Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
WeaknessAny class
- Any class
- Cross-site Scripting7
- Cross-Site Request Forgery12
- Open Redirect4
- Server-Side Request Forgery1
- Command and Code Injection4
- Injection and Smuggling2
- File and Path Handling2
- Memory Corruption4
- Race Conditions1
- Denial of Service6
- Input Validation and Logic13
- Misconfiguration and Insecure Design23
- Cryptography7
- Information Disclosure10
- Authentication15
- Access Control5
- Insecure Direct Object Reference1
- No weakness recorded40
Access (title)Any
157 of 15,219 reports · 227 analysed so far
- #3869124Valid**Unauthenticated IDOR allows modification of payment customer billing information**Weblate · Insecure Direct Object Reference · 2026 · High · no account (title)–72votes
- #3179850Validexposure of personal IP address via email.Weblate · Information Disclosure · 2025–61votes
- #3887969ValidSSRF via URL Parser Differential in `normalize_request_url` (wlc)Weblate · Server-Side Request Forgery · 2026 · High–43votes
- #1004536ValidReset password cookie leads to account takeoverWeblate · Input Validation and Logic · 2020–41votes
- #3874004ValidIncomplete fix for CVE-2022-23915: Mercurial argument injection in HgRepository.get_file() leads to command executionWeblate · Command and Code Injection · 2026 · High–34votes
- #3518571ValidArgument Injection in /manage/ssh/ via host parameter leads to sensitive file disclosure on WeblateWeblate · No weakness recorded · 2026–34votes
- #3898281ValidUnauthenticated ?q= search query causes exponential pyparsing backtracking under a process-global lock in WeblateWeblate · Denial of Service · 2026 · High · no account (title)–33votes
- #1971589ValidCSRF with logout actionWeblate · Cross-Site Request Forgery · 2023–29votes
- #236398Validno captcha for register user and weak question attacker can spam emailWeblate · Misconfiguration and Insecure Design · 2019–29votes
- #3825141ValidAPI token sent to URL dictated by an untrusted project .weblate fileWeblate · Information Disclosure · 2026 · Medium–27votes
- #4028616ValidMemory exhaustion (DoS) via unbounded file read in `EncodingDiscovery.detect_encoding()`Weblate · Denial of Service · 2026 · Medium–24votes
- #942146ValidOpen Github Repo Leaking WEBLATE SECRET KEYWeblate · Cryptography · 2020–22votes
- #4037976ValidIncomplete VCS metadata exclusion: `.svn` / `.bzr` bypass CVE-2026-61792 due to missing `VCS_METADATA_DIRS` entries.Weblate · File and Path Handling · 2026 · Medium–21votes
- #1087188ValidRace Condition allows to get more free trials and get more than 100 languages and strings for freeWeblate · Input Validation and Logic · 2021–20votes
- #634312ValidHTML injection and information disclosure in support panelWeblate · Information Disclosure · 2019–20votes
- #400826ValidBroken Authentication – Session Token bugWeblate · No weakness recorded · 2018–19votes
- #232614ValidUploaded XLF files result in External Entity ExecutionWeblate · Injection and Smuggling · 2017–18votes
- #224460ValidRate Limit Bypass on login PageWeblate · Authentication · 2017–18votes
- #4022462ValidUncaught RecursionError crash in translation-finder (deep directory tree DoS)Weblate · Denial of Service · 2026 · Low–16votes
- #229532ValidInsecure Account Removal #2Weblate · Misconfiguration and Insecure Design · 2018–16votes
- #4040149Validwlc: Project-wide download fails part-way and leaves stale archives on disk; filesystem errors surface as raw Python tracebacks.Weblate · Information Disclosure · 2026 · Low–14votes
- #4088592ValidCPU-based Denial of Service in translation-finder via O(N²) per-result wildcard mask matchingWeblate · Denial of Service · 2026 · Medium–13votes
- #1723445ValidNo rate limiting for Remove Account lead to huge Mass mailingsWeblate · Input Validation and Logic · 2022–13votes
- #253926ValidDKIM records not present, Email Hijacking is possible.....Weblate · Authentication · 2017–12votes
- #229920ValidPassword RestrictionWeblate · Misconfiguration and Insecure Design · 2017–12votes
- #4044441ValidTranslation discovery crashes on crafted filenames (regex substitution injection)Weblate · Memory Corruption · 2026 · Low–11votes
- #610219ValidStored XSS via Create Project (Add new translation project)Weblate · Cross-site Scripting · 2019–11votes
- #481654ValidNo Rate On Add SuggestWeblate · Race Conditions · 2019–11votes
- #404035Validflood of comment no rate limit on commnets >> by using different user agentWeblate · Misconfiguration and Insecure Design · 2018–11votes
- #282772Validno notification send to victim if attacker hacks/accesses his victims WebLate account.Weblate · Input Validation and Logic · 2018–11votes
- #229528ValidLogin CSRF : Login Authentication FlawWeblate · Cross-Site Request Forgery · 2017–11votes
- #225653ValidAccount Takeover using Third party Auth CSRFWeblate · Cross-Site Request Forgery · 2017–11votes
- #1971610ValidLogging in without knowing credentials after logged out actionWeblate · No weakness recorded · 2023–10votes
- #229825ValidRate Limit Issue on hosted.weblate.orgWeblate · Authentication · 2017–10votes
- #224572ValidWeak password policyWeblate · No weakness recorded · 2017–10votes
- #223461ValidWeak e-mail change functionality could lead to account takeoverWeblate · Misconfiguration and Insecure Design · 2017–10votes
- #1238749ValidNo rate Limit on Add new Translation ProjectWeblate · Authentication · 2021–9votes
- #225901ValidMissing filteration of meta characters in full name field on registration page https://demo.weblate.org/accounts/registerWeblate · Misconfiguration and Insecure Design · 2017–9votes
- #223355ValidInsecure Account RemovalWeblate · Misconfiguration and Insecure Design · 2017–9votes
- #223339ValidActivation tokens are not expiringWeblate · Cross-Site Request Forgery · 2017–9votes
- #1927499ValidTesting flow includes a DeepSource secretWeblate · Authentication · 2023–8votes
- #257376ValidMissing Restriction On String SizeWeblate · Memory Corruption · 2017–8votes
- #245450ValidReset password more than once with a reset link #2Weblate · Input Validation and Logic · 2017–8votes
- #245304ValidRunning 2 accounts with a single email #3Weblate · Input Validation and Logic · 2018–8votes
- #243594ValidReset password more than once with a reset linkWeblate · Input Validation and Logic · 2017–8votes
- #229511ValidNo Rate Limiting at /contactWeblate · Memory Corruption · 2017–8votes
- #224362DuplicateInvalidate session after password reset - hosted websiteWeblate · No weakness recorded · 2017–8votes
- #223854ValidNo Password Length Restriction leads to Denial of ServiceWeblate · Denial of Service · 2017–8votes
- #223434DuplicateImproper access control when an added email address is deleted from authenticationWeblate · Access Control · 2017–8votes
- #223337ValidNo BruteForce ProtectionWeblate · Authentication · 2017–8votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.