Web
Not rated
BUG BOUNTY WRITEUPS
Information disclosure writeups
Data that shouldn't be public: PII in API responses, exposed configs, debug pages and leaky error messages. Often the start of a bigger chain.
298 reports and writeups from 2024 to 2026. 204 carry a severity from the disclosing platform, 66 of them rated High or Critical. Last updated 2026-10-30.
Latest Information disclosure reports
Search and filter all writeupsPractical Bug Bounty Hunting: Finding API Leaks, PII Exposure, and Password Reset Vulnerabilities
Medium2026-10-29
Web, API, AI
Not rated
Users with read-only access to a Nextcloud Table can enumerate its share recipients via the Tables API
HackerOneNextcloud2026-10-27
Web, API, Cloud
Low
>> XSS vs SQL Injection (SQLi): Understanding Two Common Web Application Vulnerabilities
Medium2026-10-27
Web
Not rated
Arbitrary `/tmp` read in discourse via `convert_heif!` decoder-confusion (regression of 4bf3bf6786)
HackerOneDiscourse2026-10-26
Web
Medium
14: HSTS cache import silently drops a longer-lived child beneath an includeSubDomains parent
HackerOnecurl2026-10-26
Web
Not rated
How a Public S3 Bucket Exposed Sensitive Data
Medium2026-10-16
Web, Cloud
Not rated
One Strict-Transport-Security response header empties the victim's entire HSTS store, silently,
HackerOnecurl2026-10-15
Web
Medium
CVE-2026-107928: info leak uploading over WebSockets with GnuTLS
HackerOnecurl2026-10-14
Web
Low
CVE-2026-107929: local interface connection reuse mixup
HackerOnecurl2026-10-14
Web
Low
CVE-2026-86409: stale SigV4 headers sent unintended
HackerOnecurl2026-10-14
Web
Not rated
CVE-2026-87862: HSTS cache import drops longer-lived child
HackerOnecurl2026-10-14
Web
Not rated
Information Disclosure - Unauthen Leak Private Content
HackerOneWordPress2026-10-10
Web
Medium
curl tool: --hsts is ignored for a schemeless URL starting with a slash under --proto-default http
HackerOnecurl2026-10-08
Web
Low
NO AI, How I Exposed a Database Without Injecting Anything
Medium2026-10-07
Web, AI
Not rated
You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589)
Researcher blog2026-10-06
Web
Not rated
Use-after-free read of the freed referer buffer in `curl_easy_setopt(CURLOPT_REFERER)` — stale heap bytes transmitted in an outbound `Referer:` heade
HackerOnecurl2026-10-05
Binary
High
Insecure Firestore Security Rules & PII Exposure
InfoSec Write-ups2026-09-08
Web
Not rated
Email Enumeration via Password-Protected Share Identity Verification
HackerOneNextcloud2026-09-05$100 bounty
Web, Cloud
Low
Unauthenticated testing endpoint of notify_push expose internal IP
HackerOneNextcloud2026-09-05$150 bounty
Web, API, Cloud
Medium
API token sent to URL dictated by an untrusted project .weblate file
HackerOneWeblate2026-09-04
Web, API
Medium
CVE-2026-82209: domain-scoped PSL domain cookie
HackerOnecurl2026-09-03
Web
Not rated
07: GnuTLS 0-RTT early data bypasses file-backed public-key pin verification
HackerOnecurl2026-09-02
Web
Not rated
18: Explicit IPv6 proxy zone ID silently ignored — proxy credentials sent to wrong interface
HackerOnecurl2026-08-31
Web
Not rated
ARG_CLEAR credential scrubbing wipes only UTF-8 copies on Windows Unicode builds
HackerOnecurl2026-08-27
Windows
Low
