Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Background sync cache retains outgoing additional transaction secret keys#3749681	Valid	Information Disclosure	Low	2026-08-20	–	1
Potential linkage of public/private (anonymous) node addresses#766963	Valid	Information Disclosure	Low	2020-03-11	–	3
Monero can leak unitialized memory#481164	Valid	Information Disclosure	Medium	2019-07-02	–	5
Trusted daemon check fails when proxied through torsocks or proxychains#361269	Valid	Information Disclosure	Low	2018-08-02	–	6
Corrupt RPC responses from remote daemon nodes can lead to transaction tracing#304770	Valid	Information Disclosure	Medium	2018-03-16	–	13
Kovri: potential buffer over-read in garlic clove handling + I2NP message creation#291489	Valid	Information Disclosure	High	2017-12-05	–	14
`monero-wallet-rpc::rescan_spent` accepts daemon-supplied spent-status from an untrusted daemon, enabling ring-intersection attack on transactionsAnalysed#3719670	Valid	Information Disclosure	Medium	2026-11-02	–	21
View-only offline transaction creation bypasses the long-payment-ID privacy blockAnalysed#3686283	Valid	Information Disclosure	Medium	2026-08-20	–	32
Connection Count Bug in Monero Node Enables Outbound Peer Reset AttackAnalysed#3185083	Valid	Information Disclosure	–	2026-05-06	–	39

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.