Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Arbitrary `/tmp` read in discourse via `convert_heif!` decoder-confusion (regression of 4bf3bf6786)#3738834 | Valid | Information Disclosure | Medium | 2026-10-26 | – | 4 |
| Any authenticated user can download full list of users, including email#228399 | Valid | Information Disclosure | Medium | 2017-06-17 | $256 | 19 |
| SSRF in upload IMG through URLAnalysed#228377 | Valid | Information Disclosure | Low | 2017-06-18 | $64 | 32 |
| Arbitrary Local-File Read from Admin - Restore From Backup due to SymlinksAnalysed#213558 | Valid | Information Disclosure | High | 2017-05-13 | $512 | 52 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,437 analysed so far), which can be wrong. Data as of 2026-11-15.