HackerOne · disclosed reports
Misconfiguration and Insecure Design
76 disclosed reports · $24,600 paid · 76 valid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open HackerOne on HackerOne- reports
- 76
- valid
- 76
- paid a bounty
- 20
Every one of the 76 is a mark on the map. Named now: 1 to 26, most upvoted first.
- Internal Access to Hackerone confluence Docs
- Indexing of urls on the "External link warning" pages discloses many vulnerable endpoints from the past and unlisted videos/photos
- Account creation with invalid email addresses / email is accepting % and %0d%0a line termination chars
- Hacker.One Subdomain Takeover
- Stealing contact form data on www.hackerone.com using Marketo Forms XSS with postMessage frame-jumping and jQuery-JSONP
- Recently added 'Country' field doesn't send email notification when changed
- Password not checked when disabling 2FA on HackerOne
- Domain highlighting on External link warning is not working on Chrome & Microsoft Edge browsers on Mobile
- Bypass rate limiting on /users/password (possibly site-wide rate limit bypass?)
- Homograph fix Bypass
- Parameter pollution in social sharing buttons
- Invalid Host detection at https://hackerone.com/redirect
- Register & create a ticket as somebody else on HackerOne Support
- 2M Reports on HackerOne Celebration! - Ability to bulk-submit many reports.
- Missing SPF for hackerone.com
- Content Security Policy not applied to error pages at multiple HackerOne endpoints
- Google Analytics could be used as CSP bypass for data exfiltration on hackerone.com
- Private program email forwarding response invitation not expire after first use.
- Ability to bulk submit reports via query named based batching
- Common response suggestion is sent to Google Analytics when user accepts duplicate comment Genius suggestion
- HackerOne Integrations Design Issue
- Updating payout preference to CurrencyCloud doesn't notify user via email
- CSRF at [Apply to this program] that lead to submit your request automatic with out any validations
- Email spoofing
- Report redaction doesn't apply to report title update activities
- HTML injection can lead to data theft
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.