The newest Bug Bounty resources are on the Bug Bounty page. For a reading order instead of a date order, see the Bug Bounty learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-11-06 NEW 2026 | The Bouncer Who Only Read IPv4: SSRF in WordPress Playground’s CORS Proxy intermediate SSRF | This article details a Server-Side Request Forgery (SSRF) vulnerability discovered in WordPress Playground's CORS proxy. The proxy, designed to facilitate cross-origin requests, had a flaw where it only processed IPv4 addresses, neglecting IPv6. This oversight allowed an attacker to craft requests that bypassed intended restrictions. By manipulating hostnames and leveraging the proxy's internal routing, an attacker could trick the proxy into making requests to its own internal services, potentially exposing sensitive information or leading to further compromise. The vulnerability highlights the importance of comprehensive input validation, especially when dealing with network protocols and hostnames. |
| 2026-11-06 NEW 2026 | GitLab stored XSS in markdown via DesignReferenceFilter ($16k) intermediate XSS | GitLab's DesignReferenceFilter contained a stored XSS vulnerability, allowing arbitrary JavaScript execution. This flaw was responsibly disclosed and resulted in a $16,000 bug bounty payout. |
| 2026-11-06 NEW 2026 | PayPal stored XSS via cache poisoning ($18.9k) intermediate XSS | A stored Cross-Site Scripting (XSS) vulnerability via cache poisoning has been discovered in PayPal, potentially compromising sensitive pages like the sign-in page. This type of vulnerability is considered serious due to its ability to affect page integrity. The bounty awarded for this discovery was $18,900. |
| 2026-11-06 NEW 2026 | Intigriti August 2026 XSS Challenge Writeup intermediate 5 min read XSS | Writeup detailing a blind stored XSS vulnerability in the Intigriti August 2026 XSS challenge "Bad Reception." The exploit chains weak `channelId` validation with stored HTML injection in the report feature, then leverages an unsafe JSONP callback parameter to bypass CSP. This allows an attacker to execute arbitrary JavaScript within the moderator bot, enabling access to hidden Channel 11 and exfiltration of the flag via a webhook. The writeup also outlines effective fixes for the identified vulnerabilities. |
| 2026-11-05 NEW 2026 | How I Got Private Bug Bounty Invitations Without Hunting a Single Bug beginner Recon | This article details how the author secured private bug bounty invitations without actively hunting for vulnerabilities. Instead, they leveraged Google searches, suggesting that effective reconnaissance and understanding program scope are key. The author implies that by strategically using search engines, one can identify opportunities and engage with programs effectively, leading to invitations without direct bug hunting. |
| 2026-11-05 NEW 2026 | The AI Pentesting wave. Pay for effort vs pay for impact. news 8 min read AI Talks | Library for understanding the impact of AI on bug bounty programs, arguing that AI pentesting tools often represent a return to pay-for-effort models, contrasting with the pay-for-impact nature of bug bounty. It highlights how AI can augment researcher capabilities and expand the security testing market, but warns against the misconception of AI replacing human expertise, emphasizing the critical bottleneck of human triage and validation for genuine impact. → intigriti.com |
| 2026-11-05 NEW 2026 | 1 AI Subscription made me 100k$ in 2 months intermediate AI | The author earned over $100,000 in two months from bug bounty findings on private HackerOne programs. This significant income was generated through identifying critical vulnerabilities. The content focuses on the financial success achieved via AI subscription-related bug bounties. |
| 2026-11-05 NEW 2026 | Secure Code Review Explained: How VAPT Teams Do It, Manual and Automated beginner | This content explains how VAPT (Vulnerability Assessment and Penetration Testing) teams perform secure code reviews. It details two primary methods: manual review, where security experts examine the codebase for potential weaknesses, and automated review, utilizing tools such as Semgrep and CodeQL to scan for vulnerabilities. The explanation focuses on the process of identifying security flaws within software code. |
| 2026-11-05 NEW 2026 | AI-Powered Bug Bounty: How I Turned Claude Into a Recon & Hunting Partner intermediate AI Burp Recon | This article details how a bug bounty hunter integrated Claude, an AI, into their workflow as a reconnaissance and hunting partner. The author shares practical insights on building a modern bug bounty stack utilizing tools like Burp MCP and Chrome DevTools. The focus is on how to effectively leverage AI capabilities to enhance bug hunting efficiency and skills. |
| 2026-11-05 NEW 2026 | Understanding SQL Injection beginner SQLi | SQL injection (SQLi) is a persistent and ancient vulnerability found in modern applications. Despite its age, it remains a significant threat. This summary is based on findings from a hands-on SQLi TryHackMe room, highlighting the ongoing relevance of understanding and mitigating this attack vector. |
