漏洞目录
15,219 份公开披露报告，按弱点、厂商与发现过程组织。每条记录保留原文溯源，不做无依据的复述。
15,219公开报告
245弱点类型
428厂商
$4,934,915披露赏金
筛选结果 1,292 份 · 本页赏金 $3,750 · 清除筛选
漏洞类别
弱点目录
- 信息泄露1,447信息泄露
- XSS（通用）985跨站脚本
- Unlabeled967其他弱点
- 认证缺陷（通用）790身份认证
- 访问控制缺陷（通用）772访问控制
- 反射型 XSS661跨站脚本
- 存储型 XSS643跨站脚本
- 违反安全设计原则（按标题归类）531错误配置
- 资源消耗失控526拒绝服务
- 跨站请求伪造511跨站请求伪造
- 权限提升455访问控制
- 业务逻辑错误392业务逻辑
- IDOR359不安全的直接对象引用
- 代码注入344代码执行
- 开放重定向344开放重定向
- 内存破坏（通用）320内存破坏
- SQL 注入313SQL 注入
- SSRF293服务端请求伪造
- 路径遍历243路径遍历
- 命令注入（通用）234代码执行
- 密码学问题（通用）188密码学缺陷
- DOM 型 XSS178跨站脚本
- Unlabeled145信息泄露
- 点击劫持140错误配置
主要厂商目录 · 16
最新报告
- CVE-2026-5545: wrong reuse of HTTP Negotiate connectioncurl · 身份认证 · 2026-04-29 · CVE-2026-5545无赏金低危
- Missing server identity policy enforcement in SSH connection reuse allows host key verification bypass via pool poisoningcurl · 身份认证 · 2026-04-03 · CVE-2022-27782无赏金中危
- Cross-room signaling injection enabling unauthorized force-muteNextcloud · 身份认证 · 2026-10-21 · CVE-2026-45266无赏金低危
- HackerOne Vulnerability Report: libcurl SSL/TLS Identity Leakage via Insecure Connection Reusecurl · 身份认证 · 2026-03-31无赏金未评级
- Out of scope: Improper Input Validation Order on /api-internal/login via password field leads to unnecessary resource consumptionPortSwigger Web Security · 身份认证 · 2026-05-05$200低危
- PIN bypass in PassCodeActivity via back buttonNextcloud · 身份认证 · 2026-06-07 · CVE-2026-45153$150低危
- Wallet RPC Restricted-Mode Policy BypassMonero · 身份认证 · 2026-08-17无赏金中危
- Unauthenticated file deletion via deleteFileMessage DDP method allows permanent destruction of any uploaded fileRocket.Chat · 身份认证 · 2026-06-16 · CVE-2026-48929无赏金中危
- Restricted RPC Policy Bypass on ZMQ JSON-RPC Allows Unauthenticated Remote Admin ActionsMonero · 身份认证 · 2026-08-17无赏金中危
- Connection Reuse Ignores OAuth Bearer Token Mismatchcurl · 身份认证 · 2026-03-10 · CVE-2022-22576无赏金低危
- Activity app does not verify federated file activity received from remote serversNextcloud · 身份认证 · 2026-09-05$150低危
- Cross‑origin cookies leak and injection risk when using a custom Host headercurl · 身份认证 · 2026-01-20无赏金未评级
- libcurl: Improper Authentication State Management on Cross-Protocol Redirectscurl · 身份认证 · 2026-01-17 · CVE-2022-27774无赏金低危
- Password Reuse Vulnerability on AWS Sign-in Page via Password Reset Flow leads to Security Policy ViolationAWS VDP · 身份认证 · 2026-02-26无赏金低危
- Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDCNextcloud · 身份认证 · 2026-06-07 · CVE-2026-45156$2,500中危
- Unauthenticated SSRF via Public Reference API -Sharing Token BypassNextcloud · 身份认证 · 2026-03-31无赏金未评级
- testing hackerone functionscurl · 身份认证 · 2025-12-13无赏金低危
- CVE-2025-14524: bearer token leak on cross-protocol redirectcurl · 身份认证 · 2026-01-07 · CVE-2025-14524无赏金低危
- Unauthenticated GraphQL access by prepending __schema to private operationsEnjin · 身份认证 · 2025-12-05$500低危
- Username Validation BypassRevive Adserver · 身份认证 · 2025-11-26 · CVE-2025-55129无赏金低危
- User enumeration via timing attack in Django mod_wsgi authentication backend leads to account discoveryDjango · 身份认证 · 2026-02-04无赏金未评级
- Authentication Token Theft via Open Redirect in Callback URL Parameterlemlist · 身份认证 · 2025-11-14无赏金高危
- Credential Disclosure via Unvalidated directDownloadUrl (Missing DontAddCredentialsAttribute)Nextcloud · 身份认证 · 2026-04-13$250低危
- Unauthorized Password Reset Allows Account Takeover Across Tenant Boundarieslemlist · 身份认证 · 2025-11-07无赏金中危
- Approval app allows users to request approval for other users fileNextcloud · 身份认证 · 2025-12-05 · CVE-2025-66515无赏金低危