Semrush · disclosed reports
Information Disclosure
5 disclosed reports · $0 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Semrush on HackerOne- reports
- 5
- paid a bounty
- 0
Every one of the 5 is a mark on the map. Named now: 1 to 5, most upvoted first.
- Github information leaked
- OAuth `redirect_uri` bypass using IDN homograph attack resulting in user's access token leakage
- Exposure of service tokens to webpack bundle
- API key (api.semrush.com) leak in JS-file
- php info file and sql backup at vendor's subdomain
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.