weakness in Injection and Smuggling
HTTP Request Smuggling
68 disclosed reports · $88,790 paid
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
- reports
- 68
- paid a bounty
- 23
Every one of the 68 is a mark on the map. Named now: 1 to 26, most upvoted first.
- Bypass for #488147 enables stored XSS on https://paypal.com/signin again
- Mass account takeovers using HTTP Request Smuggling on https://slackb.com/ to steal session cookies
- Stored XSS on https://paypal.com/signin via cache poisoning
- Request smuggling on admin-official.line.me could lead to account takeover
- Stealing Zomato X-Access-Token: in Bulk using HTTP Request Smuggling on api.zomato.com
- Password theft login.newrelic.com via Request Smuggling
- HTTP Request Smuggling via HTTP/2
- HTTP request Smuggling
- HTTP Request Smuggling on https://labs.data.gov
- HTTP Request Smuggling at app.workbox.dk
- HTTP Request Smuggling due to CR-to-Hyphen conversion
- HTTP Request Smuggling on vpn.lob.com
- Improper HTTP header block termination in llhttp
- HTTP Request Smuggling in Transform Rules using hexadecimal escape sequences in the concat() function
- HTTP request smuggling using malformed Transfer-Encoding header
- Possibility of Request smuggling attack
- Pause-based desync in Apache HTTPD
- HTTP SMUGGLING EXPOSED HMAC/DOS
- CVE-2024-21733 Apache Tomcat HTTP Request Smuggling (Client- Side Desync) (CWE: 444)
- Potential HTTP Request Smuggling in ruby webrick
- Request Smuggling in Apache Tomcat (Important, CVE-2023-45648)
- HTTP Request Smuggling via Connection: close<TAB> in Node.js llhttp parser
- HTTP request smuggling with Origin Rules using newlines in the host_header action parameter
- HTTP Request Smuggling
- Potential HTTP Request Smuggling in nodejs
- Improper Input Validation — HTTP Response Parser Unconditionally Accepts Bare CR in Status Line
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.