Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| RCE on Steam Client via buffer overflow in Server InfoAnalysed#470520 | Valid | Valve | Memory Corruption | Critical | 2019-03-15 | – | 1,289 |
| RCE and Complete Server Takeover of http://www.█████.starbucks.com.sg/Analysed#502758 | Valid | Starbucks | Command and Code Injection | Critical | 2019-04-10 | – | 572 |
| Panorama UI XSS leads to Remote Code Execution via Kick/Disconnect MessageAnalysed#631956 | Valid | Valve | Command and Code Injection | Critical | 2019-10-08 | – | 420 |
| RCE on build server via misconfigured pip installAnalysed#946409 | Valid | Yelp | Supply Chain and Malicious Code | Critical | 2021-02-09 | – | 366 |
| Unauthenticated RCE in Taskcluster web-server via GraphQL filter argument (sift $where)Analysed#3782701 | Valid | Mozilla | Command and Code Injection | Critical | 2026-08-05 | $12,000 | 361 |
| RCE via npm misconfig -- installing internal libraries from the public registryAnalysed#1007014 | Valid | Uber | Command and Code Injection | Critical | 2021-02-24 | $9,000 | 325 |
| Malformed .BMP file in Counter-Strike 1.6 may cause shellcode injectionAnalysed#397545 | Valid | Valve | Memory Corruption | High | 2020-02-27 | – | 321 |
| Arbitrary Code Execution via npm misconfiguration – installing internal libraries from the public registryAnalysed#1043385 | Valid | LY Corporation | Command and Code Injection | Critical | 2021-07-05 | $11,500 | 288 |
| OOB reads in network message handlers leads to RCEAnalysed#807772 | Valid | Valve | Memory Corruption | Critical | 2021-05-04 | $7,500 | 219 |
| RCE on CS:GO client using unsanitized entity ID in EntityMsg messageAnalysed#584603 | Valid | Valve | Memory Corruption | Critical | 2021-05-27 | $9,000 | 209 |
| Test-scripts for postgis in mason-repository using unsafe unzip of content from unclaimed bucket creates potential RCE-issuesAnalysed#329689 | Valid | Mapbox | Command and Code Injection | Critical | 2020-07-28 | – | 209 |
| Prototype Pollution leads to XSS on https://blog.swiftype.com/#__proto__[asd]=alert(document.domain)Analysed#998398 | Valid | Elastic | Cross-site Scripting | High | 2021-08-16 | – | 157 |
| User-assisted RCE in Slack for macOS (from official site) due to improper quarantine meta-attribute handling for downloaded filesAnalysed#470637 | Valid | Slack | No weakness recorded | High | 2019-09-14 | – | 97 |
| Remote code execution [CVE-2023-36845]Analysed#2182202 | Valid | MTN Group | No weakness recorded | Critical | 2024-10-09 | – | 87 |
| Remote Code Execution (RCE) in a DoD websiteAnalysed#248116 | Valid | U.S. Dept Of Defense | Command and Code Injection | Critical | 2019-10-04 | – | 84 |
| Pre-auth Remote Code Execution on multiple Uber SSL VPN serversAnalysed#540242 | Valid | Uber | Command and Code Injection | Critical | 2021-02-24 | $2,000 | 80 |
| File writing by Directory traversal at actionpack-page_caching and RCE by itAnalysed#519220 | Valid | Ruby on Rails | File and Path Handling | High | 2020-07-13 | $1,000 | 80 |
| CVE-2021-40870 on [52.204.160.31]Analysed#1356845 | Valid | Elastic | Command and Code Injection | Critical | 2021-10-06 | – | 75 |
| OSX slack:// protocol handler javascript injectionAnalysed#79348 | Valid | Slack | Command and Code Injection | – | 2016-06-24 | – | 72 |
| CVE-█████-35813 in █████Analysed#2200329 | Valid | Mars | File and Path Handling | Critical | 2026-02-24 | – | 71 |
| RCE on █████ via CVE-2017-10271Analysed#576887 | Valid | U.S. Dept Of Defense | Command and Code Injection | Critical | 2019-07-01 | – | 68 |
| GMP Deserialization Type Confusion Vulnerability [MyBB <= 1.8.3 RCE Vulnerability]Analysed#198734 | Valid | Internet Bug Bounty | Command and Code Injection | High | 2019-10-13 | – | 68 |
| Persistant Arbitrary code execution in mattermost androidAnalysed#1115864 | Valid | Mattermost | Command and Code Injection | High | 2021-06-03 | – | 67 |
| RCE + PAT Exfiltration via pull_request_target in privacy-configuration/auto-respond-pr.yml — Direct Supply Chain to All DDG BrowsersAnalysed#3619288 | Valid | DuckDuckGo | No weakness recorded | Critical | 2026-06-11 | – | 66 |
| Information disclosure due to debug mode enabled at Laravel instance https://mpos.mtn.co.sz/Analysed#2765259 | Valid | MTN Group | Information Disclosure | Medium | 2025-02-23 | – | 61 |
