weakness in Memory Corruption
Array Index Underflow
16 disclosed reports · $12,000 paid · 12 valid · 1 informative · 2 N/A
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
- reports
- 16
- valid
- 12
- paid a bounty
- 4
Every one of the 16 is a mark on the map. Named now: 1 to 16, most upvoted first.
- Unchecked weapon id in WeaponList message parser on client leads to RCE
- Subdomain Takeover Via Insecure CloudFront Distribution cdn.grab.com
- V1Plugin.Decrypt panics on empty ciphertext (Remote DoS)
- Signedness issue in ClassInfo message handler leads to RCE on CS:GO client
- HackerOne
- V2Plugin.Decrypt panics on empty ciphertext (Remote DoS)
- i am The bug
- Take over subdomain undici.nodejs.org.cdn.cloudflare.net
- bypass old password with array in /admin/account-user-email.php
- wallet-rpc describe_transfer uses real_output_in_tx_index instead of real_output: cold-wallet pre-sign review shows wrong ring member
- https://publishers.basicattentiontoken.org/favicon.ico is Vulnerable to CVE-2017-7529
- Array Index Underflow--http rpc
- solving TOR vulnerability, in other to make bruteforce difficult
- Your page has 2 blocking CSS resources. This causes a delay in rendering your page.
- https://██████ vulnerable to CVE-2020-3187 - Unauthenticated arbitrary file deletion in Cisco ASA/FTD
- memory corruption while parsing HTTP response
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.