U.S. Dept Of Defense · disclosed reports
Misconfiguration and Insecure Design
28 disclosed reports · $1,000 paid · 23 valid · 5 not checked yet
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open U.S. Dept Of Defense on HackerOne- reports
- 28
- valid
- 23
- paid a bounty
- 1
Every one of the 28 is a mark on the map. Named now: 1 to 26, most upvoted first.
- Wordpress Takeover using setup configuration at http://████.edu [HtUS]
- Exposure of Private Personal Information to an Unauthorized Actor - PII and soldier data (mos, schools, and speciality training)
- Subdomain takeover ██████
- Web Cache Poisoning on █████
- Subdomain Takeover via Host Header Injection on www.█████
- Video player on ███ allows arbitrary remote videos to be played
- Unauthenticated arbitrary file upload on the https://█████/ (█████████)
- Account Takeover via Unverified Email Change and Improper Session Handling
- [█████] Bug Reports allow for Unrestricted File Upload
- Expired SSL Certificate allows credentials steal
- No Rate Limiting on https://██████/██████████/accounts/password/reset/ endpoint leads to Denial of Service
- [U.S. Air Force] Information disclosure due unauthenticated access to APIs and system browser functions
- Unauthenticated arbitrary file upload on the https://█████/ (█████.mil)
- xmlrpc.php file enabled at ██████.org
- Found Origin IP's Lead To Access ████
- Unrestricted File Upload to ███████SubmitRequest/Index.cfm?fwa=wizardform
- Insecure Direct Object Reference (IDOR) vulnerability in a DoD website
- X-XSS-Protection -> Misconfiguration
- QuickTime Promotion on a DoD website
- Violation of secure design principles on a DoD website
- Bypassing CORS Misconfiguration Leads to Sensitive Exposure at https://███/
- Remote file inclusion vulnerability on a DoD website
- CORS Misconfiguration
- Arbitrary file upload and stored XSS via ███ support request
- Information disclosure vulnerability on a DoD website
- HTML Injection/Load Images vulnerability on a DoD website
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP