Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Unauthenticated ?q= search query causes exponential pyparsing backtracking under a process-global lock in WeblateAnalysed#3898281 | Valid | Denial of Service | High | 2026-09-04 | – | 33 |
| Memory exhaustion (DoS) via unbounded file read in `EncodingDiscovery.detect_encoding()`Analysed#4028616 | Valid | Denial of Service | Medium | 2026-10-16 | – | 24 |
| Uncaught RecursionError crash in translation-finder (deep directory tree DoS)Analysed#4022462 | Valid | Denial of Service | Low | 2026-10-14 | – | 16 |
| CPU-based Denial of Service in translation-finder via O(N²) per-result wildcard mask matching#4088592 | Valid | Denial of Service | Medium | 2026-11-05 | – | 13 |
| No Password Length Restriction leads to Denial of Service#223854 | Valid | Denial of Service | Low | 2017-05-17 | – | 8 |
| Bypassing captcha in registration on Hosted site#224342 | Informative | Denial of Service | Medium | 2017-07-03 | – | 4 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.