Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| RCE on Steam Client via buffer overflow in Server InfoAnalysed#470520 | Valid | Valve | Memory Corruption | Critical | 2019-03-15 | – | 1,289 |
| Websites Can Run Arbitrary Code on Machines Running the 'PlayStation Now' ApplicationAnalysed#873614 | Valid | PlayStation | Command and Code Injection | Critical | 2020-12-04 | $15,000 | 780 |
| RCE and Complete Server Takeover of http://www.█████.starbucks.com.sg/Analysed#502758 | Valid | Starbucks | Command and Code Injection | Critical | 2019-04-10 | – | 572 |
| Remote Code Execution in Slack desktop apps + bonusAnalysed#783877 | Valid | Slack | Command and Code Injection | Critical | 2020-08-28 | – | 509 |
| RCE when removing metadata with ExifToolAnalysed#1154542 | Valid | GitLab | Command and Code Injection | Critical | 2021-05-14 | $20,000 | 508 |
| Open prod Jenkins instanceAnalysed#231460 | Valid | Snapchat | Information Disclosure | High | 2017-08-19 | $15,000 | 436 |
| RCE via unsafe inline Kramdown options when rendering certain Wiki pagesAnalysed#1125425 | Valid | GitLab | Command and Code Injection | Critical | 2021-04-20 | $20,000 | 427 |
| Panorama UI XSS leads to Remote Code Execution via Kick/Disconnect MessageAnalysed#631956 | Valid | Valve | Command and Code Injection | Critical | 2019-10-08 | – | 420 |
| RCE on build server via misconfigured pip installAnalysed#946409 | Valid | Yelp | Supply Chain and Malicious Code | Critical | 2021-02-09 | – | 366 |
| Unauthenticated RCE in Taskcluster web-server via GraphQL filter argument (sift $where)Analysed#3782701 | Valid | Mozilla | Command and Code Injection | Critical | 2026-08-05 | $12,000 | 361 |
| RCE via npm misconfig -- installing internal libraries from the public registryAnalysed#1007014 | Valid | Uber | Command and Code Injection | Critical | 2021-02-24 | $9,000 | 325 |
| Malformed .BMP file in Counter-Strike 1.6 may cause shellcode injectionAnalysed#397545 | Valid | Valve | Memory Corruption | High | 2020-02-27 | – | 321 |
| Arbitrary Code Execution via npm misconfiguration – installing internal libraries from the public registryAnalysed#1043385 | Valid | LY Corporation | Command and Code Injection | Critical | 2021-07-05 | $11,500 | 288 |
| Unrestricted File Upload Leads to RCE on mobile.starbucks.com.sgAnalysed#1027822 | Valid | Starbucks | Access Control | Critical | 2020-12-09 | – | 247 |
| OOB reads in network message handlers leads to RCEAnalysed#807772 | Valid | Valve | Memory Corruption | Critical | 2021-05-04 | $7,500 | 219 |
| RCE on CS:GO client using unsanitized entity ID in EntityMsg messageAnalysed#584603 | Valid | Valve | Memory Corruption | Critical | 2021-05-27 | $9,000 | 209 |
| Test-scripts for postgis in mason-repository using unsafe unzip of content from unclaimed bucket creates potential RCE-issuesAnalysed#329689 | Valid | Mapbox | Command and Code Injection | Critical | 2020-07-28 | – | 209 |
| Privilege escalation in workers containerAnalysed#692603 | Valid | Semmle | Access Control | High | 2019-09-25 | $1,500 | 206 |
| Burp Suite Professional: browser-powered crawl can write attacker-controlled files through file input handlingAnalysed#3712279 | Valid | PortSwigger Web Security | File and Path Handling | High | 2026-06-14 | $5,000 | 176 |
| Authenticated Elasticsearch Painless script execution via Query.search.sort_query on hackerone.com/graphqlAnalysed#3694007 | Valid | HackerOne | Command and Code Injection | High | 2026-06-17 | $7,000 | 174 |
| Mozilla VPN Clients: RCE via file write and path traversalAnalysed#2995025 | Valid | Mozilla | File and Path Handling | High | 2025-07-29 | $6,000 | 173 |
| [Portal 2] Remote Code Execution via voice packetsAnalysed#733267 | Valid | Valve | Memory Corruption | Critical | 2021-05-10 | $5,000 | 173 |
| RCE of Burp Scanner / Crawler via ClickjackingAnalysed#1274695 | Valid | PortSwigger Web Security | Command and Code Injection | High | 2023-10-10 | $3,000 | 172 |
| RCE as Admin defeats WordPress hardening and file permissionsAnalysed#436928 | Valid | WordPress | File and Path Handling | Critical | 2020-06-09 | – | 164 |
| [Half-Life 1] Malformed map name leads to memory corruption and code executionAnalysed#402566 | Valid | Valve | Memory Corruption | High | 2020-09-22 | $1,500 | 163 |