View-only offline transaction creation bypasses the long-payment-ID privacy block
HackerOneMonero2026-08-20
Web3
Medium
Background sync cache retains outgoing additional transaction secret keys
HackerOneMonero2026-08-20
Web3
Low
Adding phone number to profile By OTP brute forcing
HackerOneCoinMate.io2026-08-08$100 bounty
Web
Medium
CVE-2026-9079: stale proxy password leak
HackerOnecurl2026-06-24
Web
Medium
HTTPS proxy connection reuse lets one easy handle inherit another handle's mTLS-authenticated proxy session
HackerOnecurl2026-06-24
Web
Medium
CVE-2026-8926: password leak with netrc and user in URL
HackerOnecurl2026-06-24
Web
Low
Secure cookies leaked to HTTP origins through HTTPS forwarding proxy
HackerOnecurl2026-06-15
Web
Not rated
CURLOPT_COOKIE leaked to cross-origin redirect target — CURLOPT_UNRESTRICTED_AUTH bypass for the STRING_COOKIE path
HackerOnecurl2026-06-05
Web
Medium
PRE_PROXY change leaks stale Proxy Digest state across proxy-chain boundary
HackerOnecurl2026-06-03
Web
Not rated
SMTP connection reuse ignores --ssl-reqd / CURLOPT_USE_SSL and reuses a clear-text STARTTLS session on current master
HackerOnecurl2026-06-03
Web
Low
My First RCE by Reverse Engineering an EXE File With the Help of AI
Researcher blog2026-06-03
AI, Binary
Not rated
Unauthenticated Account Registration + Email Verification Bypass + PII Data Leak (2,480 Records) on ████████
HackerOneEssity2026-05-27
Web
Medium
HSTS multi-trailing-dot bypass-ish: possible incomplete fix for CVE-2022-30115
HackerOnecurl2026-05-18
Web
Medium
CVE-2026-4873: connection reuse ignores TLS requirement
HackerOnecurl2026-04-29
Web
Low
CVE-2026-6276: stale custom cookie host causes cookie leak
HackerOnecurl2026-04-29
Web
Low
CVE-2026-7168: cross-proxy Digest auth state leak
HackerOnecurl2026-04-29
Web
Medium
IBM Aspera HTTP Gateway stores sensitive information in clear text in easily obtainable files which can be read by an unauthenticated user.
HackerOneIBM2026-04-27
Web
High
libcurl omits IPv6 zoneid from host identity and leaks credentials/cookies across scoped link-local realms
HackerOnecurl2026-04-19
Web
Medium
libcurl reuses a learned RTSP Session header across different hosts on the same easy handle, enabling cross-host session leak and replay
HackerOnecurl2026-04-18
Web
Medium
Encryption context keys and values logged at INFO level
HackerOneAWS VDP2026-04-10
Web, Cloud
Not rated
# SCURLOPT_SSH_KNOWNHOSTS and host fingerprint pins are silently bypassed when an SSH connection is reused from the connection pool
HackerOnecurl2026-04-06
Web
Not rated
Permission Model Bypass in realpathSync.native Allows File Existence Disclosure
HackerOneNode.js2026-03-30
Web
Low
Exposed .git/config File Leading to Potential Sensitive Information Disclosure
HackerOnecurl2026-03-20
Web
Low
Unauthenticated access to private files on app.fizzy.do via Active Storage URLs leads to information disclosure
HackerOneBasecamp2026-03-16$100 bounty
Web
Low
CURLOPT_UNRESTRICTED_AUTH Dangerous Default Documentation Gap
HackerOnecurl2026-03-10
Web
Low
Publicly accessible `█████████` endpoint exposing internal user identifiers and email addresses
HackerOneMars2026-02-24
Web, API
Medium
███████ - Publicly Accessible public_html Directory Exposing WordPress Configuration
