Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Improper input validation On Exported deep-link handler crashes `FileDisplayActivity` on crafted external URL — Denial-of-Service#3399016	Valid	Memory Corruption	None	2026-05-01	–	65
SMTP header injection via C-escape `\r` in the recipient display name#3913007	Valid	Memory Corruption	None	2026-10-18	–	23
Self XSS when sending HTML as a comment in the Deck app#2058556	Valid	Cross-site Scripting	None	2024-01-18	–	20
Persistent SMTP header injection via identity `organization` / `name`#3913012	Valid	Memory Corruption	None	2026-09-18	–	19
Allows any user to share their "Root" level folder by sharing "."#889795	Valid	Access Control	None	2020-06-03	–	9
Information disclosure via Desktop client when attempting to lock a file inside a end-to-end encrypted directory#3159877	Valid	Information Disclosure	None	2026-01-04	–	8
Ratelimits do not apply to OCS DataResponse#1214158	Valid	Authentication	None	2021-08-11	–	4
Contacts only sanitizes PHOTO svg if mime type is all lower case#1789602	Valid	Cross-site Scripting	None	2023-06-24	–	3
Nextcloud update checks leaks information#1173411	Informative	Information Disclosure	None	2021-05-01	–	3

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (965 analysed so far), which can be wrong. Data as of 2026-11-14.