Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| [hta3] Remote Code Execution on ████Analysed#1072832 | Valid | Command and Code Injection | Critical | 2023-05-15 | – | 104 |
| Remote Code Execution (RCE) in a DoD websiteAnalysed#248116 | Valid | Command and Code Injection | Critical | 2019-10-04 | – | 84 |
| RCE on █████ via CVE-2017-10271Analysed#576887 | Valid | Command and Code Injection | Critical | 2019-07-01 | – | 68 |
| Remote Code Execution through DNN Cookie DeserializationAnalysed#876708 | Valid | Command and Code Injection | High | 2020-05-27 | – | 56 |
| Log4Shell: RCE 0-day exploit on █████████Analysed#1429014 | Valid | Command and Code Injection | Critical | 2022-01-03 | – | 48 |
| SSRF in Functional Administrative Support Tool pdf generator (████) [HtUS]Analysed#1628209 | Valid | Server-Side Request Forgery | Critical | 2022-09-14 | $4,000 | 46 |
| RCE in ███ [CVE-2021-26084]Analysed#1327769 | Valid | Command and Code Injection | Critical | 2023-12-21 | – | 39 |
| Pre-auth RCE in ForgeRock OpenAM (CVE-2021-35464)Analysed#1248052 | Valid | Command and Code Injection | High | 2023-12-21 | – | 30 |
| Authentication bypass and RCE on the https://████ due to exposed Cisco TelePresence SX80 with default credentialsAnalysed#684070 | Valid | Authentication | Critical | 2021-01-12 | – | 30 |
| Remote Code Execution (RCE) in a DoD websiteAnalysed#211381 | Valid | Command and Code Injection | Critical | 2017-04-13 | – | 29 |
| [███████] Remote Code Execution at ██████ [CVE-2021-44529] [HtUS]Analysed#1624172 | Valid | Command and Code Injection | Critical | 2023-01-06 | $1,000 | 28 |
| [hta3] Remote Code Execution on https://███ via improper access control to SCORM Zip upload/importAnalysed#1122791 | Valid | Command and Code Injection | Critical | 2022-09-15 | – | 28 |
| Remote Code Execution via Insecure Deserialization in Telerik UI (CVE-2019-18935)Analysed#1174185 | Valid | Deserialization and Object Injection | Critical | 2021-06-03 | – | 27 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.