漏洞目录
15,219 份公开披露报告，按弱点、厂商与发现过程组织。每条记录保留原文溯源，不做无依据的复述。
15,219公开报告
245弱点类型
428厂商
$4,934,915披露赏金
筛选结果 597 份 · 本页赏金 $31,365 · 清除筛选
漏洞类别
弱点目录
- 信息泄露1,447信息泄露
- XSS（通用）985跨站脚本
- Unlabeled967其他弱点
- 认证缺陷（通用）790身份认证
- 访问控制缺陷（通用）772访问控制
- 反射型 XSS661跨站脚本
- 存储型 XSS643跨站脚本
- 违反安全设计原则（按标题归类）531错误配置
- 资源消耗失控526拒绝服务
- 跨站请求伪造511跨站请求伪造
- 权限提升455访问控制
- 业务逻辑错误392业务逻辑
- IDOR359不安全的直接对象引用
- 代码注入344代码执行
- 开放重定向344开放重定向
- 内存破坏（通用）320内存破坏
- SQL 注入313SQL 注入
- SSRF293服务端请求伪造
- 路径遍历243路径遍历
- 命令注入（通用）234代码执行
- 密码学问题（通用）188密码学缺陷
- DOM 型 XSS178跨站脚本
- Unlabeled145信息泄露
- 点击劫持140错误配置
主要厂商目录 · 16
最新报告
- [CVE-2024-35176] DoS vulnerability in REXMLInternet Bug Bounty · 拒绝服务 · 2024-08-23 · CVE-2024-35176$2,142低危
- CVE-2024-41989: Denial-Of-Service vulnerability in the floatformat template filter when input string contains a big exponent in scientific notationInternet Bug Bounty · 拒绝服务 · 2024-09-22 · CVE-2024-41989$2,142低危
- Unbounded memory growth with session handling in TLSv1.3Internet Bug Bounty · 拒绝服务 · 2024-09-22 · CVE-2024-2511$497低危
- CVE-2024-38875: Denial-Of-Service through uncontrolled resource consumption caused by poor time complexity of strip_punctuation .Internet Bug Bounty · 拒绝服务 · 2024-08-23 · CVE-2024-38875$2,142低危
- CVE-2024-34750 Apache Tomcat DoS vulnerability in HTTP/2 connectorInternet Bug Bounty · 拒绝服务 · 2024-07-05 · CVE-2024-34750$4,920中危
- ReDoS Vulnerability in HTTP Accept Headers ParsingInternet Bug Bounty · 拒绝服务 · 2024-10-30 · CVE-2024-39316$2,642低危
- Crafted smart contract can take ~23 seconds to execute due to immense error string constructionRootstock Labs · 拒绝服务 · 2025-06-12无赏金低危
- Denial of Service in curl Request - HTTP headers eat all memorycurl · 拒绝服务 · 2024-06-18无赏金低危
- DOS: taking down a 1k users Gitlab EE instance or multiple Sidekiq instances by importing a malicious repo from a Github EE self-hosted serverGitLab · 拒绝服务 · 2024-10-09$2,300低危
- Crafted smart contract can take 1.5 minutes to execute due to inefficient CODESIZE implementationRootstock Labs · 拒绝服务 · 2025-06-12无赏金低危
- Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crashInternet Bug Bounty · 拒绝服务 · 2024-04-29 · CVE-2024-27983$3,645中危
- Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation framesInternet Bug Bounty · 拒绝服务 · 2024-04-24 · CVE-2024-27316$2,580低危
- [CVE-2024-25126] Denial of Service Vulnerability in Rack Content-Type ParsingInternet Bug Bounty · 拒绝服务 · 2024-05-22 · CVE-2024-25126无赏金低危
- [CVE-2024-26146] Header Parsing leads to Possible Denial of Service VulnerabilityInternet Bug Bounty · 拒绝服务 · 2024-05-24 · CVE-2024-26146无赏金低危
- [CVE-2024-26142] ReDoS vulnerability in Accept header parsing in Action DispatchInternet Bug Bounty · 拒绝服务 · 2024-05-22 · CVE-2024-26142无赏金低危
- Crafted smart contract can take 8 minutes to execute due to bug in modexp precompile.Rootstock Labs · 拒绝服务 · 2025-06-13无赏金中危
- HTTP/2 PUSH_PROMISE DoScurl · 拒绝服务 · 2024-03-27无赏金低危
- CVE-2024-2398: HTTP/2 push headers memory-leakcurl · 拒绝服务 · 2024-03-27 · CVE-2024-2398无赏金低危
- CVE-2024-27351: Potential regular expression denial-of-service in django.utils.text.Truncator.words()Internet Bug Bounty · 拒绝服务 · 2024-04-28 · CVE-2024-27351无赏金低危
- Action Text ReDoS (Ruby 3.1 or lower)Ruby on Rails · 拒绝服务 · 2026-06-09无赏金低危
- http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacksInternet Bug Bounty · 拒绝服务 · 2024-03-05 · CVE-2024-22019$3,495中危
- RPC service DOSMonero · 拒绝服务 · 2025-05-23无赏金低危
- Denial of Service caused by HTTP/2 CONTINUATION FloodInternet Bug Bounty · 拒绝服务 · 2024-04-22 · CVE-2024-24549$4,860中危
- "Assertion failed" in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crashNode.js · 拒绝服务 · 2024-04-08 · CVE-2024-27983无赏金中危
- Denial of Service by resource exhaustion in fetch() brotli decodingNode.js · 拒绝服务 · 2024-03-16 · CVE-2024-22025无赏金低危