affiliate/Referral pages
Shopify Information Disclosure (CWE-200)
Medium
2019-11-04
H1514 Get access to non public information by pivoting with graphql queries
Shopify Information Disclosure (CWE-200)
Low
2019-11-03
Lack of CSRF header validation at https://g-mail.grammarly.com/profile
Superhuman (formerly Grammarly) Information Disclosure (CWE-200)
Medium
2019-10-31
Private program disclosure via `vpn_suspended` GraphQL query
HackerOne Information Disclosure (CWE-200)
None
2019-10-21
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817 $2,257
HackerOne609 $1,500
Nextcloud583—
Shopify464—
curl455—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239—