The same pipeline that hunts your surface hunts live bug-bounty programs daily. Every finding is validated, disclosed to the program, then published here — numbered, CVSS-scored, kept current. What is not disclosed yet is marked reserved. Only real findings, in writing.
18 advisories · 9 programs
| Vendor | ID | Description | CVE | Type | Date |
|---|---|---|---|---|---|
| EXNESS | RHE-002 | Pending disclosure criticalWith program | — | Insufficient postMessage Origin Validation | Aug 26, 2026 |
| Vercel Sandbox | RHE-003 | Pending disclosure highWith program | — | Server-Side Request Forgery (SSRF) | Aug 26, 2026 |
| Superhuman (formerly Grammarly) | RHE-008 | Pending disclosure highCVSS 8.2Pending disclosure | — | Missing Authentication | Aug 28, 2026 |
| Superhuman (formerly Grammarly) | RHE-009 | Pending disclosure criticalCVSS 9.0Pending disclosure | — | Incorrect Authorization | Aug 28, 2026 |
| Web.com Bug Bounty | RHE-014 | Pending disclosure highWith program | — | Improper Authentication | Sep 16, 2026 |
| Web.com Bug Bounty | RHE-018 | Pending disclosure highCVSS 8.2With program | — | Broken Access Control (BAC) | Sep 18, 2026 |
EXNESS
Pending disclosure
With program
Vercel Sandbox
Pending disclosure
With program
Superhuman (formerly Grammarly)
Pending disclosure
Pending disclosure
Superhuman (formerly Grammarly)
Pending disclosure
Pending disclosure
Web.com Bug Bounty
Pending disclosure
With program
Web.com Bug Bounty
Pending disclosure
With program
Programs are the vendors' own bug-bounty programs — not customers. A finding's title is redacted until the program discloses it; the type, severity and score stay visible so you can see what class of bug the pipeline finds.
The hunting pipeline runs against live bug-bounty programs every day. What it finds there is the same class of finding it would find on your surface.
Deterministic re-check plus adversarial review. If impact can't be demonstrated, the finding doesn't ship — the same gate your own report passes.
The program is notified first. An accepted finding appears as a reserved row until the program discloses; then the full entry publishes. Only real findings, in writing.