| 2026-11-05 NEW 2026 | Web Gauntlet ~ CyLab Security Academy CTF Write-up | SQL Injection and Filter Bypass intermediate SQLi | This write-up details how to solve the "Web Gauntlet" challenge from the CyLab Security Academy CTF. The challenge focuses on SQL injection and filter bypass techniques. By understanding how the application filters input, a path was found to exploit SQL injection vulnerabilities and gain access to sensitive information, ultimately solving the challenge. |
| 2026-11-05 NEW 2026 | I Found an Interesting DOM-Based XSS Issue in Contact Form | by Samadhan Shimple intermediate XSS | Samadhan Shimple discovered a DOM-based Cross-Site Scripting (XSS) vulnerability within a contact form. The vulnerability was found during an exploration of client-side security issues. |
| 2026-11-05 NEW 2026 | From a Profile Picture Upload to RCE: Hunting an ASP.NET/IIS Vulnerability intermediate RCE Recon | This post details a real-world penetration testing experience that led to the discovery of a Remote Code Execution (RCE) vulnerability in an ASP.NET/IIS application. The researcher's journey involved reconnaissance, analyzing application logic, and scrutinizing file upload functionalities. The vulnerability was ultimately chained from a Stored XSS flaw. |
| 2026-11-05 NEW 2026 | IDOR allows cross account workspace metadata disclosure intermediate AuthZ IDOR | An Insecure Direct Object Reference (IDOR) vulnerability has been discovered that permits unauthorized access to workspace metadata across different accounts. This means a malicious actor could potentially view sensitive information about workspaces belonging to other users or organizations without proper authorization. |
| 2026-11-04 NEW 2026 | Finding 40+ Vulnerabilities in Healthcare Software Serving More Than 100 Million Patients news 11 min read | Analysis of OpenEMR, a popular electronic health record system serving over 100 million patients, revealed 42 vulnerabilities. These issues, fixed in OpenEMR 8.5.0, included SQL injection, local file disclosure via mPDF exploitation, missing authorization, stored XSS, and unsafe file processing. The research utilized attack surface mapping, data flow analysis, and variant analysis, aided by AI, to uncover these flaws and reported them using GHSA identifiers while awaiting CVE assignment. |
| 2026-11-04 NEW 2026 | Intent Redirection to One-Click Account Takeover (But It’s a Duplicate) news AuthN | This report details an intent redirection vulnerability that could lead to a one-click account takeover. However, the vulnerability was ultimately classified as a duplicate. → abdelnasserr.medium.com |
| 2026-11-04 NEW 2026 | How a Single Leaked Client Secret Exposed a Private GitHub Repo beginner Secrets | A leaked client secret, hardcoded in a JavaScript bundle, allowed an attacker to gain full admin access to a private GitHub repository. This case study highlights how a single credential exposure can lead to significant security breaches through exploit chaining. The vulnerability demonstrated a critical path from seemingly minor code oversight to complete repository compromise. |
| 2026-11-04 NEW 2026 | A Database With the Front Door Left Open: Misconfigured Firebase Security Rules beginner AuthZ | A misconfiguration in Firebase security rules left a database exposed, akin to leaving the front door open. This vulnerability allowed unauthorized access to sensitive data. |
| 2026-11-04 NEW 2026 | Will AI Kill the Bug Bounty Industry? news AI | AI's increasing speed in finding bugs is overwhelming security teams, threatening the bug bounty industry by 2026. Previously, bug discovery was the main challenge, but AI's efficiency now inundates researchers and companies alike. This technological shift necessitates adaptation within the industry to avoid collapse. The article explores how the bug bounty landscape is evolving to address this AI-driven surge in security findings. |
| 2026-11-04 NEW 2026 | Shanti Se Poocho AI: Potential API Credential Disclosure news AI API Sec | A security researcher, Het Mehta, reported a potential API credential disclosure vulnerability in Shanti Se Poocho AI on November 3, 2026. The report details a specific bug bounty program for responsible vulnerability disclosure. The title explicitly states the issue: "Potential API Credential Disclosure." |
| 2026-11-04 NEW 2026 | Container Escapes and Linux Privilege Escalation: How They Work and How to Shut Them Down beginner AuthZ | This content explores how misconfigurations can allow container escapes to the host system and lead to Linux privilege escalation. It details the vulnerabilities that enable these escapes and the single crucial check that can detect each instance. The article then outlines the necessary fixes to prevent such security breaches, ensuring a more secure containerized environment. |
