Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Misconfigured build on websites "abuse.cloudflare.com"#1624911 | Valid | No weakness recorded | Low | 2022-10-13 | $100 | 12 |
| Basic XSS [WAF Bypasses]#1615743 | Informative | No weakness recorded | – | 2023-07-07 | $50 | 27 |
| Take over subdomains of r2.dev using R2 custom domainsAnalysed#1700276 | Valid | No weakness recorded | Medium | 2022-09-28 | $1,125 | 28 |
| [Variation of #1554049] 1-Click Chaining of Self-XSS, Cookie Tossing and AntiCSRF Token Prediction leads to auto approval in Access Temp AuthAnalysed#3321406 | Valid | No weakness recorded | High | 2026-04-14 | – | 39 |
| Arbitrary file read from Cloudflare Pages build environmentAnalysed#1570874 | Valid | No weakness recorded | Medium | 2024-02-23 | – | 40 |
| Yet Another CASB Integration Takeover of Active IntegrationsAnalysed#2094346 | Valid | No weakness recorded | High | 2023-11-13 | – | 68 |
| Using special IPv4-mapped IPv6 addresses to bypass local IP banAnalysed#1785260 | Valid | No weakness recorded | Critical | 2023-01-24 | $7,500 | 78 |
| Cloudflare CASB Confused Deputy ProblemAnalysed#1952124 | Valid | No weakness recorded | Critical | 2023-06-07 | $3,300 | 97 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.