HackerOneMars2026-02-24
Web
Medium
Sensitive information exposed at [███] via /export_panelists_to_xlsx endpoint
HackerOneMars2026-02-24
Web, API
Medium
ASLR leak in Mario Kart World through LAN mode
HackerOneNintendo2026-02-19
Web
High
Information Disclosure via Logback Configuration Injection in GoCD Agent
HackerOneGoCD2026-02-04
Web
Not rated
Internal logs/info leaked via endpoint {https://203.137.128.240/server-status}
HackerOnepixiv2026-01-20
Web, API
High
Roundcube Webmail Style Sanitizer can be bypassed using CSS Character Escapes
HackerOneNextcloud2026-01-14
Web, Cloud
Medium
Exposed Extremely Sensitive Information in Public ZIP File
HackerOneU.S. Dept Of Defense2026-01-12
Web
Critical
Exposed wp-config.php file in ███ National Guard website
HackerOneU.S. Dept Of Defense2026-01-12
Web
High
Sensitive Images & Files Exposed Through Directory Listing
HackerOneU.S. Dept Of Defense2026-01-12
Web
Medium
Information Disclosure in API Endpoint /users
HackerOneU.S. Dept Of Defense2026-01-12
Web, API
Low
IDOR Exposes PII of Tens of Thousands of Users and Supervisors
HackerOneU.S. Dept Of Defense2026-01-12
Web
High
Publicly Accessible CDN Endpoint Exposing XML Metadata (including ETag)
HackerOneU.S. Dept Of Defense2026-01-12
Web, API
Low
[Critical Data Breach] Exposure of PII Data Leak via API Response
HackerOneU.S. Dept Of Defense2026-01-12
Web, API
Critical
Information Disclosure via Publicly Accessible Debug Log
HackerOneU.S. Dept Of Defense2026-01-12
Web
Low
Exposed wp-config.php file
HackerOneU.S. Dept Of Defense2026-01-12
Web
High
Secret Access Key of AWS Firehose Disclosure
HackerOneU.S. Dept Of Defense2026-01-12
Web, Cloud
High
Air Force candidate PII + recruitment chat logs accessible via BAC/IDOR on █████████ (very large/significant exposure)
HackerOneU.S. Dept Of Defense2026-01-12
Web
Critical
Critical PII Data Exposure in ORDER_ERROR_LOG
HackerOneU.S. Dept Of Defense2026-01-12
Web
High
[███] .NET Framework ObjRefs Disclosure (CVE-2024-29059)
HackerOneU.S. Dept Of Defense2026-01-12
Web
High
exposed FOUO documents, including Passport information
HackerOneU.S. Dept Of Defense2026-01-12
Web
Medium
Exposed Sensitive PDF: Misconfigured Access Controls Leading to Information Disclosure
HackerOneU.S. Dept Of Defense2026-01-12
Web
Medium
ASBS viewing other soldiers PII/Board/Board Voters/ETC
HackerOneU.S. Dept Of Defense2026-01-12
Web
Critical
Exposure of Sensitive Debug File Containing database dump with passwords in plain text
HackerOneU.S. Dept Of Defense2026-01-12
Web
High
State Isolation Failure in Multiplexed Connections (Shared Auth Context)
HackerOnecurl2026-01-08
Web
Critical
Postgres Admin Username and Password in Plain text
HackerOneUPchieve2026-01-06
Web
Low
Information disclosure via Desktop client when attempting to lock a file inside a end-to-end encrypted directory
HackerOneNextcloud2026-01-04
Web, Cloud
Not rated
Information Disclosure via “Add user” lookup in Account Management (User Access)
HackerOneRevive Adserver2025-11-19
Web
Medium
Information Disclosure via Verbose Error Messages
HackerOneRevive Adserver2025-11-19
Web
Medium
Responsible disclosure - public S3 bucket exposing JSON/config files
HackerOneAWS VDP2025-11-14
Web, Cloud
Low
Hash exposed in public repository
