HackerOne · disclosed reports
Misconfiguration and Insecure Design
92 disclosed reports · $24,600 paid · 76 valid · 12 informative · 2 duplicate · 2 N/A
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open HackerOne on HackerOne- reports
- 92
- valid
- 76
- paid a bounty
- 20
Every one of the 92 is a mark on the map. Named now: 53 to 78, most upvoted first.
- New hacktivity view discloses report IDs of non-public reports
- Reflected File Download
- GraphQL sessions aren't immediately invalidated when user password is changed
- Reputation Manipulation (Theoretical)
- Anti-MIME-Sniffing header X-Content-Type-Options header has not been set.
- Increase number of bugs by sending duplicate of your own valid report
- Insecure Direct Object Reference vulnerability
- Logic Issue with Reputation: Boost Reputation Points
- Adding an user email address to the list before confirming.
- Autocomplete enabled in Paypal preferences
- Accepting Invalid characters on email address
- CSV injection in the credentials export
- Multiple issues with Markdown and URL parsing
- Signals get affected once reports closed as self
- profile cover can also load external URL's
- Auto Approval of Invitation to join Team as a Team member
- Enumeration/Guess of Private (Invited) Programs
- Flooding mailbox of user
- Securing sensitive pages from SearchBots
- mailto: link injection on https://hackerone.com/directory
- Content Spoofing - External Link Warning Page
- Homograph attack
- Add text to the title of the page "Thanks"
- HTTPS is not enforced for objects stored by HackerOne on Amazon S3
- Issue with password change
- Spamming any user from Reset Password Function
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.