Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Unicode-to-ASCII conversion on Windows can lead to argument injection and more#2550951 | N/A | Other weaknesses | High | 2024-06-18 | – | 13 |
| LM Challenge-Response Hash Always Sent in SMB Authentication#3584491 | Informative | Other weaknesses | Medium | 2026-03-09 | – | 18 |
| Account/Repository Takeover via Abandoned GitHub Username in curl's href_extractor.c#3295738 | N/A | Other weaknesses | Medium | 2025-08-12 | – | 19 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.