| Prototype Pollution leads to XSS on https://blog.swiftype.com/#__proto__[asd]=alert(document.domain)Analysed#998398 | Valid | Elastic | Cross-site Scripting | High | 2021-08-16 | – | 157 |
| Path traversal, to RCEAnalysed#733072 | Valid | GitLab | Command and Code Injection | High | 2022-06-07 | $12,000 | 142 |
| Urgent: Server side template injection via Smarty template allows for RCEAnalysed#164224 | Valid | Unikrn | Command and Code Injection | – | 2017-08-17 | – | 122 |
| Unserialize leading to arbitrary PHP function invokeAnalysed#210741 | Valid | Rockstar Games | Command and Code Injection | Critical | 2017-12-13 | – | 119 |
| Remote Code Execution on Git.imgur-dev.comAnalysed#206227 | Valid | Imgur | Command and Code Injection | Critical | 2017-04-16 | – | 119 |
| RCE/LFI on test Jenkins instance due to improper authentication flowAnalysed#258117 | Valid | Snapchat | Access Control | Medium | 2017-08-19 | – | 118 |
| Remote Code Execution (Reverse Shell) - File ManagerAnalysed#768322 | Valid | Concrete CMS | Command and Code Injection | Medium | 2020-07-21 | – | 114 |
| DLL side-loading vulnerability in Sony Music Center for PC Ver. 2.7.2 (Latest version)Analysed#3355766 | Valid | Sony | File and Path Handling | High | 2026-06-05 | – | 109 |
| Team members can trigger arbitrary code execution in Slack Desktop Apps via HTML NotificationsAnalysed#816156 | Valid | Slack | Command and Code Injection | High | 2021-05-09 | – | 107 |
| [hta3] Remote Code Execution on ████Analysed#1072832 | Valid | U.S. Dept Of Defense | Command and Code Injection | Critical | 2023-05-15 | – | 104 |
| Malformed save files (.sav) allow to write files with arbitrary extensions and content in GoldSrc-based games.Analysed#458842 | Valid | Valve | Other weaknesses | High | 2020-02-24 | $1,500 | 99 |
| User-assisted RCE in Slack for macOS (from official site) due to improper quarantine meta-attribute handling for downloaded filesAnalysed#470637 | Valid | Slack | No weakness recorded | High | 2019-09-14 | – | 97 |
| Injection in path parameter of Ingress-nginxAnalysed#2701701 | Valid | Kubernetes | Command and Code Injection | High | 2026-03-07 | – | 91 |
| CVE-2022-40604: Apache Airflow: Format String VulnerabilityAnalysed#1707287 | Valid | Internet Bug Bounty | Memory Corruption | Critical | 2025-01-18 | $8,000 | 89 |
| CVE-2024-27281: RCE vulnerability with .rdoc_options in RDocAnalysed#2438265 | Valid | Internet Bug Bounty | No weakness recorded | High | 2024-03-29 | $4,860 | 88 |
| Remote code execution [CVE-2023-36845]Analysed#2182202 | Valid | MTN Group | No weakness recorded | Critical | 2024-10-09 | – | 87 |
| Authenticated Code Execution through Phar deserialization in CSV Importer as Shop manager in WooCommerceAnalysed#403083 | Valid | Automattic | Deserialization and Object Injection | High | 2019-12-19 | – | 84 |
| Remote Code Execution (RCE) in a DoD websiteAnalysed#248116 | Valid | U.S. Dept Of Defense | Command and Code Injection | Critical | 2019-10-04 | – | 84 |
| Integrity checks according to policies can be circumvented in Node.js 20 and Node.js 18Analysed#2208860 | Valid | Internet Bug Bounty | Cryptography | Medium | 2023-11-30 | $1,270 | 82 |
| Pre-auth Remote Code Execution on multiple Uber SSL VPN serversAnalysed#540242 | Valid | Uber | Command and Code Injection | Critical | 2021-02-24 | $2,000 | 80 |
| File writing by Directory traversal at actionpack-page_caching and RCE by itAnalysed#519220 | Valid | Ruby on Rails | File and Path Handling | High | 2020-07-13 | $1,000 | 80 |
| `use-mcp`'s oauth2 process uses a window.open call with untrusted mcp server provided data allowing for code execution under the page using itAnalysed#3211031 | Valid | Cloudflare Public Bug Bounty | Cross-site Scripting | Medium | 2025-09-30 | $550 | 75 |
| CVE-2021-40870 on [52.204.160.31]Analysed#1356845 | Valid | Elastic | Command and Code Injection | Critical | 2021-10-06 | – | 75 |
| Nextcloud Desktop Client RCE via malicious URI schemesAnalysed#1078002 | Valid | Nextcloud | Injection and Smuggling | Medium | 2021-04-15 | $1,000 | 73 |
| OSX slack:// protocol handler javascript injectionAnalysed#79348 | Valid | Slack | Command and Code Injection | – | 2016-06-24 | – | 72 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.