Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| Websites Can Run Arbitrary Code on Machines Running the 'PlayStation Now' ApplicationAnalysed#873614 | Valid | PlayStation | Command and Code Injection | Critical | 2020-12-04 | $15,000 | 780 |
| Remote Code Execution in Slack desktop apps + bonusAnalysed#783877 | Valid | Slack | Command and Code Injection | Critical | 2020-08-28 | – | 509 |
| RCE when removing metadata with ExifToolAnalysed#1154542 | Valid | GitLab | Command and Code Injection | Critical | 2021-05-14 | $20,000 | 508 |
| Open prod Jenkins instanceAnalysed#231460 | Valid | Snapchat | Information Disclosure | High | 2017-08-19 | $15,000 | 436 |
| RCE via unsafe inline Kramdown options when rendering certain Wiki pagesAnalysed#1125425 | Valid | GitLab | Command and Code Injection | Critical | 2021-04-20 | $20,000 | 427 |
| Privilege escalation in workers containerAnalysed#692603 | Valid | Semmle | Access Control | High | 2019-09-25 | $1,500 | 206 |
| Burp Suite Professional: browser-powered crawl can write attacker-controlled files through file input handlingAnalysed#3712279 | Valid | PortSwigger Web Security | File and Path Handling | High | 2026-06-14 | $5,000 | 176 |
| Authenticated Elasticsearch Painless script execution via Query.search.sort_query on hackerone.com/graphqlAnalysed#3694007 | Valid | HackerOne | Command and Code Injection | High | 2026-06-17 | $7,000 | 174 |
| Mozilla VPN Clients: RCE via file write and path traversalAnalysed#2995025 | Valid | Mozilla | File and Path Handling | High | 2025-07-29 | $6,000 | 173 |
| [Portal 2] Remote Code Execution via voice packetsAnalysed#733267 | Valid | Valve | Memory Corruption | Critical | 2021-05-10 | $5,000 | 173 |
| RCE of Burp Scanner / Crawler via ClickjackingAnalysed#1274695 | Valid | PortSwigger Web Security | Command and Code Injection | High | 2023-10-10 | $3,000 | 172 |
| [Half-Life 1] Malformed map name leads to memory corruption and code executionAnalysed#402566 | Valid | Valve | Memory Corruption | High | 2020-09-22 | $1,500 | 163 |
| Path traversal, to RCEAnalysed#733072 | Valid | GitLab | Command and Code Injection | High | 2022-06-07 | $12,000 | 142 |
| Urgent: Server side template injection via Smarty template allows for RCEAnalysed#164224 | Valid | Unikrn | Command and Code Injection | – | 2017-08-17 | – | 122 |
| RCE/LFI on test Jenkins instance due to improper authentication flowAnalysed#258117 | Valid | Snapchat | Access Control | Medium | 2017-08-19 | – | 118 |
| DLL side-loading vulnerability in Sony Music Center for PC Ver. 2.7.2 (Latest version)Analysed#3355766 | Valid | Sony | File and Path Handling | High | 2026-06-05 | – | 109 |
| Team members can trigger arbitrary code execution in Slack Desktop Apps via HTML NotificationsAnalysed#816156 | Valid | Slack | Command and Code Injection | High | 2021-05-09 | – | 107 |
| [hta3] Remote Code Execution on ████Analysed#1072832 | Valid | U.S. Dept Of Defense | Command and Code Injection | Critical | 2023-05-15 | – | 104 |
| Malformed save files (.sav) allow to write files with arbitrary extensions and content in GoldSrc-based games.Analysed#458842 | Valid | Valve | Other weaknesses | High | 2020-02-24 | $1,500 | 99 |
| Injection in path parameter of Ingress-nginxAnalysed#2701701 | Valid | Kubernetes | Command and Code Injection | High | 2026-03-07 | – | 91 |
| CVE-2022-40604: Apache Airflow: Format String VulnerabilityAnalysed#1707287 | Valid | Internet Bug Bounty | Memory Corruption | Critical | 2025-01-18 | $8,000 | 89 |
| CVE-2024-27281: RCE vulnerability with .rdoc_options in RDocAnalysed#2438265 | Valid | Internet Bug Bounty | No weakness recorded | High | 2024-03-29 | $4,860 | 88 |
| Authenticated Code Execution through Phar deserialization in CSV Importer as Shop manager in WooCommerceAnalysed#403083 | Valid | Automattic | Deserialization and Object Injection | High | 2019-12-19 | – | 84 |
| Integrity checks according to policies can be circumvented in Node.js 20 and Node.js 18Analysed#2208860 | Valid | Internet Bug Bounty | Cryptography | Medium | 2023-11-30 | $1,270 | 82 |
| Nextcloud Desktop Client RCE via malicious URI schemesAnalysed#1078002 | Valid | Nextcloud | Injection and Smuggling | Medium | 2021-04-15 | $1,000 | 73 |
| URL Scheme Validation Bypass in Shopify Mobile App Allows Javascript ExecutionAnalysed#1737358 | Valid | Shopify | Access Control | Low | 2025-09-17 | – | 65 |
