Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| Remote code execution on rubygems.orgAnalysed#274990 | Valid | RubyGems | Deserialization and Object Injection | Critical | 2017-11-09 | $1,500 | 51 |
| Buffer overflow in PyCArg_repr in _ctypes/callproc.c for Python 3.x to 3.9.1Analysed#1084342 | Valid | Internet Bug Bounty | Memory Corruption | High | 2021-08-25 | $1,500 | 51 |
| RCE in 'Copy as Node Request' BApp via code injectionAnalysed#1167530 | Valid | PortSwigger Web Security | Command and Code Injection | None | 2021-04-22 | – | 51 |
| Unsafe yaml load can lead to remote code executionAnalysed#2467232 | Valid | Liberapay | Deserialization and Object Injection | Low | 2024-05-04 | – | 55 |
| Remote Code Execution through DNN Cookie DeserializationAnalysed#876708 | Valid | U.S. Dept Of Defense | Command and Code Injection | High | 2020-05-27 | – | 56 |
| [Kafka Connect] [JdbcSinkConnector][HttpSinkConnector] RCE by leveraging file upload via SQLite JDBC driver and SSRF to internal JolokiaAnalysed#1547877 | Valid | Aiven Ltd | File and Path Handling | Critical | 2022-11-08 | $5,000 | 56 |
| RCE on worker host due to unsanitized "env" variable name in task definition on community-tc.services.mozilla.comAnalysed#2221404 | Valid | Mozilla | Command and Code Injection | Low | 2024-12-08 | $500 | 56 |
| Ingress nginx annotation injection causes arbitrary command executionAnalysed#1728174 | Valid | Kubernetes | Command and Code Injection | High | 2023-11-24 | $2,500 | 57 |
| Remote code execution and exfiltration of secret tokens by poisoning the mozilla/fxa CI build cacheAnalysed#2255750 | Valid | Mozilla | Command and Code Injection | Critical | 2024-01-20 | $8,000 | 58 |
| Guest Privilege Escalation to admin groupAnalysed#501081 | Valid | Rocket.Chat | Access Control | Critical | 2024-08-10 | – | 59 |
| Arbitrary code execution in desktop client via OpenSSL configAnalysed#622170 | Valid | Nextcloud | Command and Code Injection | Medium | 2020-08-05 | $100 | 59 |
| Remote code execution via crafted pentaho report uploaded using default credentials for pentaho business serverAnalysed#1677047 | Valid | MTN Group | Command and Code Injection | Critical | 2023-12-31 | – | 59 |
| Remote Code Execution (upload)Analysed#116575 | Valid | Legal Robot | Misconfiguration and Insecure Design | – | 2016-08-26 | – | 60 |
| [Source Engine] Material path truncation leads to Remote Code ExecutionAnalysed#544096 | Valid | Valve | Input Validation and Logic | High | 2021-05-06 | $2,500 | 60 |
| CVE-2022-40127: RCE in Apache Airflow <2.4.0 bash exampleAnalysed#1776476 | Valid | Internet Bug Bounty | Command and Code Injection | High | 2023-01-05 | $4,000 | 60 |
| Remote Code Execution identified on IBM endpoint.Analysed#3463045 | Valid | IBM | No weakness recorded | Critical | 2025-12-31 | – | 60 |
| Information disclosure due to debug mode enabled at Laravel instance https://mpos.mtn.co.sz/Analysed#2765259 | Valid | MTN Group | Information Disclosure | Medium | 2025-02-23 | – | 61 |
| URL Scheme Validation Bypass in Shopify Mobile App Allows Javascript ExecutionAnalysed#1737358 | Valid | Shopify | Access Control | Low | 2025-09-17 | – | 65 |
| Account Takeover / Arbitrary File read and deletion / Partial code execution (intent redirection)Analysed#2289836 | Valid | MercadoLibre | Command and Code Injection | High | 2024-06-28 | – | 66 |
| Remote Code Execution via unsafe usage of `reply.view({ raw })` in @fastify/view (EJS template engine)Analysed#3122019 | Valid | Fastify | No weakness recorded | None | 2025-05-28 | – | 66 |
| RCE + PAT Exfiltration via pull_request_target in privacy-configuration/auto-respond-pr.yml — Direct Supply Chain to All DDG BrowsersAnalysed#3619288 | Valid | DuckDuckGo | No weakness recorded | Critical | 2026-06-11 | – | 66 |
| Persistant Arbitrary code execution in mattermost androidAnalysed#1115864 | Valid | Mattermost | Command and Code Injection | High | 2021-06-03 | – | 67 |
| CVE-2023-5528: Insufficient input sanitization in in-tree storage plugin leads to privilege escalation on Windows nodesAnalysed#2231019 | Valid | Kubernetes | Command and Code Injection | High | 2023-12-21 | $5,000 | 67 |
| [RCE] Remote Code Execution via React Server Components Vulnerability CVE-2025-55182Analysed#3458235 | Valid | IBM | Command and Code Injection | Critical | 2025-12-18 | – | 67 |
