{
  "generated_at": "2026-06-24T16:55:27.540290+00:00",
  "source_html": "/home/hacnho/Projects/research/huntr_mysubmission.html",
  "submission_count": 130,
  "manual_extra_count": 5,
  "entries": [
    {
      "title": "CatBoost CBM model loader segfaults on single-byte malformed binary model in catboost/catboost",
      "url": "https://huntr.com/bounties/97e7f203-d0a6-492c-a5dd-a001cc8d2a69",
      "payout": "$0",
      "date": "Jun 24th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "HDF5 Fletcher32 filter SIGSEGV on single-byte malformed chunked dataset in HDF5",
      "url": "https://huntr.com/bounties/f4da4346-ac9d-4ff3-b043-ab2fe020ab6b",
      "payout": "up to $1500",
      "date": "Jun 24th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "HDF5 Fletcher32 filter SIGSEGV on single-byte malformed chunked dataset in HDF5",
      "url": "https://huntr.com/bounties/e87df875-c9a9-4e2b-a506-3e282694d06e",
      "payout": "up to $1500",
      "date": "Jun 24th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "CatBoost JSON model loader segfaults on malformed scale_and_bias bytes in catboost/catboost",
      "url": "https://huntr.com/bounties/d3ef58fa-c1f2-44a2-a626-fd341566a1c6",
      "payout": "$0",
      "date": "Jun 24th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle scanner bypass via Transformers PretrainedConfig.to_json_file writes attacker-controlled config JSON while scanners report clean in Pickle",
      "url": "https://huntr.com/bounties/ba997ef0-edc3-4975-b330-e8e1f1f964ea",
      "payout": "up to $1500",
      "date": "Jun 24th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle scanner bypass via ONNX Runtime ModelCompiler.compile_to_file writes attacker-controlled ONNX files while scanners report clean in Pickle",
      "url": "https://huntr.com/bounties/52e2dceb-c2a2-4ea6-970b-d1f6c8e8df88",
      "payout": "up to $1500",
      "date": "Jun 24th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle scanner bypass via keras.saving.save_model writes attacker-controlled .keras archives while scanners report clean in Pickle",
      "url": "https://huntr.com/bounties/1bf07352-5344-400f-86d6-2e25b3ea189e",
      "payout": "up to $1500",
      "date": "Jun 24th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle scanner bypass via TensorFlow GFile.write writes attacker-controlled files while scanners report clean in Pickle",
      "url": "https://huntr.com/bounties/e1ec2215-1ac4-4232-8956-be5866c2fac0",
      "payout": "up to $1500",
      "date": "Jun 24th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle scanner bypass via openvino.save_model writes attacker-controlled OpenVINO IR files while scanners report clean in Pickle",
      "url": "https://huntr.com/bounties/5e480927-6596-4445-aadf-4a9217ed7b49",
      "payout": "up to $1500",
      "date": "Jun 24th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle scanner bypass via Tensorizer TensorSerializer.write_tensor writes attacker-controlled tensorizer files while scanners report clean in Pickle",
      "url": "https://huntr.com/bounties/a8894c8a-7175-4b79-bee2-530f1fa860a3",
      "payout": "up to $1500",
      "date": "Jun 24th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle scanner bypass via safetensors.numpy.save_file writes attacker-controlled SafeTensors files while scanners report clean in Pickle",
      "url": "https://huntr.com/bounties/e9835d19-672d-4818-a314-779135b8a256",
      "payout": "up to $1500",
      "date": "Jun 24th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle scanner bypass via GGUFWriter writes attacker-controlled GGUF files while scanners report clean in Pickle",
      "url": "https://huntr.com/bounties/a0c2f7f7-e1dd-4d96-a6b2-f1e42a643c92",
      "payout": "up to $1500",
