Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
StatusAny
WeaknessNo weakness recorded
- Any class
- Cross-site Scripting1
- Server-Side Request Forgery1
- Command and Code Injection6
- Injection and Smuggling21
- File and Path Handling7
- Memory Corruption19
- Race Conditions4
- Denial of Service25
- Input Validation and Logic2
- Misconfiguration and Insecure Design2
- Cryptography19
- Information Disclosure3
- Authentication2
- Access Control33
- Other weaknesses4
- No weakness recorded5
5 of 15,219 reports · 161 analysed so far
- #3556769ValidIncomplete fix for CVE-2026-21637: loadSNI() in _tls_wrap.js lacks try/catch leading to Remote DoSNode.js · No weakness recorded · 2026 · High–59votes
- #3302484InformativeCWE-195 in ExternalMemoryAccounter::Increase()Node.js · No weakness recorded · 2025–55votes
- #3456148ValidUnbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustionNode.js · No weakness recorded · 2026–25votes
- #1625036ValidInsecure loading of ICU data through ICU_DATA environment variableNode.js · No weakness recorded · 2023–4votes
- #678487InformativeHostname spoofingNode.js · No weakness recorded · 2020–3votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.