| GMP Deserialization Type Confusion Vulnerability [MyBB <= 1.8.3 RCE Vulnerability]Analysed#198734 | Valid | Internet Bug Bounty | Command and Code Injection | High | 2019-10-13 | – | 68 |
| RCE on █████ via CVE-2017-10271Analysed#576887 | Valid | U.S. Dept Of Defense | Command and Code Injection | Critical | 2019-07-01 | – | 68 |
| CVE-█████-35813 in █████Analysed#2200329 | Valid | Mars | File and Path Handling | Critical | 2026-02-24 | – | 71 |
| Privilege Escalation to Root SSH Access via Pre-Receive Hook Environment in GitHub Enterprise ServerAnalysed#2336236 | Valid | GitHub | No weakness recorded | High | 2024-09-13 | – | 71 |
| OSX slack:// protocol handler javascript injectionAnalysed#79348 | Valid | Slack | Command and Code Injection | – | 2016-06-24 | – | 72 |
| Nextcloud Desktop Client RCE via malicious URI schemesAnalysed#1078002 | Valid | Nextcloud | Injection and Smuggling | Medium | 2021-04-15 | $1,000 | 73 |
| CVE-2021-40870 on [52.204.160.31]Analysed#1356845 | Valid | Elastic | Command and Code Injection | Critical | 2021-10-06 | – | 75 |
| `use-mcp`'s oauth2 process uses a window.open call with untrusted mcp server provided data allowing for code execution under the page using itAnalysed#3211031 | Valid | Cloudflare Public Bug Bounty | Cross-site Scripting | Medium | 2025-09-30 | $550 | 75 |
| File writing by Directory traversal at actionpack-page_caching and RCE by itAnalysed#519220 | Valid | Ruby on Rails | File and Path Handling | High | 2020-07-13 | $1,000 | 80 |
| Pre-auth Remote Code Execution on multiple Uber SSL VPN serversAnalysed#540242 | Valid | Uber | Command and Code Injection | Critical | 2021-02-24 | $2,000 | 80 |
| Integrity checks according to policies can be circumvented in Node.js 20 and Node.js 18Analysed#2208860 | Valid | Internet Bug Bounty | Cryptography | Medium | 2023-11-30 | $1,270 | 82 |
| Remote Code Execution (RCE) in a DoD websiteAnalysed#248116 | Valid | U.S. Dept Of Defense | Command and Code Injection | Critical | 2019-10-04 | – | 84 |
| Authenticated Code Execution through Phar deserialization in CSV Importer as Shop manager in WooCommerceAnalysed#403083 | Valid | Automattic | Deserialization and Object Injection | High | 2019-12-19 | – | 84 |
| Remote code execution [CVE-2023-36845]Analysed#2182202 | Valid | MTN Group | No weakness recorded | Critical | 2024-10-09 | – | 87 |
| CVE-2024-27281: RCE vulnerability with .rdoc_options in RDocAnalysed#2438265 | Valid | Internet Bug Bounty | No weakness recorded | High | 2024-03-29 | $4,860 | 88 |
| CVE-2022-40604: Apache Airflow: Format String VulnerabilityAnalysed#1707287 | Valid | Internet Bug Bounty | Memory Corruption | Critical | 2025-01-18 | $8,000 | 89 |
| Injection in path parameter of Ingress-nginxAnalysed#2701701 | Valid | Kubernetes | Command and Code Injection | High | 2026-03-07 | – | 91 |
| User-assisted RCE in Slack for macOS (from official site) due to improper quarantine meta-attribute handling for downloaded filesAnalysed#470637 | Valid | Slack | No weakness recorded | High | 2019-09-14 | – | 97 |
| Malformed save files (.sav) allow to write files with arbitrary extensions and content in GoldSrc-based games.Analysed#458842 | Valid | Valve | Other weaknesses | High | 2020-02-24 | $1,500 | 99 |
| [hta3] Remote Code Execution on ████Analysed#1072832 | Valid | U.S. Dept Of Defense | Command and Code Injection | Critical | 2023-05-15 | – | 104 |
| Team members can trigger arbitrary code execution in Slack Desktop Apps via HTML NotificationsAnalysed#816156 | Valid | Slack | Command and Code Injection | High | 2021-05-09 | – | 107 |
| DLL side-loading vulnerability in Sony Music Center for PC Ver. 2.7.2 (Latest version)Analysed#3355766 | Valid | Sony | File and Path Handling | High | 2026-06-05 | – | 109 |
| Remote Code Execution (Reverse Shell) - File ManagerAnalysed#768322 | Valid | Concrete CMS | Command and Code Injection | Medium | 2020-07-21 | – | 114 |
| RCE/LFI on test Jenkins instance due to improper authentication flowAnalysed#258117 | Valid | Snapchat | Access Control | Medium | 2017-08-19 | – | 118 |
| Remote Code Execution on Git.imgur-dev.comAnalysed#206227 | Valid | Imgur | Command and Code Injection | Critical | 2017-04-16 | – | 119 |
| Unserialize leading to arbitrary PHP function invokeAnalysed#210741 | Valid | Rockstar Games | Command and Code Injection | Critical | 2017-12-13 | – | 119 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (1,932 analysed so far), which can be wrong. Data as of 2026-11-15.