Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
StatusAny
WeaknessAny class
- Any class
- Cross-site Scripting2
- Server-Side Request Forgery1
- SQL Injection1
- Command and Code Injection7
- Memory Corruption3
- Input Validation and Logic1
- Misconfiguration and Insecure Design1
- Supply Chain and Malicious Code2
- Cryptography2
- Information Disclosure3
- Authentication4
- Access Control6
- Other weaknesses24
- No weakness recorded4
Access (title)Any
61 of 15,219 reports · 161 analysed so far
- #3637898ValidOS Command Injection in `aws-cdk-lib` NodejsFunction via Unsanitized `OsCommand` Helper (Supply Chain RCE)AWS VDP · Command and Code Injection · 2026 · High–111votes
- #3205667ValidXSS on Amazon Aquisition: elementalAWS VDP · Cross-site Scripting · 2025 · High–83votes
- #3022516ValidNon-Production API Endpoints for the Forecast Service Fail to Log to CloudTrail Resulting in Silent Permission EnumerationAWS VDP · Other weaknesses · 2025 · Medium–75votes
- #3780277ValidNon-Production API Endpoints for the Amazon S3 Tables Service Fails to Log to CloudTrail Resulting in Silent Permission EnumerationAWS VDP · Other weaknesses · 2026 · Medium–69votes
- #3426839ValidUnlimited Reuse of Coupon Code Allows Free Shipping on All Orders on ██████████AWS VDP · Input Validation and Logic · 2026 · Low–69votes
- #2894222ValidA potential risk in the aws-lambda-ecs-run-task which can be used to privilege escalation.AWS VDP · Access Control · 2024 · Medium–68votes
- #2731133ValidExternal service interaction (HTTP)AWS VDP · Server-Side Request Forgery · 2024 · High–62votes
- #3287396ValidAWS | Self Registration Internal LibreChat : Access to internal/proprietary LLMsAWS VDP · Authentication · 2025 · Low–61votes
- #3577145ValidQuickSight Authorization Bypass: Chat Agents Accessible Despite Custom Permissions DenialAWS VDP · No weakness recorded · 2026 · None–59votes
- #3014785Valid(Part 2) Non-Production API Endpoints for the Datazone Service Fail to Log to CloudTrail Resulting in Silent Permission EnumerationAWS VDP · Other weaknesses · 2025 · Medium–56votes
- #3514122InformativePassword Reuse Vulnerability on AWS Sign-in Page via Password Reset Flow leads to Security Policy ViolationAWS VDP · Authentication · 2026 · None–55votes
- #2808412ValidA potential risk in the experimental-programmatic-access-ccft which can be used to privilege escalation.AWS VDP · Access Control · 2024 · High–55votes
- #2787650InformativeReflected XSS on Amazon EC2 InstanceAWS VDP · Cross-site Scripting · 2024 · High–55votes
- #3630605ValidKiro IDE Stores Auth Tokens with World-Readable Permissions (0644)AWS VDP · Access Control · 2026 · Medium–54votes
- #3809407ValidAWS *.a2z.com | Unauthenticated Clickhouse UI : Database access + SSRFAWS VDP · Authentication · 2026 · High · no account (title)–53votes
- #3056937InformativeBedrock Guardrails Evasion with Prompt FormattingAWS VDP · No weakness recorded · 2025 · None–53votes
- #2981210ValidNon-Production API Endpoints for the Datazone Service Fail to Log to CloudTrail Resulting in Silent Permission EnumerationAWS VDP · Other weaknesses · 2025 · Medium–50votes
- #3632577ValidBedrock AgentCore Starter Toolkit Creates Gateway IAM Roles Without Confused Deputy ProtectionsAWS VDP · Access Control · 2026 · Medium–48votes
- #3558713ValidCommand Injection via Unsanitized Bundling Options in `aws-cdk-lib/aws-lambda-nodejs`AWS VDP · Command and Code Injection · 2026 · High–48votes
- #3478646ValidGitHub Retired UsernameTakeover From [aws/████████]AWS VDP · Supply Chain and Malicious Code · 2026 · Low–48votes
- #2784712InformativeInformation Disclosure Due To exposed .env file (Directory Listing) at ████████AWS VDP · Information Disclosure · 2024 · High–46votes
- #3702072Validbedrock-mantle.api.aws accepts Bedrock API keys outside the IAM Deny, CloudTrail signal, and invocation logging AWS publishes for Bedrock keysAWS VDP · Misconfiguration and Insecure Design · 2026 · Medium–45votes
- #3009411ValidNon-Production API Endpoints for the DocumentDB Elastic Service Fail to Log to CloudTrail Resulting in Silent Permission EnumerationAWS VDP · Other weaknesses · 2025 · Medium–45votes
- #3557138InformativeArbitrary Code Execution via Scanner Bypass in **aws-diagram-mcp-server** `exec()` NamespaceAWS VDP · No weakness recorded · 2026 · None–43votes