HackerOnecurl2025-11-11
Web, Source Code
Not rated
Microsoft `x-apikey` Exposed in Mozilla CI Public Logs
HackerOneMozilla2025-11-03$200 bounty
Web
Medium
No Confirmation Email For Email Change
HackerOneHiro2025-10-31
Web
Low
Information Disclosure
HackerOneHiro2025-10-31
Web
Medium
Blockstack Browser For Mac leaks "Core API Password" to 3rd parties
HackerOneHiro2025-10-31
Web, API
Low
curl’s persistence files inherit world-readable/writable perms from umask, leaking and tampering with cookies/HSTS/Alt-Svc caches
HackerOnecurl2025-10-28
Web
Medium
Information Disclosure via Accessible debug.log on ExactHosting
HackerOneTucows (VDP)2025-10-14
Web
Not rated
Vulnerability: XML-RPC Interface Enabled and Accessible
HackerOneTucows (VDP)2025-10-10
Web
Not rated
AWS SigV4 Signature Disclosure via Verbose Logging in libcurl
HackerOnecurl2025-10-01
Web, Cloud
Not rated
GraphQL Introspection Enabled on Shopify API Endpoint (Intended Behavior)
HackerOneShopify2025-09-17
Web, API
Not rated
Critical Information Disclosure via /talos/api/v1/files/upload
HackerOneBykea2025-09-17
Web, API
Critical
MongoDB Query Logs & Schema Leak via Unauthenticated Endpoint
HackerOneBykea2025-09-17
Web, API
Low
337k users and 1 employee leaked credentials
HackerOneKhan Academy2025-09-10
Web
High
Confirmed Security Misconfigurations on curl.se (BREACH, Missing Security Headers, ETag Info Disclosure)
HackerOnecurl2025-09-09
Web
Medium
Unauthenticated Sensitive Information Disclosure on █████████ CVE-2021-38314
HackerOneMars2025-09-02
Web
Medium
PII Exposure via Email Confirmation Link – Email Embedded in Token & Leaked via Wayback Machine
HackerOneOmise2025-08-23
Web
Medium
curl leaks destination IP via glibc getaddrinfo() UDP connect, bypassing SOCKS5/Tor
HackerOnecurl2025-08-20
Web
Not rated
█.8x8.vc/index.js: Exposed Google Maps API Key Allowing Potential Abuse of Paid Services
HackerOne8x82025-08-14$500 bounty
Web, API
Medium
IDOR - Scheduled data leak to other accounts By "projectID"
HackerOneSingleStore2025-08-12
Web
Medium
Exposure of Hard-coded Private Keys and Credentials in curl Source Repository (CWE-321)
HackerOnecurl2025-08-12
Web, Source Code
Critical
Insecure WebSocket Usage in curl Documentation and Examples (CWE-319: Cleartext Transmission of Sensitive Information)
HackerOnecurl2025-08-12
Web
High
Sample report: Denial of service
HackerOneGitHub2025-08-07
Web
Not rated
Unauthorized Disclosure of Private Emails via WakaTime Private Leaderboards
HackerOneWakaTime2025-08-03
Web
Medium
Vulnerability Report: Public Exposure of Security Audit File
HackerOnecurl2025-07-27
Web
Medium
Exposure of Private RSA Private Key in curl GitHub Repository
HackerOnecurl2025-07-23
Web, Source Code
Not rated
API Key Exposed in JavaScript File on 1Password Developer Site
HackerOne1Password - Enterprise Password Manager2025-07-18
Web, API
Not rated
exposure of personal IP address via email.
HackerOneWeblate2025-07-16
Web
Not rated
Leaked reused password for a few Khan Academy users
HackerOneKhan Academy2025-07-12
Web
High
access notes without permission
HackerOnecurl2025-07-08
Web
Not rated
Disclosure of email addresses
HackerOnecurl2025-07-08
Web
Not rated
Information disclosure identified on IBM endpoint.