      "date": "Jun 24th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle scanner bypass via ONNX save_model writes attacker-controlled ONNX files while scanners report clean in Pickle",
      "url": "https://huntr.com/bounties/e7841fe2-dd05-451f-b5ee-98c16c18f255",
      "payout": "up to $1500",
      "date": "Jun 24th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle scanner bypass via Hugging Face Tokenizer.save writes attacker-controlled tokenizer JSON while scanners report clean in Pickle",
      "url": "https://huntr.com/bounties/3b5eea8f-3207-4036-ba73-e9d27e1f8098",
      "payout": "up to $1500",
      "date": "Jun 24th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle scanner bypass via NetworkX write_edgelist writes attacker-controlled files while scanners report clean in Pickle",
      "url": "https://huntr.com/bounties/913ab06d-cc3d-46c2-99f4-1ade997718bd",
      "payout": "up to $1500",
      "date": "Jun 24th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle scanner bypass via sklearn dump_svmlight_file writes attacker-controlled SVMlight data while scanners report clean in Pickle",
      "url": "https://huntr.com/bounties/f3a12155-f8a3-4b81-8927-f4d34c32ab39",
      "payout": "up to $1500",
      "date": "Jun 24th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle scanner bypass via PIL.Image.Image.save writes attacker-controlled PNG while picklescan and modelscan report clean in Pickle",
      "url": "https://huntr.com/bounties/897ccff2-8f53-4b34-8561-88154c2ba566",
      "payout": "up to $1500",
      "date": "Jun 24th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle scanner bypass via matplotlib.pyplot.imsave writes attacker-controlled PNG while picklescan and modelscan report clean in Pickle",
      "url": "https://huntr.com/bounties/d9dd50f8-c868-47cc-9da3-746314affc28",
      "payout": "up to $1500",
      "date": "Jun 24th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle scanner bypass via SciPy savemat writes attacker-controlled MATLAB files while picklescan and modelscan report clean in Pickle",
      "url": "https://huntr.com/bounties/0999a049-d9b7-4819-a11f-48ae43a2813c",
      "payout": "up to $1500",
      "date": "Jun 24th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle scanner bypass via h5py File.create_dataset writes attacker-controlled HDF5 files while picklescan and modelscan report clean in Pickle",
      "url": "https://huntr.com/bounties/b8a5885e-9256-4088-9c5f-f1c9cc459d17",
      "payout": "up to $1500",
      "date": "Jun 24th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle scanner bypass via `pandas.to_pickle` writes attacker-controlled files while picklescan and modelscan report clean in Pickle",
      "url": "https://huntr.com/bounties/96bb3232-dae6-4636-920f-18e175554c8a",
      "payout": "up to $1500",
      "date": "Jun 24th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Eclipse Deeplearning4j ModelSerializer: unsafe Java deserialization (CWE-502) on default .zip model restore -> code execution via attacker preprocessor.bin in DL4J",
      "url": "https://huntr.com/bounties/9b5a24fb-fc1f-466f-b07f-bc0a11477fb2",
      "payout": "up to $1500",
      "date": "Jun 23rd 2026",
      "source": "dashboard_html"
    },
    {
      "title": "PMML model XXE in pypmml/pmml4s: arbitrary host file-read + SSRF on Model.load (latest 1.5.8, unpatched) in PMML",
      "url": "https://huntr.com/bounties/53a8c9cd-e31f-4cb8-a52b-9bcb4a743a7d",
      "payout": "up to $1500",
      "date": "Jun 23rd 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle scanner bypass via dbm.dumb writes attacker-controlled DBM files while picklescan and modelscan report clean in Pickle",
      "url": "https://huntr.com/bounties/3e217d35-1973-4400-ad49-97fa5f8cb9a0",
      "payout": "up to $1500",
      "date": "Jun 23rd 2026",
      "source": "dashboard_html"
    },
