Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| S3 Bucket Takeover : brave-aptAnalysed#1791558 | Valid | Brave Software | Access Control | Medium | 2023-04-26 | – | 19 |
| reflected XSS in [www.equifax.com]Analysed#1818172 | Valid | Equifax-vdp | Cross-site Scripting | Medium | 2023-04-23 | – | 19 |
| ' Full Account Takeover ' at █████Analysed#1959540 | Valid | Mars | Access Control | Critical | 2023-06-23 | – | 19 |
| important: Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows (CVE-2024-40898)Analysed#2612028 | Valid | Internet Bug Bounty | No weakness recorded | High | 2024-08-27 | $4,263 | 19 |
| HashDoS in V8Analysed#3511792 | Valid | Node.js | Cryptography | Medium | 2026-03-30 | – | 19 |
| JetBrains .idea project directoryAnalysed#80990 | Valid | Ubiquiti Inc. | Misconfiguration and Insecure Design | – | 2019-09-19 | – | 20 |
| HTTP-Response-Splitting on v.shopify.comAnalysed#106427 | Valid | Shopify | No weakness recorded | – | 2016-01-17 | $500 | 20 |
| Shell Injection via Web Management Console (dl-fw.cgi)Analysed#121940 | Valid | Ubiquiti Inc. | Command and Code Injection | – | 2016-10-15 | – | 20 |
| Missing Certificate Authority Authorization ruleAnalysed#129992 | Valid | HackerOne | Cryptography | – | 2017-08-17 | – | 20 |
| https://windsor.shopify.com/ takeoverAnalysed#150374 | Valid | Shopify | Open Redirect | – | 2016-07-18 | – | 20 |
| Unauthorized access to Zookeeper on http://locutus-zk3.ec2.shopify.com:2181Analysed#154369 | Valid | Shopify | Authentication | – | 2016-08-08 | $1,000 | 20 |
| [controlsyou.quora.com] 429 Too Many Requests Error-Page XSSAnalysed#189768 | Valid | Quora | Cross-site Scripting | Medium | 2017-03-31 | – | 20 |
| [IMP] - Blind XSS in the admin panel for reviewing commentsAnalysed#197337 | Valid | Rockstar Games | Cross-site Scripting | Medium | 2017-03-17 | $650 | 20 |
| Able to create basic user account via Google login on HackerOne Drupal CMSAnalysed#208407 | Valid | HackerOne | Authentication | – | 2017-04-25 | – | 20 |
| https://xmpp.nextcloud.com///;@www.google.com allows open redirectAnalysed#211213 | Valid | Nextcloud | Open Redirect | – | 2017-08-13 | – | 20 |
| SSLv3 Poodle VulnerabilityAnalysed#220116 | Valid | FormAssembly | Misconfiguration and Insecure Design | High | 2018-11-24 | – | 20 |
| [doc.rt.informaticacloud.com] Arbitrary File Reading via Double URL EncodeAnalysed#232371 | Valid | Informatica | File and Path Handling | High | 2022-07-23 | – | 20 |
| Session fixation in password protected public download.Analysed#237184 | Valid | Nextcloud | Authentication | Low | 2018-10-25 | – | 20 |
| Open Redirect through POST RequestAnalysed#242243 | Valid | Inflection | Open Redirect | Medium | 2017-10-16 | – | 20 |
| Subdomain take-over of {REDACTED}.18f.govAnalysed#263542 | Valid | GSA Bounty | Access Control | High | 2017-09-06 | – | 20 |
| all private tokens are leaked to an unauthenticated attackerAnalysed#268794 | Valid | GitLab | Access Control | Critical | 2017-09-21 | – | 20 |
| Xss on community.imgur.comAnalysed#274868 | Valid | Imgur | Cross-site Scripting | Medium | 2019-09-03 | – | 20 |
| Password Reset Token Not ExpiredAnalysed#283550 | Valid | Infogram | Authentication | High | 2017-10-30 | – | 20 |
| reflected XSS avito.ruAnalysed#344429 | Valid | Avito | Cross-site Scripting | Medium | 2018-12-06 | – | 20 |
| Cleartext password exposure allows access to the desafio5estrelas.com admin panelAnalysed#344566 | Valid | Uber | Cryptography | Medium | 2021-03-30 | $500 | 20 |
| Local File DownloadAnalysed#345162 | Valid | RATELIMITED | Access Control | Critical | 2019-01-01 | – | 20 |