| 2026-11-04 NEW 2026 | Intigriti XSS Challenge: Beyond the Sanitizer intermediate XSS | This content describes the Intigriti XSS Challenge, focusing on techniques to bypass sanitizers and achieve Cross-Site Scripting (XSS) vulnerabilities. It details a specific vulnerability discovered in a custom sanitizer that allowed for XSS execution by exploiting a logic flaw. The challenge aims to educate participants on advanced XSS exploitation methods beyond basic input filtering. |
| 2026-11-04 NEW 2026 | One-Click Cookie Theft via Deep Link XSS (But Deep Links Are Out of Scope) intermediate XSS | This document details a "one-click" cookie theft vulnerability discovered through Cross-Site Scripting (XSS) in deep links. The exploit allows attackers to steal user cookies with a single click. However, the content explicitly states that deep links are considered out of scope for bug bounty programs, meaning this vulnerability may not be eligible for any bounty payout. The summary highlights the technical nature of the vulnerability and its exclusion from typical reward programs. → abdelnasserr.medium.com |
| 2026-11-03 2026 | The Binance Hack Raises a Critical Question: What Can a Compromised Laptop Reach? news 2 min read Secrets | Analysis of the Binance hack, which reportedly caused $6.3 billion in losses, highlights the critical security risk posed by compromised developer laptops. Attackers can leverage credentials like API keys, cloud tokens, and SSH keys stored locally to achieve lateral movement into cloud infrastructure, internal services, and production systems. Security teams must proactively discover and manage these credentials on developer workstations, removing unnecessary plaintext copies and minimizing privileged access to limit the blast radius of an endpoint compromise. → blog.gitguardian.com |
| 2026-11-03 2026 | Bug bounty hunters: Have you found security bugs in AI-generated web or mobile apps? beginner AI AuthZ Mobile | This post explores the security implications of AI-generated web and mobile applications, using an example of an iPhone app created with Codex. The author, new to Swift, built the app and is now curious about its security vulnerabilities. The content prompts bug bounty hunters to share their experiences and findings regarding security bugs in AI-generated applications, indicating a potential new frontier for bug hunting. |
| 2026-11-03 2026 | How I Found My First Bug: Information Disclosure via Exposed Directory Listing beginner | This article details a bug bounty hunter's discovery of their first vulnerability: an information disclosure through an exposed directory listing. During the reconnaissance phase of a bug bounty program, the hunter identified an accessible directory that inadvertently revealed sensitive files and configurations. This overlooked directory, often missed during automated scans, provided unauthorized access to potentially critical data. The vulnerability highlights the importance of thorough manual reconnaissance in identifying security weaknesses that might otherwise go unnoticed. |
| 2026-11-03 2026 | The Bridge Between a Web Page and the Phone Itself: Abusing an Android WebView JavaScript Interface intermediate Mobile | This content likely discusses a security vulnerability within Android's WebView component. It explains how a JavaScript interface, intended to allow web pages to interact with the native Android application, can be exploited. Attackers could potentially leverage this bridge to gain unauthorized access to device functionalities or sensitive data that the web page should not be able to reach. The summary would focus on this vulnerability, the mechanism of abuse, and the potential consequences for user security. |
| 2026-11-03 2026 | Killed by a Browser, Revived by a Backslash intermediate | A researcher discovered a critical bug that granted full JavaScript control over NASA.gov. Initially, the vulnerability appeared to be a "dead bug" and unexploitable. However, by strategically using a backslash, the researcher was able to revive the bug and achieve the desired outcome. This discovery highlights how seemingly minor details can be crucial in security research. The content mentions a successful bug discovery. |
| 2026-11-03 2026 | The Database Said No. The Disk Said Yes. intermediate | This article details a non-atomic file upload vulnerability. A server error (500) masked a successful PHP shell upload. The attack bypassed the error entirely using MIME-polyglotting, a technique that exploits how different parts of a file can be interpreted in various ways. This allowed an attacker to upload a malicious file, despite the database seemingly rejecting the upload. The database indicated failure, but the disk stored the shell, creating a dangerous bypass. |
| 2026-11-03 2026 | This Is How Phishing Links Slip Into Trusted Business Emails intermediate | This content explains how phishing links can infiltrate trusted business emails. It details a vulnerability in a purchase-inquiry workflow that allowed attacker-controlled links to be sent to recipients via legitimate business communication channels. The summary focuses on the mechanism of compromise rather than specific payout details. |
