Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Sql query disclosure,#267922 | Informative | Information Disclosure | Low | 2017-09-18 | – | – |
| Cross-domain linkability when system time changed in Tor Browser#282339 | Informative | Information Disclosure | Low | 2017-10-26 | – | – |
| Preferred language option fingerprinting issue in Tor Browser#281597 | Informative | Information Disclosure | Low | 2017-10-24 | – | 3 |
| Tor Project - Full Path Disclosure#269426 | Informative | Information Disclosure | Low | 2023-11-28 | – | 5 |
| Content spoofing on#273819 | Informative | Misconfiguration and Insecure Design | Low | 2023-11-28 | – | 6 |
| solving TOR vulnerability, in other to make bruteforce difficult#268320 | Informative | Memory Corruption | Low | 2023-11-28 | – | 9 |
| Simple CSS line-height identifies platform#256647 | Valid | Information Disclosure | Low | 2017-10-20 | – | 10 |
| languagechange event fires simultaneously on all tabs#257942 | Valid | Information Disclosure | Low | 2017-10-19 | $100 | 10 |
| Potential IP revealing using UNC Path in Windows File Picker#376004 | Informative | Information Disclosure | Low | 2023-11-28 | – | 25 |
| Tor onion service INTRODUCE2 invalid-MAC cells permanently grow service replay cacheAnalysed#3709703 | Valid | Denial of Service | Low | 2026-09-10 | – | 28 |
| Scrollbar Width permits detecting browser platformAnalysed#252580 | Valid | Information Disclosure | Low | 2017-10-20 | – | 29 |
| Malicious Conflux Endpoint Can Leave Stale Global OOO Queue Accounting After TeardownAnalysed#3701692 | Valid | Denial of Service | Low | 2026-06-16 | $100 | 35 |
| Detecting Tor Browser UI LanguageAnalysed#282748 | Valid | Information Disclosure | Low | 2019-05-21 | – | 64 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.