Windows
Not rated
BUG BOUNTY WRITEUPS
RCE writeups
Remote code execution, the bug everyone wants. Deserialization, template injection, file uploads and dependency issues that ended with commands running on someone else's server.
204 reports and writeups from 2024 to 2026. 47 carry a severity from the disclosing platform, 38 of them rated High or Critical. Last updated 2026-10-30.
Latest RCE reports
Search and filter all writeupsPwning 15M+ Systems by Renaming a Song: From a CMS Audit to an Upstream RCE in getID3…
Medium2026-10-28
Web
Not rated
CVE-2026-35273: SSRF to RCE in Oracle PeopleSoft
Researcher blog2026-10-27
Web
Not rated
PHP2Shell: When a Memory Bug Turns Into Remote Code Execution
Medium2026-10-25
Binary
Not rated
Web
Not rated
Web
Not rated
WordPress 7.1 Media Processing Race Enables Persistent PHP File Write and Author-to-RCE
HackerOneWordPress2026-10-21
Web
High
RCE in AWS Amplify CLI via Prototype Chain Traversal in amplify-velocity-template
HackerOneAWS VDP2026-10-13
Web, Cloud
High
Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578)
Researcher blog2026-10-09
Web
Not rated
Low-privilege RCE in MariaDB: SYS_REFCURSOR cursor-array use-after-free chained with an ST_Area heap over-read
HackerOneMariaDB2026-10-07
Binary
Critical
Dirty Cert: Cisco Smart Software Manager's Silently Patched RCE
Researcher blog2026-09-24
Web
Not rated
Is This A Joke? In The Auth Header? (F5 BIG-IP UnAuth Heap-Overflow to RCE CVE-2026-94127)
Researcher blog2026-09-23
Binary
Not rated
Out-of-bounds read in MariaDB .frm parsing enables RCE via vtable hijacking
HackerOneMariaDB2026-09-08
Web
High
curl_share TOCTOU > RCE via Curl_llist _dtor Function Pointer Hijack
HackerOnecurl2026-08-26
Web
Critical
Windows installer grants low-privileged users write access to executable P2Pool directory, enabling local code execution
HackerOneMonero2026-08-20
Web3, Windows
High
[Wii U/3DS/Switch] Improper bounds check in StationURL in all NEX clients leading to remote crash/RCE
HackerOneNintendo2026-08-07
Web
Low
Unauthenticated RCE in Taskcluster web-server via GraphQL filter argument (sift $where)
HackerOneMozilla2026-08-05$12,000 bounty
Web, API
Critical
CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys
Researcher blog2026-07-10
Windows
Not rated
OS Command Injection in `aws-cdk-lib` NodejsFunction via Unsanitized `OsCommand` Helper (Supply Chain RCE)
HackerOneAWS VDP2026-07-06
Web, Cloud, Source Code
High
Enterprise Tech In, Shell Out (Progress Kemp LoadMaster Uninitialized Heap to Pre-Auth RCE CVE-2026-8037)
Researcher blog2026-06-29
Binary
Not rated
Why Use App-Level Auth When Every Database Has Auth? (Splunk Enterprise CVE-2026-20253 Pre-Auth RCE)
Researcher blog2026-06-12
Web
Not rated
RCE + Supply Chain Attack via pull_request_target in content-scope-scripts/semver-label.yml — Affects All DuckDuckGo Browsers
HackerOneDuckDuckGo2026-06-11
Web, Source Code
Critical
RCE + PAT Exfiltration via pull_request_target in privacy-configuration/auto-respond-pr.yml — Direct Supply Chain to All DDG Browsers
HackerOneDuckDuckGo2026-06-11
Web, Source Code
Critical
My First RCE by Reverse Engineering an EXE File With the Help of AI
Researcher blog2026-06-03
AI, Binary
Not rated
MQTT CONNACK Packet Type Bypass leads to RCE via Malicious Broker
HackerOnecurl2026-05-05
Web
Critical
mruby-engine: UAF in MRubyEngine#initialize enables local RCE
HackerOneShopify2026-04-24
Web
Not rated
You’re Not Supposed To ShareFile With Everyone (Progress ShareFile Pre-Auth RCE Chain CVE-2026-2699 & CVE-2026-2701)
Researcher blog2026-04-02
Web
Not rated
Arbitrary Code Execution via Scanner Bypass in **aws-diagram-mcp-server** `exec()` Namespace
HackerOneAWS VDP2026-03-09
Web, Cloud
Not rated
XSS Vulnerability on Pressable/Atomic Hosting Platform via unescaped admin notices leads to code execution
HackerOneAutomattic2026-02-18
Web
Not rated
Command Injection on Amazon Q Developer CLI via malicious .amazonq/mcp.json leads to arbitrary code execution
HackerOneAWS VDP2026-01-16
Web, Cloud
Not rated
Remote Code Execution identified on IBM endpoint.
