Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
StatusAny
WeaknessRace Conditions
- Any class
- Cross-site Scripting1
- Server-Side Request Forgery1
- Command and Code Injection6
- Injection and Smuggling21
- File and Path Handling7
- Memory Corruption19
- Race Conditions4
- Denial of Service25
- Input Validation and Logic2
- Misconfiguration and Insecure Design2
- Cryptography19
- Information Disclosure3
- Authentication2
- Access Control33
- Other weaknesses4
- No weakness recorded5
4 of 15,219 reports · 161 analysed so far
- #3752489InformativeMemory Corruption via TOCTOU Race in SharedArrayBuffer UTF-8 Decode (`StringBytes::Encode`)Node.js · Race Conditions · 2026 · High–32votes
- #4038361ValidKeep-alive socket process a response that was written before the request was sentNode.js · Race Conditions · 2026 · Medium–15votes
- #3795900Validnode:sqlite SQLTagStore Iterator Replay Lets Attacker Re-Execute Victim-Bound Writes IndefinitelyNode.js · Race Conditions · 2026 · Medium–11votes
- #3582376ValidHTTP Response Queue Poisoning via TOCTOU Race Condition in `http.Agent`Node.js · Race Conditions · 2026 · Low–11votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.