Vulnerabilities found on live bug-bounty programs, published as they are disclosed.
The same pipeline that hunts your surface hunts live bug-bounty programs daily. Every finding is validated, disclosed to the program, then published here: numbered, CVSS-scored, kept current. What is not disclosed yet is marked reserved. Only real findings, in writing.
33 advisories · 13 programs
| Vendor | ID | Description | CVE | Type | Date |
|---|---|---|---|---|---|
| EXNESS | RHE-002 | Pending disclosure criticalWith program | — | Insufficient postMessage Origin Validation | Aug 26, 2026 |
| Vercel Sandbox | RHE-004 | Pending disclosure highWith program | — | Server-Side Request Forgery (SSRF) | Aug 26, 2026 |
| Superhuman (formerly Grammarly) | RHE-008 | Pending disclosure highCVSS 8.2Pending disclosure | — | Missing Authentication | Aug 28, 2026 |
| Superhuman (formerly Grammarly) | RHE-009 | Pending disclosure criticalCVSS 9.0Pending disclosure | — | Incorrect Authorization | Aug 28, 2026 |
| Web.com Bug Bounty | RHE-014 | Pending disclosure highWith program | — | Improper Authentication | Sep 16, 2026 |
| Web.com Bug Bounty | RHE-018 | Pending disclosure highCVSS 8.2With program | — | Broken Access Control (BAC) | Sep 18, 2026 |
| toom Baumarkt GmbH - Webshop | RHE-033 | Pending disclosure highPending disclosure | — | Business Logic Errors | Oct 17, 2026 |
- RHE-002criticalAug 26, 2026
EXNESS
Pending disclosure
Insufficient postMessage Origin Validation—With program
- RHE-004highAug 26, 2026
Vercel Sandbox
Pending disclosure
Server-Side Request Forgery (SSRF)—With program
- RHE-008highAug 28, 2026
Superhuman (formerly Grammarly)
Pending disclosure
CVSS 8.2Missing Authentication—Pending disclosure
- RHE-009criticalAug 28, 2026
Superhuman (formerly Grammarly)
Pending disclosure
CVSS 9.0Incorrect Authorization—Pending disclosure
- RHE-014highSep 16, 2026
Web.com Bug Bounty
Pending disclosure
Improper Authentication—With program
- RHE-018highSep 18, 2026
Web.com Bug Bounty
Pending disclosure
CVSS 8.2Broken Access Control (BAC)—With program
- RHE-033highOct 17, 2026
toom Baumarkt GmbH - Webshop
Pending disclosure
Business Logic Errors—Pending disclosure
Programs are the vendors' own bug-bounty programs, not customers. A finding's title is redacted until the program discloses it; the type, severity and score stay visible so you can see what class of bug the pipeline finds.
How an advisory gets here
- 01
Found in the daily bounty pipeline
The hunting pipeline runs against live bug-bounty programs every day. What it finds there is the same class of finding it would find on your surface.
- 02
Validated before it counts
Deterministic re-check plus adversarial review. If impact can't be demonstrated, the finding doesn't ship; the same gate your own report passes.
- 03
Disclosed, then published
The program is notified first. An accepted finding appears as a reserved row until the program discloses; then the full entry publishes. Only real findings, in writing.