- #2794126InformativeCVE-2020-5902AWS VDP · Supply Chain and Malicious Code · 2024 · Critical–43votes
- #3620748ValidV1Plugin.Decrypt panics on empty ciphertext (Remote DoS)AWS VDP · Memory Corruption · 2026 · Medium–41votes
- #3017105InformativeSensitive API Key LeakageAWS VDP · Cryptography · 2025 · Medium–41votes
- #3591725InformativeSQL Injection Detection Bypass in AWS WAF Managed Rules (AWSManagedRulesSQLiRuleSet)AWS VDP · SQL Injection · 2026 · None–40votes
- #3021451ValidNon-Production API Endpoint for the ElastiCache Service Fails to Log to CloudTrail Resulting in Silent Permission EnumerationAWS VDP · Other weaknesses · 2025 · Medium–40votes
- #2800091ValidNon-Production API Endpoints for the bedrock-agent Service Fail to Log to CloudTrail Resulting in Silent Permission EnumerationAWS VDP · Other weaknesses · 2025 · Medium–38votes
- #2926361ValidNon-Production API Endpoints for the ssm Service Fail to Log to CloudTrail Resulting in Silent Permission EnumerationAWS VDP · Other weaknesses · 2025 · Medium–37votes
- #3382796ValidResponsible disclosure - public S3 bucket exposing JSON/config filesAWS VDP · Information Disclosure · 2025 · Low–36votes
- #2800511DuplicateSession Timeout Does Not Enforce Re-Authentication on AWS Access PortalAWS VDP · Other weaknesses · 2025 · Medium–36votes
- #3738654ValidFirecracker Out-of-bounds Read/Write Local Privilege Escalation VulnerabilityAWS VDP · Memory Corruption · 2026 · None–33votes
- #3966599ValidUnauthenticated go-httpbin servers : Leads to Cookie Tossing on *.aws.dev and Open RedirectAWS VDP · Authentication · 2026 · Medium · no account (title)–32votes
- #2999116ValidNon-Production API Endpoints for the Device Farm Service Fail to Log to CloudTrail Resulting in Silent Permission EnumerationAWS VDP · Other weaknesses · 2025 · Medium–30votes
- #2979238ValidAmazon Comprehend Medical Service Reporting "AWS Internal" for CloudTrail Events Generated from FIPS EndpointsAWS VDP · Other weaknesses · 2025 · Medium–29votes
- #3328291ValidExistence of completed pods allows for bypass of Kubernetes NetworkPolicyAWS VDP · Access Control · 2025 · Medium–28votes
- #3021618ValidNon-Production API Endpoint for the EventBridge Service Fails to Log to CloudTrail Resulting in Silent Permission EnumerationAWS VDP · Other weaknesses · 2025 · Medium–26votes
- #3897236ValidRCE in AWS Amplify CLI via Prototype Chain Traversal in amplify-velocity-templateAWS VDP · Command and Code Injection · 2026 · High–25votes
- #3620753ValidV2Plugin.Decrypt panics on empty ciphertext (Remote DoS)AWS VDP · Memory Corruption · 2026 · Medium–25votes
- #2951803ValidNon-Production API Endpoints for the bedrock Service Fail to Log to CloudTrail Resulting in Silent Permission EnumerationAWS VDP · Other weaknesses · 2025 · Medium–25votes
- #3217840InformativeRemote Code Execution in Amazon MWAA due to outdated Apache Airflow versionAWS VDP · Command and Code Injection · 2025 · None–24votes
- #3633123ValidIncomplete Input Sanitization in CodeInterpreter install_packages Allows Command Injection via pip FlagsAWS VDP · Command and Code Injection · 2026 · High–23votes
- #3419587ValidAWS Auto Scaling Service Reporting "AWS Internal" for CloudTrail Events Generated from Specific EndpointsAWS VDP · Other weaknesses · 2026 · Medium–23votes
- #3029552ValidNon-Production API Endpoints for the Global Accelerator Service Fail to Log to CloudTrail Resulting in Silent Permission EnumerationAWS VDP · Other weaknesses · 2025 · Medium–23votes
- #2972435ValidNon-Production API Endpoints for the cloudwatch Service Fail to Log to CloudTrail Resulting in Silent Permission EnumerationAWS VDP · Other weaknesses · 2025 · Medium–23votes
- #2805173ValidA potential risk in the cloudFrontExtensionsConsole which can be used to privilege escalation.AWS VDP · Access Control · 2024 · Medium–23votes
- #3620761InformativeHealth check errors silently dropped when channel buffer fullAWS VDP · No weakness recorded · 2026 · None–22votes
- #3775702ValidNon-Production API Endpoints for the Amazon Cloudwatch Fails to Log to CloudTrail Resulting in Silent Permission EnumerationAWS VDP · Other weaknesses · 2026 · Medium–21votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.