HackerOne · disclosed reports
No weakness filed
63 disclosed reports · $39,800 paid
Out of date: the sync last ran 4 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open HackerOne on HackerOne- reports
- 63
- paid a bounty
- 16
Every one of the 63 is a mark on the map. Named now: 1 to 26, most upvoted first.
- WannaCrypt “Killswitch”
- June 2022 Incident Report
- An attacker can archive and unarchive any structured scope object on HackerOne
- Disclosing PolicyPageAssetGroup in Private Programs via /graphql `gid://hackerone/PolicyPageAssetGroupsIndex::PolicyPageAssetGroup/{id}`
- HackerOne making payments in USDC (Coinbase stable coin)
- 2020-10-09 Credential Stuffing Attack
- DOS via Mutation Aliasing in GraphQL Account Recovery Phone Number Verification API
- Hackerone supports accounts organitation takeover
- Banned researcher gets email updates on a private program.
- Disclosure handle private program with external link
- [Bypass #645264] Report title disclosure despite the program settings for email notification is set to "No Content"
- How the Arch Angel stole Live Events
- Subdomain takeover of resources.hackerone.com
- `exportReportPdf` mutation shows internal Activity
- Confirmed #2118458: Intentional redirect from www.hackerone.com to domain which is up for sale
- Triager/Team members can edit hacker's report and hacker is not even notified
- Near to Infinite loop when changing Group's name that has API token as Team Member
- Team object in GraphQL disclosed of private programs via the industry
- The hacker has access to the administrative part of the management reports in publish report
- HTTP Parameter Pollution using semicolons in iframe element at hackerone.com/careers allows loading external Greenhouse forms
- Second-order SOQL injection through email and campaign name parameter in Salesforce lead submission
- Inadequate redaction exposes sensitive information via the “ShareReportViaEmail" GraphQL endpoint
- Real impersonation
- Two factor authentication bypass
- "Bounty splitting enabled" can discloses if public VDPs are running private VRP
- Disclosing a private program in an external link if program is paused
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.