| Stored Cross Site Scripting.Analysed#413077 | Valid | 8x8 | Cross-site Scripting | High | 2020-07-21 | – | 20 |
| Reflected xss on theacademy.upserve.comAnalysed#415139 | Valid | Upserve | Cross-site Scripting | Low | 2018-09-28 | – | 20 |
| Solution for h15411's CTF challengeAnalysed#415222 | Valid | h1-5411-CTF | Command and Code Injection | Critical | 2018-10-22 | – | 20 |
| DMARC RECORD MISSINGAnalysed#491753 | Valid | Brave Software | No weakness recorded | Low | 2019-02-13 | – | 20 |
| Unpublished Product Images can be disclosedAnalysed#534554 | Valid | Shopify | Access Control | Low | 2019-06-12 | $500 | 20 |
| HTML injection and information disclosure in support panelAnalysed#634312 | Valid | Weblate | Information Disclosure | Medium | 2019-07-09 | – | 20 |
| Multiple HTTP Smuggling reportsAnalysed#648434 | Valid | Internet Bug Bounty | Injection and Smuggling | Critical | 2019-11-12 | – | 20 |
| AppLovin API Key hardcoded in a Github repoAnalysed#674774 | Valid | X / xAI | Cryptography | High | 2019-09-18 | $280 | 20 |
| Out of Bounds Memory Read in exif_scan_thumbnailAnalysed#675578 | Valid | Internet Bug Bounty | Memory Corruption | High | 2020-11-09 | $1,500 | 20 |
| scripts loader (denial of service) vulnerabilityAnalysed#690330 | Valid | MariaDB | Denial of Service | Low | 2020-03-19 | – | 20 |
| Variant of CVE-2013-0269 (Denial of Service and Unsafe Object Creation Vulnerability in JSON)Analysed#706934 | Valid | Ruby | Input Validation and Logic | Medium | 2020-04-23 | – | 20 |
| Reflected XSSAnalysed#732987 | Valid | OWOX, Inc. | Cross-site Scripting | High | 2019-12-09 | – | 20 |
| Password token leak via Host headerAnalysed#737042 | Valid | Stripo Inc | Misconfiguration and Insecure Design | Medium | 2019-12-19 | – | 20 |
| India - OTP bypass on Phone number verification for account creationAnalysed#762695 | Valid | Starbucks | Authentication | Medium | 2020-04-21 | – | 20 |
| No Rate Limit On forgot Password Leading To Massive Email FloodingAnalysed#794395 | Valid | CompanyHub | No weakness recorded | Medium | 2020-02-25 | – | 20 |
| Denial of Service by requesting to reset a passwordAnalysed#812754 | Valid | Nextcloud | Denial of Service | High | 2021-01-25 | – | 20 |
| Unix time unlock_time values have dangerous validation rules enabling a number of exploitsAnalysed#854726 | Valid | Monero | Input Validation and Logic | High | 2021-09-12 | – | 20 |
| Path traversal on https://███ allows arbitrary file read (CVE-2020-3452)Analysed#936399 | Valid | U.S. Dept Of Defense | File and Path Handling | High | 2020-08-13 | – | 20 |
| Reflected XSS on a Atavist themeAnalysed#947790 | Valid | Automattic | Cross-site Scripting | Medium | 2020-11-18 | – | 20 |
| Open SonarQube instance leaking internal source codeAnalysed#947946 | Valid | Equifax-vdp | Information Disclosure | Critical | 2020-09-03 | – | 20 |
| Graphql: Sorting the reports by jira_status field resulted to different valueAnalysed#955286 | Valid | HackerOne | Access Control | Low | 2020-08-27 | – | 20 |
| [tumblr.com] CSRF in /svc/user/filtered_contentAnalysed#1010806 | Valid | Automattic | Cross-Site Request Forgery | Low | 2020-12-26 | – | 20 |
| Some build dependencies are downloaded over an insecure channel (without subsequent integrity checks)Analysed#1039504 | Valid | Internet Bug Bounty | Cryptography | High | 2020-12-04 | $100 | 20 |
| [Bypass #870709] Unauthorised access to pagespeed global admin at https://webtools.paloalto.com/Analysed#1070889 | Valid | Palo Alto Software | Access Control | Medium | 2021-02-13 | – | 20 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.