Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| BAD Code !#180074 | N/A | Paragon Initiative Enterprises | Command and Code Injection | None | 2016-11-04 | – | 549 |
| How the Bug stole hackingAnalysed#762510 | Valid | HackerOne | Insecure Direct Object Reference | None | 2019-12-20 | – | 471 |
| HackerOne making payments in USDC (Coinbase stable coin)Analysed#1220747 | Valid | HackerOne | No weakness recorded | None | 2021-06-17 | – | 201 |
| Takeover of Twitter-owned domain at mobileapplinking.comAnalysed#321699 | Valid | X / xAI | Input Validation and Logic | None | 2019-02-28 | – | 159 |
| DNS Rebinding SSRF in Burp Suite MCP Server Enables Internal Network Access via send_http1_request ToolAnalysed#3176157 | Valid | PortSwigger Web Security | Server-Side Request Forgery | None | 2025-10-08 | – | 144 |
| Open redirect#2957962 | Spam | XVIDEOS | Open Redirect | None | 2025-02-06 | – | 143 |
| Reflected XSS in twitterflightschool.comAnalysed#770349 | Valid | X / xAI | Cross-site Scripting | None | 2020-02-21 | – | 140 |
| Private program disclosure via `vpn_suspended` GraphQL queryAnalysed#715192 | Valid | HackerOne | Information Disclosure | None | 2019-10-21 | $2,500 | 138 |
| Business Logic Error – Bypass of OTP Verification During Signup on hover.comAnalysed#3255473 | Valid | Tucows (VDP) | Input Validation and Logic | None | 2025-09-02 | – | 135 |
| [3DS][SSL] Improper certificate validation allows an attacker to perform MitM attacksAnalysed#894922 | Valid | Nintendo | Cryptography | None | 2020-12-18 | – | 129 |
| How the Arch Angel stole Live EventsAnalysed#2285198 | Valid | HackerOne | No weakness recorded | None | 2023-12-15 | – | 98 |
| Cloud Computer Hackerone Triager can be Accessible for everyone [h1_analyst_lucas+view@wearehackerone.com] computer#2263294 | Informative | HackerOne | Input Validation and Logic | None | 2024-05-10 | – | 91 |
| Blind Stored XSS in HackerOne's Sal 4.1.4.2149 (sal.████.com)Analysed#995995 | Valid | HackerOne | Cross-site Scripting | None | 2020-11-09 | – | 84 |
| admin.shopify.com: Shopify Flow continues sending internal emails to a configured recipient after the staff author is removed#3628961 | Informative | Shopify | No weakness recorded | None | 2026-07-03 | – | 78 |
| another liberapay member team twitter account broken Link Hijacking via Expired Twitter Account Link#3723002 | Informative | Liberapay | Open Redirect | None | 2026-05-09 | – | 77 |
| Leaked credentials ( emails and passwords , etc...)Analysed#3091909 | Valid | WakaTime | Information Disclosure | None | 2025-04-16 | – | 77 |
| Exposure of shopify employee summit page allows anonymous user to place orders for free books#2552027 | Informative | Shopify | Input Validation and Logic | None | 2024-07-29 | – | 76 |
| Bypass rate limiting on /users/password (possibly site-wide rate limit bypass?)Analysed#170310 | Valid | HackerOne | Misconfiguration and Insecure Design | None | 2016-12-08 | – | 76 |
| #**CSV Injection in shared passwords leads to complete Private Vault Exfiltration**#3042984 | Informative | 1Password - Enterprise Password Manager | Injection and Smuggling | None | 2025-04-12 | – | 75 |
| Login Information and Credentials Have Been Leaked on wakatime.comAnalysed#3090641 | Valid | WakaTime | Information Disclosure | None | 2025-04-13 | – | 74 |
| Password Reset link hijacking via Host Header PoisoningAnalysed#226659 | Valid | Concrete CMS | Access Control | None | 2017-06-06 | – | 73 |
| Port 587 SMPT Open: Can send any mail remotely from the internal mail users to company mail id's.Analysed#2264982 | Valid | SideFX | No weakness recorded | None | 2024-02-01 | $300 | 71 |
| Email Verification Bypass via Race Condition#3020733 | Informative | Malwarebytes | Authentication | None | 2025-08-15 | – | 70 |
| Deprecated Hacker101 coursework repository mentions Heroku App that is susceptible to takeoverAnalysed#514451 | Valid | HackerOne | Server-Side Request Forgery | None | 2019-04-04 | $500 | 68 |
| Remote Code Execution via unsafe usage of `reply.view({ raw })` in @fastify/view (EJS template engine)Analysed#3122019 | Valid | Fastify | No weakness recorded | None | 2025-05-28 | – | 66 |