HackerOneIBM2025-12-31
Web, API
Critical
[RCE] Remote Code Execution via React Server Components Vulnerability CVE-2025-55182
HackerOneIBM2025-12-18
Web
Critical
`use-mcp`'s oauth2 process uses a window.open call with untrusted mcp server provided data allowing for code execution under the page using it
HackerOneCloudflare Public Bug Bounty2025-09-30$550 bounty
Web, Cloud, AI
Medium
Stack Buffer Overflow in cURL Cookie Parsing Leads to RCE
HackerOnecurl2025-09-16
Binary
High
Fuzzing a Printer: Pre-auth RCE in a Network IoT Device
Researcher blog2025-09-02
Web
Not rated
## Title Heap Use-After-Free Vulnerability in `curl` Leading to Potential Code Execution
HackerOnecurl2025-08-18
Binary
Medium
Remote Code Execution in Amazon MWAA due to outdated Apache Airflow version
HackerOneAWS VDP2025-08-14
Web, Cloud
Not rated
Title: Remote Code Execution (RCE) via Arbitrary Library Loading in `--engine` option
HackerOnecurl2025-08-10
Web
Critical
Path Traversal in SFTP QUOTE command leads to Arbitrary File Write and potential RCE
HackerOnecurl2025-08-10
Web
Critical
Mozilla VPN Clients: RCE via file write and path traversal
HackerOneMozilla2025-07-29$6,000 bounty
Web
High
Remote Code Execution via unsafe usage of `reply.view({ raw })` in @fastify/view (EJS template engine)
HackerOneFastify2025-05-28
Web
Not rated
[SECURITY] CVE-2024-50379 Apache Tomcat - RCE via write-enabled default servlet
HackerOneInternet Bug Bounty2025-05-27
Web
High
Breaking Out of Restricted Mode: XSS to RCE in Visual Studio Code
Researcher blog2025-05-14
Web
Not rated
insecure deserilize object leads to RCE On Sitecore (CVE-██████████-27218)
HackerOneMars2025-05-12
Web
Critical
CVE-2025-24813: Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet
HackerOneInternet Bug Bounty2025-04-27$4,323 bounty
Web
High
Remote Code Execution and AWS IAM Credentials Exfiltration in https://████████/
HackerOneU.S. Dept Of Defense2024-12-18
Web, Cloud
Critical
RCE on worker host due to unsanitized "env" variable name in task definition on community-tc.services.mozilla.com
HackerOneMozilla2024-12-08$500 bounty
Web
Low
Buffer Overflow Vulnerability in strcpy() Leading to Remote Code Execution
HackerOnecurl2024-12-02
Binary
Critical
From an Android Hook to RCE: $5000 Bounty
Researcher blog2024-11-19
Android
Not rated
CVE-2017-9822 DotNetNuke Cookie Deserialization Remote Code Execution (RCE) on lonidoor.mtn.ci
HackerOneMTN Group2024-11-16
Web
Critical
CVE-2020-7961 RCE Liferay Portal Unauthenticated via https://████████/
HackerOneU.S. Dept Of Defense2024-10-25
Web
Critical
Remote code execution [CVE-2023-36845]
HackerOneMTN Group2024-10-09
Web
Critical
Path traversal in AcitveStorage, and lead RCE
HackerOneRuby on Rails2024-10-08
Web
High
[Switch, PIA/MK8DX] Stack buffer overflow and potential RCE in PIA (LAN/LDN, possibly NEX) room info deserialization
HackerOneNintendo2024-09-30
Binary
Medium
Vulnerabilities in Open Source C2 Frameworks
Researcher blogBishop Fox (Sliver), Havoc, Ninja C22024-09-18
Web
Not rated
[2,500$ Bug Bounty Write-Up] Remote Code Execution (RCE) via unclaimed Node package
Medium2024-09-18$2,500 bounty
Web, Source Code
Not rated
Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in actions-console