HackerOneIBM2025-07-08
Web, API
Medium
Information Disclosure at : https://curl.se/.mailmap
HackerOnecurl2025-07-07
Web
High
Git repository found
HackerOnecurl2025-07-07
Web, Source Code
High
information disclosure
HackerOnecurl2025-07-07
Web
Not rated
curl doesn't hide credentials in /proc/XXX/cmdline provided via CLI arguments
HackerOnecurl2025-07-03
Web
Medium
Failure to strip Proxy-Authorization header on change in origin
HackerOnecurl2025-06-27
Web
Medium
Improper Access Control Allows Trip Hijacking and Passenger/Driver PII Disclosure
HackerOneBykea2025-06-26
Web
Medium
Exposed trip_no in WebSocket Responses Leading to Excessive information Disclosure
HackerOneBykea2025-06-26
Web
Medium
Sensitive information disclosure with malicious netrc file
HackerOnecurl2025-06-22
Web
Medium
Broken Access Control (IDOR) in Booking Detail and Bids Could Leads to Sensitive Information Disclosure
HackerOneBykea2025-06-13
Web
High
WordPress Version Exposure via ███████ on hemi.xyz
HackerOneHemi VDP2025-06-13
Web
Not rated
Public GitHub repositories for multiple HackerOne managed triage team profiles contain private HackerOne reports information
HackerOneHackerOne2025-05-31
Web
Medium
Information Disclosure of metrics fax.wavecell.com/metrics
HackerOne8x82025-05-30
Web
Low
Private AWS AMIs are temporarily being exposed publicly
HackerOneAWS VDP2025-05-29
Web, Cloud
Not rated
Customer Data Exposure via Insecure Endpoint of coupon
HackerOneMars2025-05-27
Web, API
Medium
user api key leaked
HackerOneWakaTime2025-05-13
Web, API
Not rated
Netlify Authentication Token Exposed in Public Mozilla CI Logs
HackerOneMozilla2025-05-13
Web
Critical
massive PII leakage for ███████
HackerOneMars2025-05-12
Web
Medium
debug.log leaked [█████████]
HackerOneMars2025-05-12
Web
Low
Users Data Exposure via Insecure Endpoint
HackerOneMars2025-05-12
Web, API
Medium
Unauthorized Account Access via Leaked Credentials in URL Format (Account Takeover )
HackerOneKhan Academy2025-05-07
Web
Critical
Information disclosure on IBM training service endpoint
HackerOneIBM2025-04-29
Web, API
Not rated
CVE-2025-24813: Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet
HackerOneInternet Bug Bounty2025-04-27$4,323 bounty
Web
High
Possible Sensitive Session Information Leak in Active Storage
HackerOneInternet Bug Bounty2025-04-27$4,323 bounty
Web
High
Leaked credentials ( emails and passwords , etc...)
HackerOneWakaTime2025-04-16
Web
Not rated
Login Information and Credentials Have Been Leaked on wakatime.com
HackerOneWakaTime2025-04-13
Web
Not rated
The /reports/:id.json endpoint discloses potentially sensitive user attributes when reporter summary is present
HackerOneHackerOne2025-04-01
Web, API
Critical
Django Debug Mode Enabled - Information Disclosure on api.wwm-dev.autodesk.com
HackerOneAutodesk2025-03-18
Web, API
Medium
Sensitive Information Disclosure via Back Button Post Logout on https://apps.nextcloud.com/account/
HackerOneNextcloud2025-03-16
Web, Cloud
Low
cgi scripts wordlist entry for windmail.exe has payload that sends arbitrary file read result to third-party
HackerOnePortSwigger Web Security2025-03-13$200 bounty
Windows
Low
Exposing debug.log file leads to server full path disclosure
HackerOneAutodesk2025-03-06
Web
Low
CVE-2023-5561 on Payapps.com
HackerOneAutodesk2025-03-05
Web
Medium
Sensitive API Key Leakage
HackerOneAWS VDP2025-03-04
Web, API, Cloud
Medium
Exposed proxy allows to access internal reddit domains
HackerOneReddit2025-02-24$7,500 bounty
Web
High
Information disclosure due to debug mode enabled at Laravel instance https://mpos.mtn.co.sz/
HackerOneMTN Group2025-02-23
Web
Medium
User Email Disclosure via ID-Based Invitation
HackerOneWakaTime2025-02-22
Web
Medium
Unauthorized access to PII leads to Administrator account Takeover
HackerOneMTN Group2025-02-22
Web
Critical
VSCode launch.json file exposed on hemi.xyz
HackerOneHemi VDP2025-02-21
Web
Not rated
Possible to enumerate valid files in password protected shares/files drop shares as well as spam folder with files
HackerOneNextcloud2025-02-21
Web, Cloud
Low
Wordpress users Disclosure
HackerOneAutodesk2025-02-12
Web
Critical
Showing the 150 most recent of 298. See all in the searchable index.
Every entry links to the original report or article. Secure Hyperloop doesn't copy the content. Severity comes from the disclosing platform (HackerOne). Writeups without a platform rating show "Not rated". The index has 2,810 items in total.