| 2026-11-03 2026 | Triager closed a detailed, verified report as "SPAM" (-10 rep penalty), and H1 Support refuses to mediate because of the resulting negative Signal. How is this allowed? news | A HackerOne user received a -10 reputation penalty and had a verified report closed as "SPAM" by a triager. HackerOne Support is refusing to mediate the dispute due to the resulting negative "Signal" score. The user is questioning how this process is allowed to happen and seeking community feedback on the platform's triage and dispute resolution mechanisms. |
| 2026-11-03 2026 | Cross-Site Scripting (XSS) via Malicious GIF Cyshield CTF 2026 intermediate XSS | This content describes a Cross-Site Scripting (XSS) vulnerability discovered during the CYSHIELD CTF 2026. The challenge involved exploiting a malicious GIF to achieve XSS. This follows a previous writeup that detailed a 2FA authentication flaw in the same CTF. |
| 2026-11-03 2026 | The Hidden IDOR Vulnerability in /me/ API Endpoints intermediate API Sec AuthZ IDOR | This guide explores Insecure Direct Object Reference (IDOR) vulnerabilities within `/me/` API endpoints. It focuses on practical bug bounty hunting techniques for discovering broken object-level authorization in modern APIs. The content provides actionable strategies for identifying these security flaws, crucial for protecting user data and improving API security. |
| 2026-11-02 2026 | Broken Access Control via Direct URL Navigation: Bypassing Premium Feature Restrictions intermediate AuthZ | This content details a security vulnerability where broken access control allowed users to bypass premium feature restrictions through direct URL navigation. The vulnerability means that even without a premium subscription, users could access restricted content simply by knowing or guessing the correct URL. This bypass indicates a flaw in how the system verifies user permissions before granting access to features intended for paying customers. |
| 2026-11-02 2026 | API Security Testing: A Complete Guide to Reconnaissance, Hidden Endpoints, Mass Assignment, and… beginner API Sec Recon | This guide covers API security testing fundamentals, including reconnaissance and identifying hidden endpoints. It also delves into common vulnerabilities like mass assignment. The content aims to equip users with the knowledge to effectively test and secure APIs. |
| 2026-11-02 2026 | The Mutation Everyone Tested, and the One Field Nobody Did: GraphQL Field-Level Authorization… intermediate API Sec AuthZ GraphQL | This article discusses a vulnerability in GraphQL's security model, specifically concerning field-level authorization bypass. While mutations were extensively tested, GraphQL's flexibility can lead to security weaknesses. The content highlights that field-level authorization is an area that was overlooked in testing, suggesting it's a potential entry point for attackers. |
| 2026-11-02 2026 | GraphQL API Security: Reconnaissance, Common Vulnerabilities, Exploitation Techniques, and… beginner API Sec GraphQL Recon | This content, published by Shadow, delves into GraphQL API security. It covers essential reconnaissance techniques, common vulnerabilities found in GraphQL APIs, and effective exploitation methods. The focus is on understanding and mitigating security risks associated with GraphQL, enabling developers and security professionals to build more robust and secure applications. |
| 2026-11-02 2026 | Intigriti Bug Bytes #241 - October 2026 🚀 news 11 min read RCE | Library for understanding PHP2Shell, covering CVE-2026-109618 & CVE-2026-109619, their four confirmed attack chains, and organizational impact. It also highlights AI's influence on bug bounty trends, customer stories on proactive security, and the implications of ID verification changes for public bug bounty programs. Additional resources include a Microsoft Edge exploit chain using logic bugs, a Discord RCE via Twitch embed, and a Google RCE via Flask session pickle deserialization. → intigriti.com |
| 2026-11-02 2026 | Logistics company admin panel compromise news | A logistics company's admin panel was compromised. This panel is crucial for managing shipping for thousands of businesses and handling customer inquiries through a support system. |
| 2026-11-02 2026 | Mozilla: Stored XSS on the public Pontoon dashboards: the latest-activity tooltip re-parses a contributor's account address as HTML news XSS | Mozilla's Pontoon dashboards had a high-severity stored XSS vulnerability. The issue stemmed from the latest-activity tooltip improperly re-parsing a contributor's account address as HTML. This allowed malicious code to be injected and stored, potentially impacting users viewing the dashboards. → hackerone.com |
| 2026-11-01 2026 | The Debugging File Nobody Removed Before Shipping: Secrets Exposed Through a Public Source Map intermediate Secrets | A critical security vulnerability was discovered when a developer accidentally shipped a source map file to production. This file, intended for debugging, exposed sensitive information like API keys and other secrets. The source map effectively de-obfuscated the compiled JavaScript code, making it readable and revealing these critical credentials. This highlights the importance of thoroughly checking production builds and removing debugging artifacts before deployment to prevent potential data breaches and unauthorized access. |
