Tor · disclosed reports
Memory Corruption
17 disclosed reports · $300 paid
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Tor on HackerOne- reports
- 17
- paid a bounty
- 1
Every one of the 17 is a mark on the map. Named now: 1 to 17, most upvoted first.
- Conflux-queued zero-length RELAY_END triggers heap out-of-bounds read
- Zip bomb
- Use of unitialized value in crypto_pk_num_bits (src/common/crypto.c:971)
- Use-after-free during XML transformations (MFSA-2016-27)
- solving TOR vulnerability, in other to make bruteforce difficult
- [tor] libevent dns OOB read
- potential memory corruption in or/buffers.c (particularly on 32 bit)
- Heap corruption via memarea.c
- Overreads/overcopies in torsocks
- libevent (stack) buffer overflow in evutil_parse_sockaddr_port
- [tor] libevent dns remote stack overread vulnerability
- smartlist_add, smartlist_insert (may) cause heap corruption as a result of inadequate checks in smartlist_ensure_capacity
- Use of unitialized value in token_check_object (src/or/parsecommon.c:224)
- Use of uninitialized value in networkstatus_parse_vote_from_string (src/or/routerparse.c:3533)
- Use of uninitialized value in memarea_strdup (src/common/memarea.c:369)
- Stack overflow in UnbindFromTree (browser can be crashed remotely)
- Crashes/Buffer at 0x2C0086,name=PBrowser::Msg_Destroy
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.