X / xAI · disclosed reports
Cross-Site Request Forgery
16 disclosed reports · $5,320 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open X / xAI on HackerOne- reports
- 16
- paid a bounty
- 4
Every one of the 16 is a mark on the map. Named now: 1 to 16, most upvoted first.
- Periscope android app deeplink leads to CSRF in follow action
- [CRITICAL] Full account takeover using CSRF
- CSRF on Periscope Web OAuth authorization endpoint
- Periscope iOS app CSRF in follow action due to deeplink
- CSRF on cards API
- CSRF on https://www.niche.co leads to "account disconnection"
- CSRF and probable account takeover on https://www.niche.co
- login csrf in analytics.mopub.com
- Add tweet to collection CSRF
- CSRF in twitterflightschool.com ( CAN POST ON TIMELINE WITHOUT USER PERMISSION)
- URGENT : NICHE.co Account Take Over Vulnerability
- [mobile.twitter.com / twitter.com] CSRF protection bypass
- Notifications can mark as read by CSRF
- iOS App can establish Facetime calls without user's permission
- CSRF in crashlytics.com
- HTML form without CSRF protection at http://try.crashlytics.com/enterprise/
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.