    {
      "title": "MLflow model scanner bypass: pickle-free python_function loader_module + code/ achieves RCE on mlflow.pyfunc.load_model while picklescan and modelscan report clean in MLFlow",
      "url": "https://huntr.com/bounties/a52364d3-16c8-4f48-a770-2fe47af5e03e",
      "payout": "up to $1500",
      "date": "Jun 23rd 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle scanner bypass: memo-build value desync hides posix.system from picklescan's STACK_GLOBAL operand recovery (RCE on load) in Pickle",
      "url": "https://huntr.com/bounties/a17792c7-2d2b-41f0-86eb-6fd937163231",
      "payout": "up to $1500",
      "date": "Jun 23rd 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle scanner bypass: EXT extension-registry opcodes + self-registering copyreg.add_extension evade picklescan and modelscan (self-contained RCE on load) in Pickle",
      "url": "https://huntr.com/bounties/68191672-6059-40c8-b858-2175bf8f41f4",
      "payout": "up to $1500",
      "date": "Jun 23rd 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle scanner bypass: pathlib.Path.write_bytes + sqlite3 load_extension evade picklescan and modelscan (self-contained RCE on load) in Pickle",
      "url": "https://huntr.com/bounties/65044d05-3244-4fb8-82ca-0796150e3d7e",
      "payout": "up to $1500",
      "date": "Jun 23rd 2026",
      "source": "dashboard_html"
    },
    {
      "title": "TensorFlow.js model loader hangs on large string weight specs before weight validation in TensorFlow.js",
      "url": "https://huntr.com/bounties/80e1bc83-ccb5-4012-a212-73e88226abbd",
      "payout": "up to $1500",
      "date": "Jun 23rd 2026",
      "source": "dashboard_html"
    },
    {
      "title": "TensorFlow Checkpoint reader aborts on malformed BundleEntry and invalid dtype metadata in TensorFlow Checkpoint",
      "url": "https://huntr.com/bounties/89494bc2-c987-4f4f-9626-e3913c28bb14",
      "payout": "up to $1500",
      "date": "Jun 23rd 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Unauthenticated arbitrary server-side file read in Merlin API via Standard Transformer Simulation endpoint (fromFile absolute-path bypass) in caraml-dev/merlin",
      "url": "https://huntr.com/bounties/033aef67-7934-48d4-b3c1-99d5b8e6050b",
      "payout": "$0",
      "date": "Jun 23rd 2026",
      "source": "dashboard_html"
    },
    {
      "title": "TensorFlow SavedModel loader exhausts memory validating variadic op N attributes in TensorFlow Saved Model",
      "url": "https://huntr.com/bounties/7458fdaf-e652-4203-8026-c1c2572d85c5",
      "payout": "up to $4000",
      "date": "Jun 23rd 2026",
      "source": "dashboard_html"
    },
    {
      "title": "SSRF via attacker-controlled redis:// DataReference in flytestdlib storage routing — control plane dials arbitrary internal hosts in flyteorg/flyte",
      "url": "https://huntr.com/bounties/852cb714-b0bf-4d2b-b913-cdbd4629d06c",
      "payout": "$0",
      "date": "Jun 23rd 2026",
      "source": "dashboard_html"
    },
    {
      "title": "SafeTensors lazy slicing aborts the process on zero-size tensors with huge dimensions in SafeTensors",
      "url": "https://huntr.com/bounties/5aeeddb5-4547-49f5-81ea-ae357718c163",
      "payout": "up to $4000",
      "date": "Jun 23rd 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Unauthenticated RCE in Feast Registry Server via dill deserialization of attacker-controlled UDF (ApplyFeatureView) in feast-dev/feast",
      "url": "https://huntr.com/bounties/32360aed-8a2a-45af-90f4-45518a7d8fc8",
      "payout": "$0",
      "date": "Jun 23rd 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Out-of-bounds read in LiteRT tensor name parsing exposes process memory via TFLite metadata in TFLite",
      "url": "https://huntr.com/bounties/b3d70d68-c252-4d3e-9209-a83b6b79e9f9",
      "payout": "up to $1500",