| 2026-11-01 2026 | Account Takeover via CSRF on the Email-Change Endpoint ($1,300) intermediate AuthN CSRF | A security researcher discovered a Cross-Site Request Forgery (CSRF) vulnerability in the email-change endpoint, leading to account takeover. This flaw allowed attackers to exploit user sessions to change a victim's email address without their knowledge or consent. The vulnerability was reported and the researcher was awarded a bounty of $1,300. |
| 2026-11-01 2026 | Cara Mengatasi Eror Jaringan Kali Linux & Burp Suite saat Pertama Kali Setup (Panduan… beginner Burp | This content is a practical troubleshooting guide for beginners encountering network errors when setting up Kali Linux and Burp Suite for web penetration testing and bug hunting. It aims to help users overcome initial setup challenges, likely focusing on common network configuration issues that arise during this process. The article provides solutions to ensure a smooth start in the field. |
| 2026-11-01 2026 | One Link to Unlink: CSRF in OpenAI Discord Verification Service intermediate 6 min read CSRF | Library for identifying and mitigating Cross-Site Request Forgery (CSRF) vulnerabilities, specifically detailing a finding in OpenAI's Discord verification service. The vulnerability, identified as a CSRF on the `/unlink` endpoint, allowed attackers to disconnect a user's OpenAI account from their Discord account via a crafted GET request without proper anti-CSRF tokens. This could disrupt community access and was classified as P3, medium severity, and has since been resolved. |
| 2026-11-01 2026 | CSRF in HackerOne Tray.io integration news CSRF GraphQL | Writeup of CSRF in HackerOne's Tray.io integration, demonstrating how an attacker can trick users into linking their third-party apps like Github and Jira to the attacker's HackerOne account due to a lack of CSRF protection. The vulnerability also allows unauthorized actions via the GraphQL API, such as accessing private Github repositories. This report details the exploit chain and discusses the bounty implications. |
| 2026-11-01 2026 | Wizard Takeover ATO (IDOR + CSRF) lab based on a real report intermediate 2 min read AuthN CSRF IDOR | Lab recreating a $1,500 bug on YesWeHack, combining IDOR and CSRF vulnerabilities in a pet memorial creation wizard. The lab exploits enumerable IDs, absent session binding, and a literal CSRF token acceptance to allow anonymous takeover of memorials, access to private data, and retrieval of a hidden flag. Vulnerabilities include CWE-639 (IDOR) and CWE-352 (CSRF), stemming from broken access control. |
| 2026-11-01 2026 | Intigriti Bug Bytes #241 (October 2026) news 9 min read | Library featuring techniques for exploiting logic bugs in Microsoft Edge, RCE via Discord Twitch embeds, Chrome full-chain bounties, Cloudflare XSS through SVG sanitizer bypass, and Google RCE from Flask session pickle deserialization. It also details PHP2Shell (CVE-2026-109618 & CVE-2026-109619), AI and bug bounty trends, proactive security for AI companies, and ID verification in bug bounty programs. Resources include guides on LLM prompt injection, vulnerability report writing, and a bug bounty starter kit, alongside tools like HexStrike AI and Claude-OSINT. |
| 2026-11-01 2026 | Cross-account JS execution in Basecamp Fizzy: five chained bugs to token theft advanced 7 min read AuthZ XSS | Analysis of five chained vulnerabilities in Basecamp's Fizzy application, demonstrating cross-account JavaScript execution leading to token theft. The exploit chain leverages an untrusted parameter in pagination URLs, parameterized HTML content types bypassing checks, orphaned blob authorization, Turbo's script execution with a leaked CSP nonce, and same-origin script execution to mint and steal API tokens. This research highlights the composition problem in web security, where individually safe decisions can create unintended attack paths. |
| 2026-11-01 2026 | The Hidden IDOR Vulnerability in /me/ API Endpoints intermediate AuthZ IDOR | This content discusses an Insecure Direct Object Reference (IDOR) vulnerability found in the `/me/` API endpoints. An IDOR flaw allows attackers to access or modify data they are not authorized to by manipulating object identifiers within requests. The specific details of the vulnerability and its potential impact are likely explored in the full article, which is currently only represented by its title. |
| 2026-11-01 2026 | IDOR, The Beginner’s Goldmine: The Bug Bounty Field Manual beginner 7 min read AuthZ IDOR | Manual for Insecure Direct Object Reference (IDOR) hunting in bug bounties. It details IDOR's prevalence, common patterns like sequential IDs and GraphQL node substitution, and provides a step-by-step hunting methodology using tools like Burp Suite. The manual emphasizes the core principle of authorization checks and outlines how to write effective IDOR reports. |