HackerOneGitHub2024-09-17
Web
High
Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in ghe-update-check
HackerOneGitHub2024-09-17
Web
High
Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in collectd
HackerOneGitHub2024-09-17
Web
High
Attacking PowerShell CLIXML Deserialization
Researcher blogMicrosoft2024-09-13
Web
Not rated
Management Console Editor Privilege Escalation to Root SSH Access in GitHub Enterprise Server via RCE in syslog-ng
HackerOneGitHub2024-09-13
Web
High
Zero-Click Calendar invite — Critical zero-click vulnerability chain in macOS
MediumApple (macOS)2024-09-13
macOS
Not rated
We Spent $20 To Achieve RCE And Accidentally Became The Admins Of .MOBI
Researcher blog2024-09-11
Web
Not rated
Getting code execution on Veeam through CVE-2023-27532
Researcher blogVeeam2024-09-10
Web, Source Code
Not rated
CVE-2024-45195: Apache OFBiz Unauthenticated Remote Code Execution (Fixed)
Researcher blogApache OFBiz2024-09-05
Web
Not rated
Spip Preauth RCE 2024: Part 2, A Big Upload
Researcher blogSPIP2024-09-04
Web, Source Code
Not rated
4 exploits, 1 bug: exploiting cve-2024-20017 4 different ways
Researcher blogMediaTek2024-08-30
Binary
Not rated
Analysis of CVE-2024-43044 — From file read to RCE in Jenkins through agents
Researcher blogJenkins2024-08-29
Web
Not rated
$15k RCE Through Monitoring Debug Mode
Medium2024-08-28$15,000 bounty
Web
Not rated
[CVE-2021-44228] Arbitrary Code Execution on ng01-cloud.acronis.com
HackerOneAcronis2024-08-28
Web, Cloud
Critical
Back To School - Exploiting A Remote Code Execution Vulnerability In Moodle
Researcher blogMoodle2024-08-27
Web, Source Code
Not rated
Local Privilege Escalation and Code Execution when restoring files from Quarantine
HackerOneAcronis2024-08-27$250 bounty
Web
Medium
WordPress GiveWP POP to RCE (CVE-2024-5932)
Researcher blogWordfence2024-08-26
Web, Source Code
Not rated
Hitting the jackpot with RCE!
Medium2024-08-25$1,500 bounty
Web
Not rated
How I got $24000 Bounty from a Log4j RCE in Apple App Store.
MediumApple2024-08-25$24,000 bounty
Web
Not rated
Traccar 5 Remote Code Execution Vulnerabilities
Researcher blogTraccar2024-08-23
Web, Source Code
Not rated
Web
Not rated
Vulnerabilities in Homepage Dashboard
Researcher blogHomepage2024-08-22
Web
Not rated
WPML Multilingual CMS Authenticated Contributor+ Remote Code Execution (RCE) via Twig Server-Side Template Injection (SSTI)
Researcher blogWordfence2024-08-21$1,639 bounty
Web, Source Code
Not rated
From MLOps to MLOops: Exposing the Attack Surface of Machine Learning Platforms
Researcher blogJupyter, Hugging Face, MLflow2024-08-20
Web, AI
Not rated
$4,998 Bounty Awarded and 100,000 WordPress Sites Protected Against Unauthenticated Remote Code Execution Vulnerability Patched in GiveWP WordPress Plugin
Researcher blogWordfence2024-08-19$4,998 bounty
Web, Source Code
Not rated
Spip Preauth RCE 2024: Part 1, The Feather
Researcher blogSPIP2024-08-16
Web, Source Code
Not rated
How i hacked NASA? at NASA VDP
MediumNASA2024-08-10
Web
Not rated
Bucket Monopoly: Breaching AWS Accounts Through Shadow Resources
Researcher blogAWS2024-08-09
Web, Cloud
Not rated
Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server!