      "date": "Jun 23rd 2026",
      "source": "dashboard_html"
    },
    {
      "title": "ExecuTorch (.pte) out-of-bounds read in Program::load via unvalidated flatbuffer offset → SIGSEGV (reproduces on latest 1.3.1) in ExecuTorch",
      "url": "https://huntr.com/bounties/c1fb5d20-b5a5-48bb-8b83-54ed2c8d66da",
      "payout": "up to $1500",
      "date": "Jun 23rd 2026",
      "source": "dashboard_html"
    },
    {
      "title": "NETCDF3_64BIT_OFFSET dimension-count metadata crashes netCDF4-python Dataset constructor in NetCDF",
      "url": "https://huntr.com/bounties/65d63436-05a2-41b4-8f24-c3f637bb50e6",
      "payout": "up to $1500",
      "date": "Jun 23rd 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Torch Export (.pt2) scanner bypass → RCE via torch.export.load() silent weights_only=False fallback in Torch Export",
      "url": "https://huntr.com/bounties/afd5803a-4f67-447c-8089-6cf7e706f84e",
      "payout": "up to $1500",
      "date": "Jun 23rd 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via _ctypes.dlopen - Arbitrary Shared Library Load (RCE), Bypass of the ctypes Block (GHSA-4675) in Pickle",
      "url": "https://huntr.com/bounties/b807c570-50ba-4802-99ae-9e8806274e4a",
      "payout": "up to $1500",
      "date": "Jun 23rd 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via Unblocked File-Open Callables (gzip/bz2/lzma/wave/mailbox) - Arbitrary File Creation and Truncation Invisible to Scanners in Pickle",
      "url": "https://huntr.com/bounties/8fe01b2d-aba8-4235-9013-8d916febd156",
      "payout": "up to $1500",
      "date": "Jun 23rd 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Out-of-bounds read in TensorRT legacy plugin deserialization crashes the process in TensorRT",
      "url": "https://huntr.com/bounties/54d9e376-61ff-4818-834c-3a468528114f",
      "payout": "up to $4000",
      "date": "Jun 23rd 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via Dotted-Qualname Re-Export (posixpath -> os.system) leads to Arbitrary Command Execution in Pickle",
      "url": "https://huntr.com/bounties/7d1a220a-b4dd-4ec9-81df-bd734a1e86eb",
      "payout": "up to $1500",
      "date": "Jun 23rd 2026",
      "source": "dashboard_html"
    },
    {
      "title": "IndexFlatPanorama deserialization accepts forged ntotal and crashes during search in facebookresearch/faiss",
      "url": "https://huntr.com/bounties/df22b1cb-dce8-41fd-9970-2d05ce4b1084",
      "payout": "$125 to $175",
      "date": "Jun 23rd 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Keras Native safe_mode executes dead Functional operation nodes via incomplete NON_MODELING_APIS guard in Keras Native",
      "url": "https://huntr.com/bounties/cd91fcc8-ae2a-4fec-9fde-6965af3d4512",
      "payout": "up to $4000",
      "date": "Jun 23rd 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Attention kv_num_heads=0 crashes ONNX shape inference via integer division by zero in ONNX",
      "url": "https://huntr.com/bounties/306054f0-9e54-4227-b0b0-2064a42d0fbc",
      "payout": "up to $4000",
      "date": "Jun 23rd 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Attention kv_num_heads=0 crashes ONNX shape inference via integer division by zero in ONNX",
      "url": "https://huntr.com/bounties/f4873f96-ae01-4b2b-bfae-76c433b94d7c",
      "payout": "up to $4000",
      "date": "Jun 23rd 2026",
      "source": "dashboard_html"
    },
    {
      "title": "SplitToSequence scalar split=0 crashes ONNX shape inference via integer modulo by zero in ONNX",
      "url": "https://huntr.com/bounties/a94187b4-4c4d-424a-a2b4-b32f835598e7",
      "payout": "up to $4000",
      "date": "Jun 23rd 2026",
      "source": "dashboard_html"
    },
    {
      "title": "SplitToSequence scalar split=0 crashes ONNX shape inference via integer modulo by zero in onnx/onnx",