| Login email verification bypass via `/oauth/token`.#2676025 | Informative | GitLab | Authentication | None | 2024-09-03 | – | 66 |
| Improper input validation On Exported deep-link handler crashes `FileDisplayActivity` on crafted external URL — Denial-of-ServiceAnalysed#3399016 | Valid | Nextcloud | Memory Corruption | None | 2026-05-01 | – | 65 |
| user api key leakedAnalysed#3098717 | Valid | WakaTime | Information Disclosure | None | 2025-05-13 | – | 65 |
| HTTP Parameter Pollution using semicolons in iframe element at hackerone.com/careers allows loading external Greenhouse formsAnalysed#298265 | Valid | HackerOne | No weakness recorded | None | 2018-03-13 | – | 65 |
| Session Persistence Designed to Keep Users Logged In Across Multiple Devices (Intended Behaviour)#3161827 | Informative | Shopify | Authentication | None | 2025-09-04 | – | 63 |
| API Key Exposed in JavaScript File on 1Password Developer Site#2923061 | N/A | 1Password - Enterprise Password Manager | Information Disclosure | None | 2025-07-18 | – | 62 |
| LLM03: Training Data Poisoning via ASCII decoding#2370955 | Informative | HackerOne | Injection and Smuggling | None | 2024-05-28 | – | 61 |
| HackerOne customer submitted sensitive link to VirusTotal, exposing confidential informationAnalysed#378122 | Valid | HackerOne | Information Disclosure | None | 2018-07-26 | – | 60 |
| QuickSight Authorization Bypass: Chat Agents Accessible Despite Custom Permissions DenialAnalysed#3577145 | Valid | AWS VDP | No weakness recorded | None | 2026-05-12 | – | 59 |
| Stored XSS on https://events.hackerone.comAnalysed#1028332 | Valid | HackerOne | Cross-site Scripting | None | 2021-03-26 | – | 59 |
| H1514 [beerify.shopifycloud.com] GraphQL discloses internal beer consumptionAnalysed#419883 | Valid | Shopify | Information Disclosure | None | 2019-05-08 | $802 | 57 |
| Register & create a ticket as somebody else on HackerOne SupportAnalysed#2082680 | Valid | HackerOne | Misconfiguration and Insecure Design | None | 2023-07-31 | – | 56 |
| Password Reuse Vulnerability on AWS Sign-in Page via Password Reset Flow leads to Security Policy Violation#3514122 | Informative | AWS VDP | Authentication | None | 2026-02-26 | – | 55 |
| Open Redirect on http://events.hackerone.com/redirect?url=https://naglinagli.github.ioAnalysed#1028345 | Valid | HackerOne | Open Redirect | None | 2021-03-26 | – | 54 |
| Bedrock Guardrails Evasion with Prompt Formatting#3056937 | Informative | AWS VDP | No weakness recorded | None | 2025-05-15 | – | 53 |
| Internal Blind Server-Side Request Forgery (SSRF) allows scanning internal ports#2015554 | Informative | Mozilla | Server-Side Request Forgery | None | 2024-01-12 | – | 53 |
| Open Redirection in index.php pageAnalysed#320376 | Valid | HackerOne | Open Redirect | None | 2018-03-07 | – | 53 |
| Private Emails of Moz Workers Leaked in Public file#2696294 | Informative | Mozilla | No weakness recorded | None | 2024-09-04 | – | 52 |
| sentry Auth Token exposed publicly in docker hub imageAnalysed#2412983 | Valid | Mozilla | Information Disclosure | None | 2024-10-18 | – | 51 |
| RCE in 'Copy as Node Request' BApp via code injectionAnalysed#1167530 | Valid | PortSwigger Web Security | Command and Code Injection | None | 2021-04-22 | – | 51 |
| `/names.nsf` and all `/names*` files route to public API on rubygems.org#3097900 | Spam | RubyGems | Access Control | None | 2025-05-03 | – | 46 |
| Unauthenticated API Access Exposing Premium Content and Financial Data#2979176 | N/A | XVIDEOS | Information Disclosure | None | 2025-02-09 | – | 46 |
| Any WARP User Can Access Organization-Specific Application#2802817 | Informative | Cloudflare Public Bug Bounty | Authentication | None | 2025-05-19 | – | 46 |
| Information Disclosure: .dockerignore file is publicly accessible#2888001 | Informative | Flickr | No weakness recorded | None | 2025-01-14 | – | 45 |
| Race Condition on Create API FunctionAnalysed#2682392 | Valid | Enjin | Race Conditions | None | 2024-10-15 | – | 45 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.