Researcher blogApache HTTP Server, ModSecurity, Redmine2024-08-09
Web
Not rated
Permissions can be bypassed via arbitrary code execution through abusing libuv signal pipes
HackerOneNode.js2024-08-08
Web
Not rated
Exploiting authorization by nonce in WordPress plugins
Researcher blogWordfence2024-08-05
Web, Source Code
Not rated
Unveiling Remote Code Execution in AI chatbot workflows 💵
InfoSec Write-ups2024-08-05
Web, AI
Not rated
Unveiling Remote Code Execution in AI chatbot workflows 💵
Medium2024-08-05
Web, AI
Not rated
KnowBe4 RCE and LPE
Researcher blogKnowBe42024-08-02
Web
Not rated
Pwn2Own Miami: Aveva Edge Arbitrary DLL Loading Vulnerability
MediumAVEVA2024-08-01
Web
Not rated
RCE on partner.steampowered.com
HackerOneValve2024-07-30
Web
Critical
MITMing the Xbox 360 Dashboard for Fun and RCE
Researcher blogMicrosoft (Xbox)2024-07-30
Web
Not rated
Path Traversal and Code Execution in CSLA.NET (CVE-2024-28698)
Researcher blogCSLA.NET2024-07-25
Web, Source Code
Not rated
Studying 0days: How we hacked Anki, the world's most popular flashcard app
Researcher blogAnki2024-07-24
Web, Source Code
Not rated
3 ways to get Remote Code Execution in Kafka UI
Researcher blogKafka UI2024-07-23
Web
Not rated
Arbitrary code execution in TSEC Heavy Secure, return-oriented programming in TSEC Secure ROM, and recovery of TSEC-derived cryptographic secrets
HackerOneNintendo2024-07-22
Web
Medium
JNDI Injection Remote Code Execution via Path Manipulation in MemoryUserDatabaseFactory
Researcher blog2024-07-21
Web, Source Code
Not rated
Authentication bypass and potential RCE on the https://████ due to exposed Cisco TelePresence SX80 with default credentials
HackerOneU.S. Dept Of Defense2024-07-19
Web
High
XXE with RCE potential on the https://█████████ (CVE-2017-3548)
HackerOneU.S. Dept Of Defense2024-07-19
Web
High
SSD Advisory – XenForo RCE Via CSRF
Researcher blogXenForo2024-07-16
Web, Source Code
Not rated
SSD Advisory – SonicWall SMA100 Stored XSS To RCE
Researcher blogSonicWall2024-07-12
Web
Not rated
Chaining Three Bugs to Access All Your ServiceNow Data
Researcher blogServiceNow2024-07-11
Web, Source Code
Not rated
Evernote RCE: From PDF.js font-injection to All-platform Electron exposed ipcRenderer with listened BrokerBridge Remote-Code Execution
Researcher blogEvernote2024-07-10
Web
Not rated
Shelltorch Explained: Multiple Vulnerabilities in Pytorch Model Server (Torchserve) (CVSS 9.9, CVSS 9.8) Walkthrough
Researcher blogPyTorch, AWS, Google2024-07-08
Web, Cloud, AI
Not rated
WhatsUp Gold Pre-Auth RCE WriteDataFile Primitive (CVE-2024-4883)
Researcher blogProgress (WhatsUp Gold)2024-07-08
Web, Source Code
Not rated
WhatsUp Gold Pre-Auth RCE GetFileWithoutZip Primitive (CVE-2024-4885)
Researcher blogProgress (WhatsUp Gold)2024-07-08
Web, Source Code
Not rated
Universal Code Execution by Chaining Messages in Browser Extensions
Researcher blog2024-07-07
Web
Not rated
RCE by parsing `.rdoc_options` in RDoc
HackerOneRuby2024-07-03
Web
Not rated
CVE-2024-29510 – Exploiting Ghostscript using format strings
Researcher blogGhostscript2024-07-02
Binary
Not rated
From Limited file read to full access on Jenkins (CVE-2024-23897)
Researcher blog2024-07-02
Web
Not rated
Vulnerabilities In CocoaPods Open The Door To Supply Chain Attacks Against Thousands Of iOS And MacOS Applications
Researcher blogCocoaPods2024-07-01
iOS, Source Code, macOS
Not rated
CVE-2024-27292: docAssembling exploits for RCE
Researcher blogDocassemble2024-07-01
Web
Not rated
regreSSHion: Remote Unauthenticated Code Execution Vulnerability in OpenSSH server
Researcher blogOpenSSH2024-07-01
Web
Not rated
Getting Unauthenticated Remote Code Execution On The Logsign Unified Secops Platform
Researcher blogLogsign2024-07-01
Web, Source Code
Not rated
Bytecode Breakdown: Unraveling Factorio's Lua Security Flaws
Researcher blogFactorio2024-06-29
Binary
Not rated
Account Takeover / Arbitrary File read and deletion / Partial code execution (intent redirection)
HackerOneMercadoLibre2024-06-28
Android
High
Inside Xerox WorkCentre: Two Unauthenticated RCEs
Researcher blogXerox2024-06-28
Web, Source Code
Not rated
Exploiting Steam: Usual and Unusual Ways in the CEF Framework
