Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1310 CNY

100%
Buy Us a Coffee

Bug Bounty Intelligence

Source: HackerOne public disclosures · updated every 6h

Browse publicly disclosed bug bounty reports from HackerOne. Filter by severity, weakness type, or program. Cross-referenced with CVE IDs where available.

Disclosed Reports
12,262
CVE-linked
1,866
Programs
343
New This Week
0
Severity: All CriticalHighMediumLow
Type: All Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 658 Improper Authentication - Generic 654 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
Disclosure of h1 challenges name through the calendar
HackerOne Information Disclosure (CWE-200)
Low
2019-01-30
Disclosure of information about the system, configuration files.
Smule Information Disclosure (CWE-200)
Low
2019-01-03
Exposure of tinyMCE js source code with plugin version disclosure which can leads to exploit further attacks.
RATELIMITED Information Disclosure (CWE-200)
Low
2018-12-29
Information disclosure
HackerOne Information Disclosure (CWE-200)
Low
2018-12-27
Timing attack towards endpoints on the web without CSRF
HackerOne Information Disclosure (CWE-200)
Low
2018-12-27
information disclosure which leak the apache version
RATELIMITED Information Disclosure (CWE-200)
Low
2018-12-11
Inline banner on Report page discloses whether organization runs a private program
HackerOne Information Disclosure (CWE-200)
Low
2018-12-11
Full path disclosure on track.uber.com
Uber Information Disclosure (CWE-200)
Low
2018-11-20
PII disclosure -- Past team members & their email ID(personal email) can be viewed by Staff member with no permissions on Partner Dashboard
Shopify Information Disclosure (CWE-200)
Low
2018-11-08
Disclosure of top 10 vulnerability types for programs that haven't enabled the Insights feature
HackerOne Information Disclosure (CWE-200)
Low
2018-11-07
Password protected rooms total number of viewers disclosure to unauthorized members
Chaturbate Information Disclosure (CWE-200)
Low
2018-09-24
Phishing user to download malicious app could lead to leakage of User Access Token, Email, Name and Profile photo via exported RemoteService
Eternal Information Disclosure (CWE-200)
Low
2018-09-11
Open port leads to information disclosure
Weblate Information Disclosure (CWE-200)
Low
2018-09-10
Internal usage of AdBlockPlus may expose PoC URLs to unknown third-parties
HackerOne Information Disclosure (CWE-200)
Low
2018-08-17
Basic auth details is still work on report ( 351555 )
Reverb.com Information Disclosure (CWE-200)
Low
2018-08-09
TeamProfile exposes partially sensitive information through GraphQL
HackerOne Information Disclosure (CWE-200)
Low
2018-08-08
Просмотр приватных видео записей у Пользователей
VK.com Information Disclosure (CWE-200)
Low
2018-07-06
People who interviewed for HackerOne security analyst position can be enumerated and their personal email address may be exposed
HackerOne Information Disclosure (CWE-200)
Low
2018-06-25
Disclosed Version of PORTS SSH|HTTP|SSL
Nextcloud Information Disclosure (CWE-200)
Low
2018-06-14
Leak of Platform Authentication credentials via Repeater
PortSwigger Web Security Information Disclosure (CWE-200)
Low
2018-06-13
Top Weakness Types
Most Active Programs
ProgramReportsMax $
U.S. Dept Of Defense896—
Internet Bug Bounty817 $2,257
HackerOne609—
Nextcloud584—
Shopify465—
curl464—
Node.js third-party modules307—
GitLab258—
X / xAI250 $7,000
Uber239—