66 records / Open collection
Public reports with the root cause, demonstrated impact, award evidence, and lessons kept together.
66 matching records
Mamba received a distinct USD 37,604.40 award. The case illustrates why temporary processing output needs explicit access isolation, with retrieval dependencies kept separate from standalone impact.
Firefly received a separately identified USD 60,000 award. The case illustrates how delegated worker authority and storage permissions can diverge from caller authorization.
One Chrome graphics report earned USD 250,000 across two award decisions.
ZDI awarded Doyensec USD 10,000 for this distinct Pwn2Own Berlin entry.
ZDI awarded Summoning Team USD 20,000 for this distinct Pwn2Own Berlin entry.
ZDI awarded Compass Security USD 40,000 for this distinct Pwn2Own Berlin entry.
Sentry documents a USD 150,000 award to Drinor Selmanaj for CVE-2026-20685.
A researcher reports USD 13,337 for a device-grant authorization-boundary failure.
Wiz confirms a USD 30,000 individual competition award for Yoni Sherez’s Redis entry, identified as CVE-2026-23631.
Wiz confirms USD 30,000 for Emil Lerner’s Redis competition entry. Two related disclosed defects remain one awarded entry.
A researcher organization reports a $150,000 base award for an exposed service identity with excessive downstream integration authority.
A researcher reports a $75,000 base award for a distinct Application Integration report.
The organizer awarded Team Xint Code USD 30,000 for this individually identified ZeroDay.cloud 2025 competition entry.
A PostgreSQL encoding-validation failure earned Team Bugz Bunnies a $30,000 individual-entry award at ZeroDay.cloud. The vendor subsequently issued CVE-2026-2006.
The organizer awarded Team Xint Code USD 30,000 for this individually identified ZeroDay.cloud 2025 competition entry.
Ordinary authenticated customers could read internal support activity; the researcher reports a USD 14,337 award.
One V8 type-consistency report earned a USD 50,000 award.
A researcher reports a $15,000 Google bounty for a Gemini Enterprise integration issue affecting persistent assistant memory.
A Google-rewarded report connected an adjacent CI misconfiguration with insufficient separation of automation trust, creating a potential Angular supply-chain impact.
Wiz confirms a USD 30,000 competition award for Daniel Firer’s PostgreSQL entry, uniquely mapped by the organizer to CVE-2026-2004.
A distinct V8 initialization-check report received a vendor-confirmed USD 50,000 award.
A Kestrel request-framing report earned a researcher-reported USD 10,000 award.
Google awarded USD 20,000 for the Colab-export finding in a multi-finding research article.
A researcher reported one dependency-confusion finding affecting GitHub build and development services and a $20,000 award.
ZDI awarded Wiz researchers USD 40,000 for this single Pwn2Own Berlin 2025 entry.
GitHub awarded USD 10,000 for a GHES comparison feature that exposed limited code across repository permission boundaries (vendor-report).
A support-system misconfiguration allowed external access to internal Confluence documentation, including limited content modification. One report received USD 12,500 split between two researchers.
A researcher-reported USD 30,000 award illustrates a gap between approval of a contribution and selection of the code executed.
ZDI awarded Wiz researchers USD 30,000 for this single Pwn2Own Berlin 2025 entry.
A browser-IDE trust-boundary report received a USD 22,500 award.
One Actifio report earned USD 10,000 after a collaboration multiplier.
A framework upgrade exposed private contributor attributes in public report responses. The vendor confirmed a USD 25,000 award; the public report supplies the underlying serialization and test-normalization explanation.
A monetized-channel account could access another monetized creator’s private email through inconsistent cross-API authorization. The researcher reports a USD 20,000 award.
One recovery report received USD 35,000 across two award events.
One cross-product privacy report received USD 3,133 and a USD 7,500 adjustment, totaling USD 10,633.
HackerOne awarded USD 25,000 in 2022 for private-program GraphQL metadata exposure; the report became public in January 2025 (primary).
Patchstack confirmed a USD 14,400 Zero Day award for an authentication-boundary flaw.
One Workspace data-disclosure finding within a broader research article earned USD 20,000.
An isolation misconfiguration exposed runner-image build infrastructure; the researcher reports a $20,000 payment.
The researcher documents USD 14,500 for one report: a 10,000 base bounty and two event bonuses.
Meta confirms a USD 44,250 total award, including bonuses, for this Quest OAuth account-access report.
Meta confirms a USD 27,200 total award for this account-verification report.
A researcher-published vendor decision documents a USD 70,000 award for CVE-2022-20465.
Meta confirmed a $30,000 base award for an Instagram application-token exposure; additional researcher-listed bonuses are excluded from the recorded amount.
A reference-validation flaw crossed the GitHub Actions trust boundary and earned USD 25,000.
The second fork-collaboration report received its own USD 10,000 award.
The first fork-collaboration finding in this article earned USD 20,000.
The cited researcher documents a USD 50,000 award for this finding.
Bhavuk Jain reports being paid $100,000 for this finding. The recorded USD denomination is a contextual inference from Apple's May 2019 program documentation, published about one year before the May 2020 disclosure.
Facebook confirms a USD 65,000 bounty payment for an error-response data-exposure report.
A USD 25,000 researcher-reported award illustrates how differing framework and controller assumptions can remove an OAuth consent boundary.
The researcher reports a $10,000 award for this finding. USD is a contextual currency inference from Facebook’s later official retrospective of its 2019 bounty program, not an explicit denomination in the individual…
The cited researcher documents a USD 30,000 award for this finding.
Shopify awarded USD 25,000 for a screenshot-service request-isolation flaw with impact bounded to one infrastructure subset.
Shopify confirms a $20,000 award for unauthorized collaborator access caused by automatic account conversion.
HackerOne awarded $12,500 for internal attachments exposed through report export in 2016. Its enduring lesson for 2026 applications is that export and interactive views must enforce the same visibility policy.
A 2013 researcher disclosure reports a $20,000 award for unauthorized recovery-phone binding. Its enduring lesson for 2026 applications is that recovery-factor possession and account-change authority require separate…
The USD 32,500 researcher-reported award illustrates the distinction between message origin and disclosure authority.
The researcher assigns a separate $62,500 award to the client-side finding labeled Bug #1.
The researcher attributes a USD 250,000 award to the article’s separately identified backend finding, Bug #2.
An authenticated media-editing operation exposed another user’s prompts and generated content because object ownership was not enforced. The researcher reports a USD 10,000 award.
A researcher-reported USD 30,000 award documents a cross-product account-linking trust failure.
A USD 66,000 researcher-reported award illustrates how weak message authentication and unsafe rendering can invalidate an SDK trust boundary.
A rejected network response left inconsistent filesystem state. The researcher reports a $20,000 award and subsequent payment.
The cited researcher documents a USD 75,000 award for this reported chain.
The cited researcher documents a USD 100,500 award for this reported chain.
No records match these filters. Try a broader search or reset the collection.
GitHub snapshot 2026-10-04
53796974ace8 · JSON exports & schemas · CC BY 4.0 content / MIT software
| / | Focus search on this page |
| Ctrl K | Search everything (command palette) |
| 1-9 | Library, Generator, Playbooks, Gadgets, Checklists, Payloads, Bypasses, Utilities, Reports |
| 0 | AI / MCP connector |
| j / k | Move selection down / up |
| Enter | Expand / open selected |
| c | Copy primary command of selected |
| f | Toggle favorite on selected tool |
| Esc | Clear search / close |