A structured, auto-updated database of publicly disclosed HackerOne vulnerability reports.
Use the interactive dashboard to search reports and filter them by severity, year, program, bounty, CVE, weakness, or disclosure date.
Open the HackerOne Disclosed Reports dashboard →
| Metric | Count |
|---|---|
| Total Reports | 12,745 |
| With Bounty | 2,343 |
| With CVE | 2,065 |
| Total Bounty Paid | $3,972,545 |
| Critical | 1,009 |
| High | 1,990 |
| Medium | 3,638 |
| Low | 2,327 |
Last Updated: November 06, 2026 at 03:39 AM EST
| Category | Description |
|---|---|
| By Severity | critical / high / medium / low / none |
| By Weakness | CWE-based vulnerability categories |
| By Program | One page per bug bounty program |
| By Asset Type | URL / Source Code / Android / iOS / Hardware / ... |
| By Year | Chronological disclosure timeline |
| Top Reports | Ranked by votes, bounty, CVSS, CVE |
| Top Researchers | Leaderboards by count, bounty, votes |
| Curated | Perfect CVSS 10.0 / Hall of Fame / High-sev no bounty |
reports.txt— discovered URL + title list (12,616 unique reports)index.json— structured metadata (12,745 enriched reports)reports/— individual markdown page per report