      "url": "https://huntr.com/bounties/7403e3bb-cbf7-4f1b-b64f-cab3b616648e",
      "payout": "$125 to $150",
      "date": "Jun 23rd 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via distutils.spawn.spawn leads to Arbitrary Command Execution in Pickle",
      "url": "https://huntr.com/bounties/0f840caf-d32d-475d-ab62-decc4c1ec387",
      "payout": "up to $1500",
      "date": "Jun 23rd 2026",
      "source": "dashboard_html"
    },
    {
      "title": "IndexRaBitQFastScan deserialization accepts empty codes vector and crashes during search in facebookresearch/faiss",
      "url": "https://huntr.com/bounties/5a4997a6-8f65-4e65-8d93-a82fa9417aa5",
      "payout": "$0",
      "date": "Jun 23rd 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via logging.config.dictConfig leads to Arbitrary Code Execution in Pickle",
      "url": "https://huntr.com/bounties/c92af184-9e90-4bbb-ba87-69dcfd8cd7d2",
      "payout": "up to $1500",
      "date": "Jun 23rd 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Missing admin authorization on PUT /v1/system/log_levels allows any authenticated user to modify server logging in infiniflow/ragflow",
      "url": "https://huntr.com/bounties/aa44eed2-1ac0-4e72-9b38-e2a14c929659",
      "payout": "$0",
      "date": "Apr 1st 2026",
      "source": "dashboard_html"
    },
    {
      "title": "SSRF via DNS rebinding in RSS connector bypasses _validate_url_no_ssrf() TOCTOU check in infiniflow/ragflow",
      "url": "https://huntr.com/bounties/6d076c17-89a1-4c2e-a193-42022506242a",
      "payout": "$0",
      "date": "Apr 1st 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Remote Code Execution via Server-Side Template Injection in unsandboxed Jinja2 Environment in rag/prompts/generator.py in infiniflow/ragflow",
      "url": "https://huntr.com/bounties/12a68269-d3b6-4dd7-beb1-917e229d1342",
      "payout": "$0",
      "date": "Apr 1st 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Remote Code Execution via Unsandboxed exec() in Flow Studio in parisneo/lollms",
      "url": "https://huntr.com/bounties/e1a2f187-e4ca-4088-999d-102e788cf252",
      "payout": "$0",
      "date": "Mar 31st 2026",
      "source": "dashboard_html"
    },
    {
      "title": "SSRF via GitHub Artefact URL Substring Check Bypass in parisneo/lollms in parisneo/lollms",
      "url": "https://huntr.com/bounties/b7ebe135-2571-4763-9170-08f5197a6357",
      "payout": "$0",
      "date": "Mar 31st 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Python Module Hijacking via sys.path.insert in MLflow MLmodel code Field in mlflow/mlflow in mlflow/mlflow",
      "url": "https://huntr.com/bounties/3be7194d-3e94-4ecc-9ccd-911b4554a707",
      "payout": "$750",
      "date": "Mar 31st 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Arbitrary Module Import via pickle_module_info.txt in MLflow PyTorch Model Loading in mlflow/mlflow in mlflow/mlflow",
      "url": "https://huntr.com/bounties/9e1c42a6-ae02-4661-bf16-6cc117ae2df5",
      "payout": "$750",
      "date": "Mar 31st 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Arbitrary File Read via Tar Symlink Bypass of Path Traversal Fix in mlflow/mlflow in mlflow/mlflow",
      "url": "https://huntr.com/bounties/4aec61f4-6604-4ec8-8d7e-fda6a2b98e25",
      "payout": "$125",
      "date": "Mar 31st 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Authentication Bypass in Gradio MCP Server via Starlette Mount in gradio-app/gradio in gradio-app/gradio",
      "url": "https://huntr.com/bounties/08e93d9b-1a99-4ea6-ac40-3893c49ce0d5",
      "payout": "$0",
      "date": "Mar 31st 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via glob.glob — Filesystem Enumeration Invisible to Scanners in Pickle in Pickle",
      "url": "https://huntr.com/bounties/19fbd307-880f-4bb0-b534-91a6a15744f5",
