Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
13 of 15,219 reports · 227 analysed so far
- #3302484InformativeCWE-195 in ExternalMemoryAccounter::Increase()Node.js · No weakness recorded · 2025–55votes
- #3736889InformativeNULL pointer dereference in node:sqlite DatabaseSync#applyChangeset() via malformed SQLite changesetNode.js · Memory Corruption · 2026 · High–44votes
- #3781015InformativeIncomplete Fix for CVE-2026-21637: OCSPRequest and resumeSession Events Crash Node.js TLS Server via Unhandled Synchronous ExceptionsNode.js · Denial of Service · 2026 · High–41votes
- #3255707InformativeWindows Device Names Still Allow Path Traversal in UNC Paths After CVE-2025-27210 FixNode.js · File and Path Handling · 2025 · High–39votes
- #3752489InformativeMemory Corruption via TOCTOU Race in SharedArrayBuffer UTF-8 Decode (`StringBytes::Encode`)Node.js · Race Conditions · 2026 · High–32votes
- #3463949InformativeMissing AES-GCM Authentication Tag Validation and Improper Deprecation HandlingNode.js · Cryptography · 2025 · High–24votes
- #2260337InformativePermissions can be bypassed via arbitrary code execution through abusing libuv signal pipesNode.js · Access Control · 2024–20votes
- #3817602InformativeNode --run POSIX positional argument escaping allows shell command injectionNode.js · Command and Code Injection · 2026 · High–13votes
- #878181InformativeChild process environment injection via prototype pollutionNode.js · Command and Code Injection · 2020–3votes
- #678487InformativeHostname spoofingNode.js · No weakness recorded · 2020–3votes
- #771596InformativeCRLF Injection in legacy url API (url.parse().hostname)Node.js · Injection and Smuggling · 2020–2votes
- #340053InformativeUse After Free in crypto.randomFillNode.js · Memory Corruption · 2020–2votes
- #676710InformativeHttp response is not ended although underlying socket is already destroyedNode.js · Denial of Service · 2020–1votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.