Potential pre-auth RCE on Twitter VPN Analysed #591295 Valid X / xAI Command and Code Injection Critical 2019-08-10 $20,160 1,246 Privilege Escalation From user to SYSTEM via unauthenticated command execution Analysed #544928 Valid Ubiquiti Inc. Command and Code Injection Critical 2019-11-08 – 553 Unauthenticated RCE in Taskcluster web-server via GraphQL filter argument (sift $where) Analysed #3782701 Valid Mozilla Command and Code Injection Critical 2026-08-05 $12,000 361 Unauthenticated blind SSRF in OAuth Jira authorization controller Analysed #398799 Valid GitLab Server-Side Request Forgery High 2019-03-14 $4,000 238 Blind SQLi leading to RCE, from Unauthenticated access to a test API Webservice Analysed #592400 Valid Starbucks SQL Injection Critical 2019-07-22 – 236 Unauthenticated SSRF in jira.tochka.com leading to RCE in confluence.bank24.int #713900 No longer public QIWI Command and Code Injection – 2021-06-29 – 221 Unauthenticated access to sensitive user information #702677 No longer public Razer Access Control – – $500 184 SQL Injection [unauthenticated] with direct output at https://news.mail.ru/ #818972 No longer public Mail.ru SQL Injection – 2020-10-30 $7,500 156 MobileIron Unauthenticated RCE on mdm.qiwi.com with WAF bypass #983548 No longer public QIWI Deserialization and Object Injection – 2021-04-27 – 148 Unauthenticated users can access all food.grammarly.io user's data Analysed #745495 Valid Superhuman (formerly Grammarly) Access Control Low 2020-08-10 – 138 Unauthenticated LFI revealing log information Analysed #272578 Valid Slack Information Disclosure High 2018-01-26 – 123 "😂" + Unauthenticated Stored XSS in API at https://api.my.games/comments/v1/comments/update/ #853637 No longer public Mail.ru Cross-site Scripting – 2020-07-28 – 118 China – Limited Partner PII Regarding Work Scheduling via Unauthenticated API Endpoint Analysed #659248 Valid Starbucks Information Disclosure Critical 2020-04-01 – 116 Ability to perform actions (Tweet, Retweet, DM) and other actions, unauthenticated, on any account with SMS enabled. Analysed #470749 Valid X / xAI Input Validation and Logic Critical 2019-09-26 – 106 Zero day path traversal vulnerability in Grafana 8.x allows unauthenticated arbitrary local file read Analysed #1415820 Valid Aiven Ltd File and Path Handling High 2021-12-14 $1,000 105 Thailand - a small number of SMB CCTV footage backup servers were accessible without authentication. Analysed #417360 Valid Starbucks Access Control Medium 2019-11-19 – 99 Stored XSS in Rocket.Chat HTML File Export — Unauthenticated Entry via LiveChat Analysed #3779690 Valid Rocket.Chat Cross-site Scripting Medium 2026-07-16 – 97 [███████] Information disclosure due unauthenticated access to APIs and system browser functions Analysed #2122964 Valid U.S. Dept Of Defense Information Disclosure Medium 2023-11-03 – 97 POST /api/bitcoinWithdrawalFees returns financial data without authentication despite being documented as a USER OPERATION (private endpoint) Analysed #3676308 Valid CoinMate.io Authentication Medium 2026-05-20 – 93 Unauthenticated Docker registry Analysed #179103 Valid Imgur Authentication – 2016-11-22 – 92 Unauthenticated user can upload an attachment to the last updated report draft Analysed #419896 Valid HackerOne Memory Corruption High 2018-10-09 – 87 Docker Registry HTTP API v2 exposed in HTTP without authentication leads to docker images dumping and poisoning Analysed #347296 Valid Semmle Access Control Critical 2020-06-06 – 83 Pre-auth Remote Code Execution on multiple Uber SSL VPN servers Analysed #540242 Valid Uber Command and Code Injection Critical 2021-02-24 $2,000 80 IDOR leading unauthenticated attacker to download documents discloses PII of users and soldiers via https://www.