      "payout": "up to $1500",
      "date": "Mar 30th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via code.interact — Drop to Interactive Python Console Invisible to Scanners in Pickle in Pickle",
      "url": "https://huntr.com/bounties/dd8ce867-2895-4ec9-97a1-749f1d915e52",
      "payout": "$1500",
      "date": "Mar 30th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via tempfile.NamedTemporaryFile — Create Arbitrary Temporary Files Invisible to Scanners in Pickle in Pickle",
      "url": "https://huntr.com/bounties/525f7ab7-9c29-4167-80d2-e015a0e9636e",
      "payout": "$1500",
      "date": "Mar 30th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via imaplib.IMAP4 — IMAP Email Protocol Exfiltration Channel Invisible to Scanners in Pickle in Pickle",
      "url": "https://huntr.com/bounties/9bc57d83-8174-4414-8da1-c022e897e2e6",
      "payout": "up to $1500",
      "date": "Mar 30th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via poplib.POP3 — POP3 Email Protocol Exfiltration Channel Invisible to Scanners in Pickle in Pickle",
      "url": "https://huntr.com/bounties/c9535a64-95f4-4ef1-9023-03dc7efc49de",
      "payout": "up to $1500",
      "date": "Mar 30th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via inspect.getsource — Read Python Source Code of Any Module Invisible to Scanners in Pickle in Pickle",
      "url": "https://huntr.com/bounties/903f2dab-fef8-4f96-8795-215edd36bad7",
      "payout": "up to $1500",
      "date": "Mar 30th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via compileall.compile_file — Compile and Execute Arbitrary Python Files Invisible to Scanners in Pickle in Pickle",
      "url": "https://huntr.com/bounties/d332745d-6cf2-4b56-a69f-e5ebe59a2a33",
      "payout": "up to $1500",
      "date": "Mar 30th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via fileinput.input — Read Multiple Files Simultaneously Invisible to Scanners in Pickle in Pickle",
      "url": "https://huntr.com/bounties/2840ae14-fb38-494d-a808-98809c880c5c",
      "payout": "up to $1500",
      "date": "Mar 30th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via multiprocessing.Process — Spawn Separate Processes Invisible to Scanners in Pickle in Pickle",
      "url": "https://huntr.com/bounties/a58b5e5e-f203-4f5d-807f-ca9e1196e511",
      "payout": "up to $1500",
      "date": "Mar 30th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via tarfile.open — Archive Extraction and Arbitrary File Read Invisible to Scanners in Pickle in Pickle",
      "url": "https://huntr.com/bounties/7dddf659-ab54-4d8f-be5c-c6649f928a8b",
      "payout": "up to $1500",
      "date": "Mar 30th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via codecs.open — Arbitrary File Read with Encoding Bypass Invisible to Scanners in Pickle in Pickle",
      "url": "https://huntr.com/bounties/cb684028-7450-4549-9e35-c0aee93e01d2",
      "payout": "up to $1500",
      "date": "Mar 30th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via configparser.ConfigParser — Read Configuration Files with Credentials Invisible to Scanners in Pickle in Pickle",
      "url": "https://huntr.com/bounties/06fcdc04-0e03-423e-b450-b03eee8f0f3f",
      "payout": "up to $1500",
      "date": "Mar 30th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via compileall.compile_file — Compile and Execute Arbitrary Python Files Invisible to Scanners in Pickle in Pickle",
      "url": "https://huntr.com/bounties/8b111294-11c9-486f-a40f-980e6c9e64a7",
      "payout": "up to $1500",
      "date": "Mar 30th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via sqlite3.connect — Database Access and Data Exfiltration Invisible to Scanners in Pickle in Pickle",
      "url": "https://huntr.com/bounties/d4b51ca8-8125-477e-bc27-534a2a5c2ff8",
      "payout": "up to $1500",
