Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| CVE-2025-5399: WebSocket endless loopAnalysed#3168039 | Valid | Denial of Service | Low | 2025-06-04 | – | 58 |
| CVE-2023-38545: socks5 heap buffer overflowAnalysed#2187833 | Valid | Memory Corruption | High | 2023-10-11 | – | 55 |
| CVE-2020-8177: curl overwrite local file with -JAnalysed#887462 | Valid | Input Validation and Logic | Medium | 2020-12-05 | – | 55 |
| CVE-2025-5025: No QUIC certificate pinning with wolfSSLAnalysed#3153497 | Valid | Cryptography | Medium | 2025-05-28 | – | 54 |
| CVE-2024-9681: HSTS subdomain overwrites parent cache entryAnalysed#2764830 | Valid | Input Validation and Logic | Low | 2024-11-06 | – | 49 |
| CVE-2026-7168: cross-proxy Digest auth state leakAnalysed#3697719 | Valid | Information Disclosure | Medium | 2026-04-29 | – | 37 |
| CVE-2025-9086: Out of bounds read for cookie pathAnalysed#3294999 | Valid | Memory Corruption | Low | 2025-09-10 | – | 36 |
| CVE-2025-0167: netrc and default credential leakAnalysed#2917232 | Valid | Information Disclosure | Low | 2025-02-07 | – | 36 |
| CVE-2026-3805: use after free in SMB connection reuseAnalysed#3591944 | Valid | Memory Corruption | Medium | 2026-03-11 | – | 34 |
| CVE-2026-7009: OCSP stapling bypass with Apple SecTrustAnalysed#3694390 | Valid | Cryptography | Medium | 2026-04-29 | – | 33 |
| CVE-2024-11053: netrc + redirect credential leakAnalysed#2829063 | Valid | Information Disclosure | Low | 2024-12-11 | – | 33 |
| CVE-2026-3784: wrong proxy connection reuse with credentialsAnalysed#3584903 | Valid | Access Control | Low | 2026-03-11 | – | 30 |
| CVE-2025-10148: predictable WebSocket maskAnalysed#3330839 | Valid | Cryptography | Low | 2025-09-10 | – | 30 |
| CVE-2020-8284: trusting FTP PASV responsesAnalysed#1040166 | Valid | Information Disclosure | Low | 2021-02-09 | – | 30 |
| CVE-2023-46218: cookie mixed case PSL bypassAnalysed#2212193 | Valid | Information Disclosure | Medium | 2023-12-06 | – | 28 |
| CVE-2023-46219: HSTS long file name clears contentsAnalysed#2236133 | Valid | Cryptography | Low | 2023-12-08 | – | 27 |
| CVE-2026-3783: token leak with redirect and netrcAnalysed#3583983 | Valid | Information Disclosure | Medium | 2026-03-11 | – | 26 |
| CVE-2023-32001: fopen race conditionAnalysed#2039870 | Valid | Race Conditions | Medium | 2023-07-25 | – | 26 |
| CVE-2024-6874: macidn punycode buffer overreadAnalysed#2604391 | Valid | Memory Corruption | Low | 2024-07-24 | – | 25 |
| CVE-2019-5443: Windows Privilege Escalation: Malicious OpenSSL EngineAnalysed#608577 | Valid | Command and Code Injection | High | 2019-06-29 | – | 25 |
| CVE-2026-6276: stale custom cookie host causes cookie leakAnalysed#3671818 | Valid | Information Disclosure | Low | 2026-04-29 | – | 24 |
| CVE-2026-6253: proxy credentials leak over redirect-to proxyAnalysed#3669637 | Valid | No weakness recorded | Medium | 2026-04-29 | – | 24 |
| CVE-2025-0665: eventfd double closeAnalysed#2954286 | Valid | Race Conditions | Low | 2025-02-07 | – | 24 |
| CVE-2019-5435: An integer overflow found in /lib/urlapi.cAnalysed#547630 | Valid | Memory Corruption | Low | 2020-12-05 | – | 24 |
| CVE-2026-80256: wcurl backslash bypassAnalysed#3969820 | Valid | File and Path Handling | Medium | 2026-09-02 | – | 22 |
| CVE-2026-5545: wrong reuse of HTTP Negotiate connectionAnalysed#3642555 | Valid | Authentication | Medium | 2026-04-29 | – | 22 |
| CVE-2020-8169: Partial password leak over DNS on HTTP redirectAnalysed#874778 | Valid | Information Disclosure | Medium | 2020-12-05 | – | 21 |
| CVE-2023-28319: UAF in SSH sha256 fingerprint checkAnalysed#1913733 | Valid | Memory Corruption | Medium | 2023-05-24 | – | 20 |
| CVE-2026-6429: netrc credential leak with reused proxy connectionAnalysed#3677759 | Valid | Information Disclosure | Medium | 2026-04-29 | – | 19 |
| CVE-2022-27776: Auth/cookie leak on redirectAnalysed#1547048 | Valid | Authentication | Medium | 2022-04-27 | – | 19 |
| CVE-2025-15079: libssh global knownhost overrideAnalysed#3477116 | Valid | Cryptography | Low | 2026-01-07 | – | 18 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.