Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
MySQL username and password leaked in developer.valvesoftware.com via source code dislosureAnalysed#291057	Valid	Authentication	–	2018-05-07	–	123
Malformed .BSP Access Violation in CS:GO can lead to Remote Code ExecutionAnalysed#351014	Valid	Memory Corruption	–	2018-07-19	–	154
RCE on CS:GO client using unsanitized entity ID in EntityMsg messageAnalysed#584603	Valid	Memory Corruption	–	2021-05-27	$9,000	209
OOB reads in network message handlers leads to RCEAnalysed#807772	Valid	Memory Corruption	–	2021-05-04	$7,500	219
Unchecked weapon id in WeaponList message parser on client leads to RCEAnalysed#513154	Valid	Memory Corruption	–	2019-09-17	$3,000	229
Malformed .BMP file in Counter-Strike 1.6 may cause shellcode injectionAnalysed#397545	Valid	Memory Corruption	–	2020-02-27	–	321
Panorama UI XSS leads to Remote Code Execution via Kick/Disconnect MessageAnalysed#631956	Valid	Command and Code Injection	–	2019-10-08	–	420
RCE on Steam Client via buffer overflow in Server InfoAnalysed#470520	Valid	Memory Corruption	–	2019-03-15	–	1,289

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (779 analysed so far), which can be wrong. Data as of 2026-11-14.