| Remote code execution via crafted pentaho report uploaded using default credentials for pentaho business serverAnalysed#1677047 | Valid | MTN Group | Command and Code Injection | Critical | 2023-12-31 | – | 59 |
| Guest Privilege Escalation to admin groupAnalysed#501081 | Valid | Rocket.Chat | Access Control | Critical | 2024-08-10 | – | 59 |
| Remote code execution and exfiltration of secret tokens by poisoning the mozilla/fxa CI build cacheAnalysed#2255750 | Valid | Mozilla | Command and Code Injection | Critical | 2024-01-20 | $8,000 | 58 |
| Remote Code Execution through DNN Cookie DeserializationAnalysed#876708 | Valid | U.S. Dept Of Defense | Command and Code Injection | High | 2020-05-27 | – | 56 |
| WordPress SOME bug in plupload.flash.swf leading to RCEAnalysed#134738 | Valid | Automattic | Command and Code Injection | – | 2016-07-10 | – | 50 |
| Log4Shell: RCE 0-day exploit on █████████Analysed#1429014 | Valid | U.S. Dept Of Defense | Command and Code Injection | Critical | 2022-01-03 | – | 48 |
| Java Deserialization RCE via JBoss on card.starbucks.inAnalysed#221294 | Valid | Starbucks | Command and Code Injection | Critical | 2017-05-22 | – | 48 |
| CVE-2017-9822 DotNetNuke Cookie Deserialization Remote Code Execution (RCE) on lonidoor.mtn.ciAnalysed#2762119 | Valid | MTN Group | Command and Code Injection | Critical | 2024-11-16 | – | 46 |
| `chrome://brave` available for navigation in Release build [-> RCE] + navigation to `chrome://*` using tab_helper ["Open in new tab"]Analysed#395737 | Valid | Brave Software | No weakness recorded | High | 2018-09-25 | – | 46 |
| forum.getmonero.org Shell uploadAnalysed#357858 | Valid | Monero | Command and Code Injection | High | 2018-07-27 | – | 43 |
| Java Deserialization RCE via JBoss JMXInvokerServlet/EJBInvokerServlet on card.starbucks.inAnalysed#153026 | Valid | Starbucks | Command and Code Injection | – | 2017-02-03 | – | 42 |
| RCE + Supply Chain Attack via pull_request_target in content-scope-scripts/semver-label.yml — Affects All DuckDuckGo BrowsersAnalysed#3619287 | Valid | DuckDuckGo | No weakness recorded | Critical | 2026-06-11 | – | 41 |
| RCE which may occur due to `ActiveSupport::MessageVerifier` or `ActiveSupport::MessageEncryptor` (especially Active storage)Analysed#473888 | Valid | Ruby on Rails | Command and Code Injection | High | 2019-03-13 | $1,500 | 41 |
| Delimiter injection in GitHub Actions core.exportVariableAnalysed#1625652 | Valid | GitHub | Misconfiguration and Insecure Design | Medium | 2022-08-18 | $4,617 | 39 |
| XSS в upload.phpAnalysed#142135 | Valid | VK.com | Cross-site Scripting | – | 2017-02-09 | $1,500 | 38 |
| Remote Code Execution on ██.8x8.com via .NET VSTATE DeserializationAnalysed#1391576 | Valid | 8x8 | Command and Code Injection | Critical | 2022-02-03 | – | 36 |
| Remote code execution by hijacking an unclaimed S3 bucket in Rocket.Chat's installation script.Analysed#399166 | Valid | Rocket.Chat | Command and Code Injection | Medium | 2018-08-28 | – | 35 |
| Unauthenticated RCE in VaultpressAnalysed#236552 | Valid | Automattic | No weakness recorded | Critical | 2017-09-15 | – | 31 |
| RCE via exposed JMX server on jabber.37signals.com/jabber.basecamp.comAnalysed#1456063 | Valid | Basecamp | Deserialization and Object Injection | Low | 2022-04-26 | $100 | 30 |
| Pre-auth RCE in ForgeRock OpenAM (CVE-2021-35464)Analysed#1248052 | Valid | U.S. Dept Of Defense | Command and Code Injection | High | 2023-12-21 | – | 30 |
| Authentication bypass and RCE on the https://████ due to exposed Cisco TelePresence SX80 with default credentialsAnalysed#684070 | Valid | U.S. Dept Of Defense | Authentication | Critical | 2021-01-12 | – | 30 |
| Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) (CVE-2021-42013)Analysed#1400238 | Valid | Internet Bug Bounty | File and Path Handling | Critical | 2021-11-19 | $1,000 | 29 |
| RCE Apache Struts2 remote command execution (S2-045) on [wifi-partner.mtn.com.gh]Analysed#1070532 | Valid | MTN Group | Command and Code Injection | High | 2021-09-09 | – | 29 |
| Lack of quarantine macOS attribute(com.apple.quarantine) leads multiple issues including RCEAnalysed#1019389 | Valid | Basecamp | No weakness recorded | Medium | 2021-04-22 | $250 | 29 |
| Remote OS Command Execution on Oracle Weblogic server via [CVE-2017-10271]Analysed#810755 | Valid | MTN Group | Command and Code Injection | Critical | 2021-04-25 | – | 29 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,686 analysed so far), which can be wrong. Data as of 2026-11-15.