HackerOne · disclosed reports
Denial of Service
26 disclosed reports · $6,350 paid
Out of date: the sync last ran 4 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open HackerOne on HackerOne- reports
- 26
- paid a bounty
- 6
Every one of the 26 is a mark on the map. Named now: 1 to 26, most upvoted first.
- profile-picture name parameter with large value lead to DoS for other users and programs on the platform
- Denial of service via cache poisoning
- Static files on HackerOne.com can be made inaccessible through Cache Poisoning attack
- Uploading large payload on domain instructions causes server-side DoS
- ActiveStorage throws exception when using whitespace as filename, may lead to denial of service of multiple pages
- Attacker with an Old account might still be able to DoS ctf.hacker101.com by sending a Crafted request
- Denial Of Service (Out Of Memory) on Updating Bounty Table [Urgent]
- Pixel flood attack
- GIF flooding
- Hogging up all the resources on hackerone.com
- The possibility of disrupting the normal operation of frontend using markdown
- Unicorn worker pool exhaustion by continuously updating payout preferences
- Attacker may be able to bounce enough emails which suspend HackerOne's SES service and cause a DoS of HackerOne's email service
- Lack of length validation on user address attribute
- PNG compression DoS
- DOS Report FILE html inside <code> in markdown
- Denial of Service any Report
- Making any Report Failed to load
- attack in not an authorized user
- Potential denial of service in hackerone.com/<program>/reward_settings
- URL Crashing browser. {Tested on firefox, Chrome and Safari}
- Putting link inside link in markdown
- Breaking Bugs as team member
- Denial of Service
- Potential denial of service in hackerone.com/teams/new
- Denial of service in report view.
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.