weakness in Access Control
Forced Browsing
14 disclosed reports · $810 paid
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
- reports
- 14
- paid a bounty
- 2
Every one of the 14 is a mark on the map. Named now: 1 to 14, most upvoted first.
- IP restriction bypass via X-Forwarded-For header
- URL Scheme Validation Bypass in Shopify Mobile App Allows Javascript Execution
- One Click Account Hijacking via Unvalidated Deeplink
- View HackerOne challenge scope before challenge begins
- 403 Forbidden Bypass at www.██████.mil
- Remote 0click exfiltration of Safari user's IP address
- Wrong link on corne.maximum.nl
- Mentioned unites are at the same time .Then we have to increase the bounty.
- Improper deep link validation
- [Android org.torproject.android] Possible to force list of bridges
- Potential server misconfiguration leads to disclosure of vendor/ directory
- Direct URL access to PDF files
- 200 http code in 403 forbidden directories on main Ubnt.com domain
- Bypass MFA requirement to send messages
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.