█████████/Download.aspx?id= [HtUS] Analysed #1626508 Valid U.S. Dept Of Defense Insecure Direct Object Reference High 2024-06-27 $500 77 Unauthenticated access to private files on app.fizzy.do via Active Storage URLs leads to information disclosure Analysed #3467641 Valid Basecamp Insecure Direct Object Reference Low 2026-03-16 $100 76 Unauthenticated GraphQL access by prepending __schema to private operations Analysed #3452015 Valid Enjin Authentication Medium 2025-12-05 $500 76 Exposure of shopify employee summit page allows anonymous user to place orders for free books #2552027 Informative Shopify Input Validation and Logic None 2024-07-29 – 76 Autotranslate DDP Method Exposes Private Messages Without Authentication or Room Access Check Analysed #3734326 Valid Rocket.Chat Insecure Direct Object Reference High 2026-05-25 – 74 **Unauthenticated IDOR allows modification of payment customer billing information** Analysed #3869124 Valid Weblate Insecure Direct Object Reference High 2026-08-30 – 72 Unauthenticated access to webmail at maildev.happytools.dev leading to compromised wordpress site api.happytools.dev [RCE] Analysed #1067547 Valid Automattic Information Disclosure High 2021-02-01 – 71 Unauthenticated WordPress Database Repair DoS #2786591 N/A WordPress Denial of Service High 2024-10-18 – 70 CVE-2020-3187 - Unauthenticated Arbitrary File Deletion Analysed #960330 Valid U.S. Dept Of Defense File and Path Handling Critical 2020-09-21 – 70 Unauthenticated LFI (Local File Inclusion) using the symbol `!` At the target `https://████/` Analysed #2778380 Valid U.S. Dept Of Defense File and Path Handling High 2024-10-25 – 69 Unauthenticated API allows reading, writing to and deleting any user's private chat history on ████████ Analysed #4020767 Valid Essity Misconfiguration and Insecure Design Critical 2026-09-18 – 68 Unauthenticated team "income/payments" export ignores donor privacy settings (hide_giving, hide_from_lists) and uses frozen visibility, exposing donat Analysed #3878586 Valid Liberapay No weakness recorded Medium 2026-08-01 $100 68 jitsi-call-analytics: Unauthenticated arbitrary file write via path traversal in `/api/v1/uploads/analyze` Analysed #3485343 Valid 8x8 File and Path Handling Low 2026-07-02 $100 68 access to profile & reset password page without authentication #2213337 Informative Tennessee Valley Authority Authentication Medium 2023-11-30 – 68 Unauthenticated Remote Access to Testing Endpoint Analysed #2192984 Valid IBM Access Control Critical 2023-12-04 – 67 Unauthenticated Sensitive Information Disclosure on █████████ CVE-2021-38314 Analysed #1452774 Valid Mars Information Disclosure Medium 2025-09-02 – 67 CVE-2020-7961 RCE Liferay Portal Unauthenticated via https://████████/ Analysed #2742457 Valid U.S. Dept Of Defense Command and Code Injection Critical 2024-10-25 – 62 Unauthenticated SQL Injection at █████████ [HtUS] Analysed #1626226 Valid U.S. Dept Of Defense SQL Injection Critical 2022-10-14 – 61 Unauthenticated access to Zendesk tickets through athena-flex-production.shopifycloud.com Okta bypass Analysed #397130 Valid Shopify Authentication Critical 2018-09-19 – 61 Unauthenticated Path Traversal and Command Injection in Trellix Enterprise Security Manager 11.6.10 Analysed #2817658 Valid Trellix Command and Code Injection Critical 2025-01-12 – 60 Unauthenticated users can obtain information about Checklist objects with unclaimed ChecklistCheck objects Analysed #781175 Valid HackerOne Access Control Medium 2020-03-20 – 59 Store Development Resource Center was vulnerable to a Remote Code Execution - Unauthenticated Remote Command Injection (CVE-2019-0604) Analysed #536134 Valid Starbucks Command and Code Injection Critical 2019-12-12 – 57 Unauthenticated File Upload to CDN Analysed #3589247 Valid Enjin Access Control Medium 2026-05-18 – 56 Improper Session Invalidation – Auto Sign-In Without Credentials After Logout (Affects Chrome & Firefox) Analysed #3101207 Valid Dust Authentication Medium 2025-04-29 – 56 Sensitive data exposure: █████████ candidate resumes/CVs available to download with no authentication through BAC/IDOR/Improper Salesforce config Analysed #2623715 Valid U.S. Dept Of Defense Access Control High 2024-12-18 – 55 insecure storage of information, you can view any file uploaded to the server without authentication and only with a single link #2007235 No longer public Radancy Information Disclosure – 2023-08-21 – 55 DoS via markdown API from unauthenticated user Analysed #1619604 Valid GitHub Denial of Service Medium 2022-12-13 $4,000 54