Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,222
CVE-linked
1,855
Programs
342
New This Week
3
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 656 Improper Authentication - Generic 652 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
ASP.NET Application Trace Enabled
U.S. Dept Of Defense Information Exposure Through Debug Information (CWE-215)
High
2026-01-12
Exposure of Sensitive Debug File Containing database dump with passwords in plain text
U.S. Dept Of Defense Information Disclosure (CWE-200)
High
2026-01-12
SQL Injection - JSON 'name' parameter
U.S. Dept Of Defense SQL Injection (CWE-89)
High
2026-01-12
XML E██████ternal Entity (XXE) Injection in ███
U.S. Dept Of Defense XML External Entities (XXE) (CWE-611)CVE-2022-2414
High
2026-01-12
SQL Injection in URI Path Leading to Full Database Disclosure on ████████
U.S. Dept Of Defense SQL Injection (CWE-89)
High
2026-01-12
SQL Injection via URL
U.S. Dept Of Defense SQL Injection (CWE-89)
High
2026-01-12
SQL Injection - data[account][id] parameter
U.S. Dept Of Defense SQL Injection (CWE-89)
High
2026-01-12
Unauthenticated File Read Adobe ColdFusion
U.S. Dept Of Defense Improper Access Control - Generic (CWE-284)CVE-2023-26360
High
2026-01-12
Secret Access Key of AWS Firehose Disclosure
U.S. Dept Of Defense Information Disclosure (CWE-200)
High
2026-01-12
Heap Out-of-Bounds Read in lib/http2.c via Malformed PUSH_PROMISE Headers
curl Out-of-bounds Read (CWE-125)
High
2026-01-10
Stack Buffer Overflow in mprintf.c formatting function (fallback path)
curl Classic Buffer Overflow (CWE-120)
High
2026-01-08
Path Traversal in curl file:// Protocol Handler Allows Unauthorized File Access
curl Path Traversal (CWE-22)CVE-2021-22901
High
2026-01-04
Alt-Svc bypasses credential leak protection (CVE-2018-1000007)
curl Information Exposure Through Sent Data (CWE-201)CVE-2018-1000007
High
2026-01-04
PROTOCOL-LEVEL: Persistent UDP Amplification and Cache Poisoning via Alt-Svc Logic Flaw
curl Business Logic Errors (CWE-840)
High
2026-01-02
HTTP Request Smuggling and SSRF via CRLF Injection in Curl_add_custom_headers
curl HTTP Request Smuggling (CWE-444)
High
2026-01-02
MQTT Protocol Violation & Integer Overflow in libcurl
curl Integer Overflow (CWE-190)
High
2026-01-01
Proxy-Authorization header is leaked to origin server after redirect from proxied to direct connection
curl Information Exposure Through Sent Data (CWE-201)
High
2025-12-30
Heap Buffer Over-read in lib/http2.c (on_header) handling PUSH_PROMISE frames
curl Buffer Over-read (CWE-126)
High
2025-12-28
Protocol Smuggling / CRLF Injection via Gopher Protocol allows Arbitrary Command Injection
curl CRLF Injection (CWE-93)
High
2025-12-25
HAProxy Connection Reuse leads to IP Spoofing and mTLS Context Smuggling
curl Improper Access Control - Generic (CWE-284)
High
2025-12-23
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817—
HackerOne609—
Nextcloud583—
Shopify464—
curl440—
Node.js third-party modules307—
GitLab258—
X / xAI250 $2,500
Uber239—