Coinbase · disclosed reports
No weakness filed
17 disclosed reports · $400 paid
Out of date: the sync last ran 5 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Coinbase on HackerOne- reports
- 17
- paid a bounty
- 3
Every one of the 17 is a mark on the map. Named now: 1 to 17, most upvoted first.
- HTML injection in apps user review
- [buy.coinbase.com]Content Injection
- Race condition allowing user to review app multiple times
- Information disclosure same issue #176002
- XXE in OAuth2 Applications gallery profile App logo
- Window.opener bug at www.coinbase.com
- Balance Manipulation - BUG
- Credit Card Validation Issue
- IFRAME loaded from External Domains
- Cookie missing the HttpOnly flag
- User provided values trusted in sensitive actions
- New Device Confirmation Bug
- Transaction Pending Via Ip Change
- Cookie not secure
- Inaccurate Payment receipt
- Big Bug with Vault which i have already reported: Case #606962
- Device confirmation Flaw
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.