目標達成 すべての支援者に感謝 — 100%達成しました！

目標: 1000 CNY · 調達済み: 1336 CNY

100%
コーヒーを一杯おごる

漏洞赏金情报

数据来源：HackerOne 公开披露报告 · 每 6 小时更新

浏览 HackerOne 平台公开披露的漏洞赏金报告，按严重程度、漏洞类型或目标项目筛选，关联 CVE 编号。

已披露报告
12,262
关联 CVE
1,866
参与项目数
343
近 7 天新增
0
严重度: All CriticalHighMediumLow
类型: 全部 Information Disclosure 1173 Cross-site Scripting (XSS) … 747 Violation of Secure Design … 719 Improper Access Control - Generic 658 Improper Authentication - Generic 654 Cross-site Scripting (XSS) … 513 Uncontrolled Resource Consumption 483 Cross-site Scripting (XSS) … 461 Cross-Site Request Forgery (CSRF) 421 Privilege Escalation 375
项目筛选：cloudflare✕
AI Playground XSS to steal user-chat messages and access to connected MCP Server
Cloudflare Public Bug Bounty Cross-site Scripting (XSS) - Reflected (CWE-79)
Low
2026-02-26
Second-Order XSS via javascript protocol in MCP Server Portal Apps leads to ATO
Cloudflare Public Bug Bounty Cross-site Scripting (XSS) - Stored (CWE-79)
Low
2025-12-16
YAML schema injection risk in Swagger UI via schema_url parameter at developers.cloudflare.com
Cloudflare Public Bug Bounty Resource Injection (CWE-99)
Low
2023-11-10
💥💥Crash report -Cloudflare WARP doesn't verify text length in "Excluded Host" name input data💥💥
Cloudflare Public Bug Bounty Memory Corruption - Generic (CWE-119)
Low
2023-07-31
Privilege escalation to root in Pages build image v2
Cloudflare Public Bug Bounty Privilege Escalation (CAPEC-233)
Low
2023-05-26
Bypassing creation of API tokens without email verification
Cloudflare Public Bug Bounty Improper Authentication - Generic (CWE-287)
Low
2023-03-27
cd=false (DNSSEC) not respected in DNS over HTTPS JSON requests
Cloudflare Public Bug Bounty Business Logic Errors (CWE-840)
Low
2022-12-12
Misconfigured build on websites "abuse.cloudflare.com"
Cloudflare Public Bug Bounty
Low
2022-10-13
Bypass two-factor authentication
Cloudflare Public Bug Bounty Improper Authentication - Generic (CWE-287)
Low
2022-10-04
Password Policy Restriction Bypass
Cloudflare Public Bug Bounty Violation of Secure Design Principles (CWE-657)
Low
2022-09-30
Blind SSRF on platform.dash.cloudflare.com Due to Sentry misconfiguration
Cloudflare Public Bug Bounty Server-Side Request Forgery (SSRF) (CWE-918)
Low
2022-08-31
Sign in with Apple generates long-life JWTs, seemingly irrevocable, that grant immediate access to accounts
Cloudflare Public Bug Bounty Improper Authentication - Generic (CWE-287)
Low
2022-06-27
高频漏洞类型
最活跃项目
项目报告数最高赏金
U.S. Dept Of Defense896—
Internet Bug Bounty817 $2,257
HackerOne609—
Nextcloud584—
Shopify465—
curl464—
Node.js third-party modules307—
GitLab258—
X / xAI250—
Uber239—