Researcher blogValve (Steam), Google (Chromium)2024-06-27
Web
Not rated
17 vulnerabilities in Sharp Multi-Function Printers
GitHubSharp, Toshiba2024-06-27
API, Binary
Not rated
When Prompts Go Rogue: Analyzing a Prompt Injection Code Execution in Vanna.AI
Researcher blogVanna.ai2024-06-27
Web, AI
Not rated
Probllama: Ollama Remote Code Execution Vulnerability (CVE-2024-37032) – Overview and Mitigations
Researcher blogOllama2024-06-24
Web, AI
Not rated
From a GLPI patch bypass to RCE
Researcher blogGLPI2024-06-20
Web, Source Code
Not rated
Preauth RCE on NVIDIA Triton Server
Researcher blogNvidia2024-06-19
AI, Binary
Not rated
Arbitrary File Reading leads to RCE in the Pulse Secure SSL VPN on the https://██████ (███)
HackerOneU.S. Dept Of Defense2024-06-18
Web
High
Brand-new prototype pollution gadget in MongoDB leading to RCE
InfoSec Write-upsMongoDB2024-06-17
Web
Not rated
Iconv, Set The Charset To RCE: Exploiting The Glibc To Hack The PHP Engine (Part 2)
Researcher blogGNU C Library (glibc)2024-06-17
Binary
Not rated
Re-moo-te Code Execution in Mailcow: Always Sanitize Error Messages
Researcher blogMailcow2024-06-17
Web, Source Code
Not rated
Abusing title reporting and tmux integration in iTerm2 for code execution
GitHubiTerm22024-06-16
Web
Not rated
What’s in a Name? Writing custom DNS tunnelling protocol, exploiting unexpected AWS Lambda misconfiguration – in a web app Pen test (Part 1)
Researcher blog2024-06-13
Web, Cloud
Not rated
Molding Lies Into Reality || Exploiting CVE-2024-4358
Researcher blogProgress (Telerik)2024-06-03
Web, Source Code
Not rated
Authenticated RCE via page title
HackerOneExpressionEngine2024-05-28
Web
Medium
Iconv, Set The Charset To RCE: Exploiting The Glibc To Hack The PHP Engine (Part 1)
Researcher blogGNU C Library (glibc)2024-05-27
Binary
Not rated
Wikimedia/svgtranslate 2.0.1 Remote Code Execution
Researcher blogWikimedia (SVGTranslate)2024-05-23
Web, Source Code
Not rated
The risk in malicious AI models: Wiz Research discovers critical vulnerability in AI-as-a-Service provider, Replicate
Researcher blogReplicate2024-05-23
Web, AI
Not rated
Abusing url handling in iTerm2 and Hyper for code execution
GitHubiTerm2, Vercel (Hyper)2024-05-21
Web
Not rated
My LLM Bug Bounty Journey on Hugging Face Hub via Protect AI
MediumHugging Face, Protect AI2024-05-11$3,250 bounty
Web, AI
Not rated
Hacking Apple - SQL Injection to Remote Code Execution
Researcher blogApple, Mura CMS, Masa CMS2024-05-08
Web, Source Code
Not rated
Exploit Archeology - Exploiting an old unknown Server Side Browser
Researcher blog2024-05-08
Binary
Not rated
Lethal Injection: How We Hacked Microsoft's Healthcare Chat Bot
Researcher blogMicrosoft2024-05-07$203,000 bounty
Web
Not rated
Send()-ing Myself Belated Christmas Gifts - GitHub.com's Environment Variables & GHES Shell
Researcher blogGitHub2024-05-06
Web, Source Code
Not rated
LLM Pentest: Leveraging Agent Integration For RCE
Researcher blog2024-05-06
Web, AI
Not rated
Unsafe yaml load can lead to remote code execution
HackerOneLiberapay2024-05-04
Web
Low
Devfile file write vulnerability in GitLab
Researcher blogGitLab2024-05-03
Web
Not rated
Poppin shells with Okta Verify on Windows
Researcher blogOkta2024-05-02$13,337 bounty
Windows
Not rated
CVE-2024-2887: A Pwn2Own Winning Bug In Google Chrome
Researcher blogGoogle (Chrome), Microsoft (Edge)2024-05-02
Binary
Not rated
Code Injection to RCE with .NET
Researcher blog2024-04-29
Web
Not rated
R-bitrary Code Execution: Vulnerability In R’s Deserialization (CVE-2024-27322)
Researcher blogR2024-04-29
Web
Not rated
Hello: I’m your Domain Admin and I want to authenticate against you
Researcher blogMicrosoft2024-04-24
Windows
Not rated
Dangerous Import: SourceForge Patches Critical Code Vulnerability
Researcher blogSourceForge, Apache Allura2024-04-16
Web, Source Code
Not rated
Showing the 150 most recent of 204. See all in the searchable index.
Every entry links to the original report or article. Secure Hyperloop doesn't copy the content. Severity comes from the disclosing platform (HackerOne). Writeups without a platform rating show "Not rated". The index has 2,810 items in total.