      "date": "Mar 30th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via importlib.import_module — Import Any Python Module for Arbitrary Code Execution in Pickle in Pickle",
      "url": "https://huntr.com/bounties/8638d73c-b931-4d3b-a5ec-110d079bd1c5",
      "payout": "up to $1500",
      "date": "Mar 30th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via zipfile.ZipFile — Arbitrary File Read and ZIP Bomb DoS Invisible to Scanners in Pickle in Pickle",
      "url": "https://huntr.com/bounties/747cd152-da28-4e1c-beb2-e5e35b669d21",
      "payout": "up to $1500",
      "date": "Mar 30th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via xmlrpc.client.ServerProxy — Remote Procedure Call Invisible to Scanners in Pickle in Pickle",
      "url": "https://huntr.com/bounties/c230ab46-63bf-4ef7-a4d5-77ba4f6db49b",
      "payout": "up to $1500",
      "date": "Mar 30th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via smtplib.SMTP — Email-Based Data Exfiltration Invisible to Scanners in Pickle in Pickle",
      "url": "https://huntr.com/bounties/987b1488-012d-46e9-af63-2a29f8fa7931",
      "payout": "up to $1500",
      "date": "Mar 30th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via ftplib.FTP — FTP Data Exfiltration Channel Invisible to Scanners in Pickle in Pickle",
      "url": "https://huntr.com/bounties/f9c72b9a-28be-4760-98a1-d2fc366fd467",
      "payout": "up to $1500",
      "date": "Mar 30th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via sqlite3.connect — Database Access and Data Exfiltration Invisible to Scanners in Pickle in Pickle",
      "url": "https://huntr.com/bounties/c5f46a05-6c82-4652-bf87-41fef61b0723",
      "payout": "up to $1500",
      "date": "Mar 30th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via importlib.import_module — Import Any Python Module for Arbitrary Code Execution in Pickle in Pickle",
      "url": "https://huntr.com/bounties/8ff2f707-f9f8-4293-810d-9a847a0685ba",
      "payout": "up to $1500",
      "date": "Mar 30th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Remote Code Execution via Unsafe FAISS Pickle Deserialization with allow_dangerous_deserialization=True in GaiZhenbiao/ChuanhuChatGPT in gaizhenbiao/chuanhuchatgpt",
      "url": "https://huntr.com/bounties/3da0034c-dd52-43b0-9f30-ed39b51e386c",
      "payout": "$0",
      "date": "Mar 30th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Stored XSS via Unsanitized DuckDuckGo Search Result Titles in GaiZhenbiao/ChuanhuChatGPT in gaizhenbiao/chuanhuchatgpt",
      "url": "https://huntr.com/bounties/3d3ca7ef-6161-4f1e-aae6-ad08ce22fa3d",
      "payout": "$0",
      "date": "Mar 30th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Remote Code Execution via Unsafe FAISS Pickle Deserialization with allow_dangerous_deserialization=True in GaiZhenbiao/ChuanhuChatGPT in gaizhenbiao/chuanhuchatgpt",
      "url": "https://huntr.com/bounties/af091f3a-d37f-434e-8675-3b774d2b056e",
      "payout": "$0",
      "date": "Mar 30th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Stored XSS via Unsanitized DuckDuckGo Search Result Titles in GaiZhenbiao/ChuanhuChatGPT in gaizhenbiao/chuanhuchatgpt",
      "url": "https://huntr.com/bounties/2b7bb5ed-c093-4ccd-803b-2da4c95f29c1",
      "payout": "$0",
      "date": "Mar 30th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Path Traversal in Chat History Loading Enables Arbitrary File Read and API Key Theft in GaiZhenbiao/ChuanhuChatGPT in gaizhenbiao/chuanhuchatgpt",
      "url": "https://huntr.com/bounties/3e290575-f2d7-4c30-9226-8ef8c9a7727d",
      "payout": "$0",
      "date": "Mar 30th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via torch.multiprocessing.spawn — Process Spawning Invisible to Scanners in Pickle in Pickle",
      "url": "https://huntr.com/bounties/9d35fd36-d428-46cc-92a3-0150daa51658",
