目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告
12,262
关联 CVE
1,866
参与项目数
343
近 7 天新增
0
严重度: All Critical High Medium Low
类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 658 Improper Authentication - Generic 654 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Reported RPC Overflow
Monero Integer Overflow (CWE-190)
Unknown
2026-04-06
# SCURLOPT_SSH_KNOWNHOSTS and host fingerprint pins are silently bypassed when an SSH connection is reused from the connection pool
curl Exposed Dangerous Method or Function (CWE-749)
Unknown
2026-04-06
SMTP Command Injection via CRLF in libcurl MAIL_FROM / MAIL_RCPT (lib/smtp.c)
curl CRLF Injection (CWE-93)
Unknown
2026-04-06
ignoring 'options' when doing connection reuse
curl Incorrect Comparison (CWE-697)
Unknown
2026-04-05
Data race in Curl_dnscache_add_negative() corrupts shared DNS cache — heap corruption and double-free when using CURLOPT_SHARE with CURL_LOCK_DATA_DNS
curl Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (CWE-362)
Medium
2026-04-04
Internal application wrapper or script using curl
curl Code Injection (CWE-94)
Critical
2026-04-03
Missing server identity policy enforcement in SSH connection reuse allows host key verification bypass via pool poisoning
curl Authentication Bypass by Primary Weakness (CWE-305) CVE-2022-27782 CVE-2023-27538
High
2026-04-03
Cookie attribute TAB injection regression in Set-Cookie parsing
curl Improper Input Validation (CWE-20) CVE-2022-35252
Low
2026-04-03
Bypassing Strict SSH Server Verification via Connection Pool Reuse in libcurl
curl
Unknown
2026-03-31
Use-After-Free race condition in url_move_hostname() via shared connection pool
curl Use After Free (CWE-416)
Medium
2026-03-31
Unauthenticated SSRF via Public Reference API -Sharing Token Bypass
Nextcloud
Unknown
2026-03-31
HackerOne Vulnerability Report: libcurl SSL/TLS Identity Leakage via Insecure Connection Reuse
curl Authentication Bypass by Primary Weakness (CWE-305)
Unknown
2026-03-31
HTTP/2 PUSH_PROMISE header loss on OOM bypasses scheme validation (regression of 2e8c922a89)
curl Improper Handling of Insufficient Permissions or Privileges (CWE-280)
Medium
2026-03-31
Unbounded GZIP Decompression Leading to Event-Loop Starvation
curl Improper Handling of Highly Compressed Data (Data Amplification) (CWE-409)
Medium
2026-03-31
SSRF Filter Bypass via Unblocked NAT64 Local-Use IPv6 Prefix (64:ff9b:1::/48)
arkadiyt-projects Server-Side Request Forgery (SSRF) (CWE-918)
High
2026-03-31
Path Traversal in writeFile via Unsafe Prefix Containment Check Allows Out-of-Directory Writes
arkadiyt-projects Path Traversal (CWE-22)
Medium
2026-03-31
HashDoS in V8
Node.js Cryptographic Issues - Generic (CWE-310) CVE-2026-21717
Medium
2026-03-30
Permission Model Bypass in realpathSync.native Allows File Existence Disclosure
Node.js Information Disclosure (CWE-200) CVE-2026-21715
Low
2026-03-30
Timing side-channel in HMAC verification via memcmp() in crypto_hmac.cc leads to potential MAC forgery
Node.js Cryptographic Issues - Generic (CWE-310) CVE-2026-21713
Medium
2026-03-30
Node.js Permission Model bypass: UDS server bind/listen works without `--allow-net`
Node.js Improper Access Control - Generic (CWE-284) CVE-2026-21711
Medium
2026-03-30
高频漏洞类型
最活跃项目
项目 报告数 最高赏金
U.S. Dept Of Defense 896 —
Internet Bug Bounty 817 $2,257
HackerOne 609 —
Nextcloud 584 —
Shopify 465 —
curl 464 —
Node.js third-party modules 307 —
GitLab 258 —
X / xAI 250 —
Uber 239 —