Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
SSRF via URL Parser Differential in `normalize_request_url` (wlc)Analysed#3887969	Valid	Server-Side Request Forgery	High	2026-09-02	–	43
Reset password cookie leads to account takeoverAnalysed#1004536	Valid	Input Validation and Logic	Medium	2020-10-12	–	41
Incomplete fix for CVE-2022-23915: Mercurial argument injection in HgRepository.get_file() leads to command executionAnalysed#3874004	Valid	Command and Code Injection	High	2026-09-15	–	34
CSRF with logout actionAnalysed#1971589	Valid	Cross-Site Request Forgery	–	2023-06-16	–	29
API token sent to URL dictated by an untrusted project .weblate fileAnalysed#3825141	Valid	Information Disclosure	Medium	2026-09-04	–	27
Memory exhaustion (DoS) via unbounded file read in `EncodingDiscovery.detect_encoding()`Analysed#4028616	Valid	Denial of Service	Medium	2026-10-16	–	24
Incomplete VCS metadata exclusion: `.svn` / `.bzr` bypass CVE-2026-61792 due to missing `VCS_METADATA_DIRS` entries.Analysed#4037976	Valid	File and Path Handling	Medium	2026-10-30	–	21
Race Condition allows to get more free trials and get more than 100 languages and strings for freeAnalysed#1087188	Valid	Input Validation and Logic	Low	2021-02-25	–	20
Broken Authentication – Session Token bugAnalysed#400826	Valid	No weakness recorded	None	2018-09-26	–	19
Uploaded XLF files result in External Entity ExecutionAnalysed#232614	Valid	Injection and Smuggling	High	2017-06-02	–	18
Uncaught RecursionError crash in translation-finder (deep directory tree DoS)Analysed#4022462	Valid	Denial of Service	Low	2026-10-14	–	16

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.