| CVE-2022-40127: RCE in Apache Airflow <2.4.0 bash exampleAnalysed#1776476 | Valid | Internet Bug Bounty | Command and Code Injection | High | 2023-01-05 | $4,000 | 60 |
| [Source Engine] Material path truncation leads to Remote Code ExecutionAnalysed#544096 | Valid | Valve | Input Validation and Logic | High | 2021-05-06 | $2,500 | 60 |
| Arbitrary code execution in desktop client via OpenSSL configAnalysed#622170 | Valid | Nextcloud | Command and Code Injection | Medium | 2020-08-05 | $100 | 59 |
| Ingress nginx annotation injection causes arbitrary command executionAnalysed#1728174 | Valid | Kubernetes | Command and Code Injection | High | 2023-11-24 | $2,500 | 57 |
| RCE on worker host due to unsanitized "env" variable name in task definition on community-tc.services.mozilla.comAnalysed#2221404 | Valid | Mozilla | Command and Code Injection | Low | 2024-12-08 | $500 | 56 |
| [Kafka Connect] [JdbcSinkConnector][HttpSinkConnector] RCE by leveraging file upload via SQLite JDBC driver and SSRF to internal JolokiaAnalysed#1547877 | Valid | Aiven Ltd | File and Path Handling | Critical | 2022-11-08 | $5,000 | 56 |
| RCE in 'Copy as Node Request' BApp via code injectionAnalysed#1167530 | Valid | PortSwigger Web Security | Command and Code Injection | None | 2021-04-22 | – | 51 |
| Buffer overflow in PyCArg_repr in _ctypes/callproc.c for Python 3.x to 3.9.1Analysed#1084342 | Valid | Internet Bug Bounty | Memory Corruption | High | 2021-08-25 | $1,500 | 51 |
| Remote code execution on rubygems.orgAnalysed#274990 | Valid | RubyGems | Deserialization and Object Injection | Critical | 2017-11-09 | $1,500 | 51 |
| RCE via WikiCloth markdown rendering if the `rubyluabridge` gem is installedAnalysed#1401444 | Valid | GitLab | Command and Code Injection | – | 2022-04-12 | $3,000 | 50 |
| Uncontrolled Search Path Element allows DLL hijacking for priv esc to SYSTEMAnalysed#921675 | Valid | GlassWire | Access Control | High | 2021-06-04 | $250 | 50 |
| reverb.twitter.com redirects to vulnerable reverb.guruAnalysed#158148 | Valid | X / xAI | No weakness recorded | – | 2016-10-01 | – | 50 |
| connect.8x8.com: Deserialization Vulnerability in Automation Builder via Jint→Newtonsoft serializer coercion (TypeNameHandling)Analysed#3861550 | Valid | 8x8 | Deserialization and Object Injection | Critical | 2026-09-01 | $3,000 | 49 |
| Broken parsing of Git diff allows an attacker to inject arbitrary Ruby scripts to Casks on official tapsAnalysed#1167608 | Valid | Homebrew | No weakness recorded | Critical | 2021-04-21 | – | 49 |
| Remote Code Execution in Basecamp Windows Electron AppAnalysed#1016966 | Valid | Basecamp | Command and Code Injection | High | 2020-11-19 | – | 48 |
| Synthetics Recorder: Code injection when recording website with malicious contentAnalysed#1636382 | Valid | Elastic | Command and Code Injection | High | 2023-04-08 | – | 47 |
| RCE on ingress-nginx-controller via Ingress spec.rules.http.paths.path fieldAnalysed#1620702 | Valid | Kubernetes | Command and Code Injection | High | 2023-10-26 | $2,500 | 47 |
| SSRF in Functional Administrative Support Tool pdf generator (████) [HtUS]Analysed#1628209 | Valid | U.S. Dept Of Defense | Server-Side Request Forgery | Critical | 2022-09-14 | $4,000 | 46 |
| Loading YAML in Java client can lead to command executionAnalysed#1167773 | Valid | Kubernetes | Deserialization and Object Injection | Medium | 2021-08-07 | $1,000 | 45 |
| RCE due to ImageTragick v2Analysed#402362 | Valid | pixiv | Command and Code Injection | Critical | 2021-03-16 | $2,000 | 44 |
| Out-of-bounds read in MariaDB .frm parsing enables RCE via vtable hijackingAnalysed#3897914 | Valid | MariaDB | Memory Corruption | High | 2026-09-08 | – | 43 |
| GitLab CI runner can read and poison cache of all other projectsAnalysed#301432 | Valid | GitLab | File and Path Handling | Critical | 2018-04-27 | $2,000 | 43 |
| CVE-2019-11043: a buffer underflow in fpm_main.c can lead to RCE in php-fpmAnalysed#722327 | Valid | Internet Bug Bounty | Memory Corruption | Critical | 2020-11-09 | $1,500 | 42 |
| Code inject via nginx.ingress.kubernetes.io/permanent-redirect annotationAnalysed#2039464 | Valid | Kubernetes | Command and Code Injection | High | 2023-10-25 | $2,500 | 40 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,437 analysed so far), which can be wrong. Data as of 2026-11-15.