Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| Unrestricted File Upload Leads to RCE on mobile.starbucks.com.sgAnalysed#1027822 | Valid | Starbucks | Access Control | Critical | 2020-12-09 | – | 247 |
| Unserialize leading to arbitrary PHP function invokeAnalysed#210741 | Valid | Rockstar Games | Command and Code Injection | Critical | 2017-12-13 | – | 119 |
| Remote Code Execution on Git.imgur-dev.comAnalysed#206227 | Valid | Imgur | Command and Code Injection | Critical | 2017-04-16 | – | 119 |
| `use-mcp`'s oauth2 process uses a window.open call with untrusted mcp server provided data allowing for code execution under the page using itAnalysed#3211031 | Valid | Cloudflare Public Bug Bounty | Cross-site Scripting | Medium | 2025-09-30 | $550 | 75 |
| [RCE] Remote Code Execution via React Server Components Vulnerability CVE-2025-55182Analysed#3458235 | Valid | IBM | Command and Code Injection | Critical | 2025-12-18 | – | 67 |
| CVE-2023-5528: Insufficient input sanitization in in-tree storage plugin leads to privilege escalation on Windows nodesAnalysed#2231019 | Valid | Kubernetes | Command and Code Injection | High | 2023-12-21 | $5,000 | 67 |
| Remote Code Execution via unsafe usage of `reply.view({ raw })` in @fastify/view (EJS template engine)Analysed#3122019 | Valid | Fastify | No weakness recorded | None | 2025-05-28 | – | 66 |
| Account Takeover / Arbitrary File read and deletion / Partial code execution (intent redirection)Analysed#2289836 | Valid | MercadoLibre | Command and Code Injection | High | 2024-06-28 | – | 66 |
| Remote Code Execution identified on IBM endpoint.Analysed#3463045 | Valid | IBM | No weakness recorded | Critical | 2025-12-31 | – | 60 |
| Remote Code Execution (upload)Analysed#116575 | Valid | Legal Robot | Misconfiguration and Insecure Design | – | 2016-08-26 | – | 60 |
| Unsafe yaml load can lead to remote code executionAnalysed#2467232 | Valid | Liberapay | Deserialization and Object Injection | Low | 2024-05-04 | – | 55 |
| PHP code injection in delivery-limitation `logical` validation bypass - XML-RPC setChannelTargetingAnalysed#3781492 | Valid | Revive Adserver | Command and Code Injection | High | 2026-06-25 | – | 46 |
| F5 BIG-IP TMUI RCE - CVE-2020-5902 (██.packet8.net)Analysed#1519841 | Valid | 8x8 | Command and Code Injection | Critical | 2022-03-25 | – | 46 |
| [VK Android] Access to app protected components leads to arbitrary code executionAnalysed#1095633 | Valid | VK.com | No weakness recorded | – | 2021-05-27 | – | 43 |
| Log4j RCE on https://judge.me/reviewsAnalysed#1427589 | Valid | Judge.me | Command and Code Injection | None | 2021-12-21 | $50 | 40 |
| RCE in ███ [CVE-2021-26084]Analysed#1327769 | Valid | U.S. Dept Of Defense | Command and Code Injection | Critical | 2023-12-21 | – | 39 |
| [3DS][SSL] Use of uninitialized class member leads to RCE in eShop movie playerAnalysed#895769 | Valid | Nintendo | Memory Corruption | None | 2020-12-18 | – | 38 |
| Code injection in Nextcloud Desktop Client for macOSAnalysed#2307625 | Valid | Nextcloud | Command and Code Injection | – | 2024-06-14 | $250 | 37 |
| PHP code injection in delivery-limitation `logical` validation bypassAnalysed#3780854 | Valid | Revive Adserver | Command and Code Injection | High | 2026-06-25 | – | 35 |
| important: Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. (CVE-2024-38475)Analysed#2585378 | Valid | Internet Bug Bounty | Input Validation and Logic | High | 2024-07-13 | $4,920 | 30 |
| Remote Code Execution (RCE) in a DoD websiteAnalysed#211381 | Valid | U.S. Dept Of Defense | Command and Code Injection | Critical | 2017-04-13 | – | 29 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,437 analysed so far), which can be wrong. Data as of 2026-11-15.