      "payout": "up to $1500",
      "date": "Mar 30th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via torch.package.PackageImporter — Arbitrary Code Import from Package Files in Pickle in Pickle",
      "url": "https://huntr.com/bounties/e35ff420-348d-4009-a970-9e02629cd20d",
      "payout": "up to $1500",
      "date": "Mar 30th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via types.FunctionType — Construct Executable Functions from Code Objects Invisible to Scanners in Pickle in Pickle",
      "url": "https://huntr.com/bounties/f628e1bc-f556-4f26-9707-ae1b3b20f01f",
      "payout": "up to $1500",
      "date": "Mar 30th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via linecache.getline — Arbitrary File Read Invisible to Scanners in Pickle in Pickle",
      "url": "https://huntr.com/bounties/5a316404-46db-46b2-8b54-72bc97ad16e3",
      "payout": "up to $1500",
      "date": "Mar 30th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via http.client — Data Exfiltration to Attacker Server Invisible to Scanners in Pickle in Pickle",
      "url": "https://huntr.com/bounties/ad00e898-d235-4664-86d0-a3e3e71a3b27",
      "payout": "up to $1500",
      "date": "Mar 30th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via logging.config.fileConfig — Arbitrary Code Execution Through Handler Instantiation in Pickle in Pickle",
      "url": "https://huntr.com/bounties/341dde5f-9fdb-4d4f-a425-2fd073ecce8e",
      "payout": "up to $1500",
      "date": "Mar 30th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via linecache.getline — Arbitrary File Read Invisible to Scanners in Pickle in Pickle",
      "url": "https://huntr.com/bounties/0f5b1c73-4bcf-44a0-aba7-54a559b8aed1",
      "payout": "up to $1500",
      "date": "Mar 30th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via http.client — Data Exfiltration to Attacker Server Invisible to Scanners in Pickle in Pickle",
      "url": "https://huntr.com/bounties/bcb883e0-043b-4b44-a87e-90abbc49ca9c",
      "payout": "up to $1500",
      "date": "Mar 30th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via logging.config.fileConfig — Arbitrary Code Execution Through Handler Instantiation in Pickle in Pickle",
      "url": "https://huntr.com/bounties/a1a3065d-6edf-4e98-8359-3abc52d5e438",
      "payout": "up to $1500",
      "date": "Mar 30th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Unauthenticated Remote Code Execution via /vibe-code Endpoint in Vibe Mode in gradio-app/gradio",
      "url": "https://huntr.com/bounties/e4414ffe-2108-4205-9518-b95a2f9f17cc",
      "payout": "$0",
      "date": "Mar 29th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Unauthenticated RCE via MCP STDIO Command Injection in Model Config Import in mudler/localai",
      "url": "https://huntr.com/bounties/e96cfae8-f7ae-4206-b77b-5dca88ce8c2d",
      "payout": "$0",
      "date": "Mar 29th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "ONNX Parser SIGSEGV via Mutually Recursive Functions — Distinct from Self-Recursion in ONNX",
      "url": "https://huntr.com/bounties/29e61e4d-e3ed-4a29-80d4-4ef8b4be2409",
      "payout": "up to $4000",
      "date": "Mar 29th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass — All 5 Joblib Compression Types Invisible to Scanners in Joblib",
      "url": "https://huntr.com/bounties/8e903a4e-22b1-4bb6-be7d-fe6f170ba9a9",
      "payout": "up to $4000",
      "date": "Mar 29th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via shelve.open — Pickle-in-Pickle Deserialization Chain in Pickle",
      "url": "https://huntr.com/bounties/f38772c0-10ba-4775-a3a4-dd3b7032e036",
      "payout": "$250",
      "date": "Mar 29th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via torch.hub.load — Download and Execute Code from Attacker GitHub Repo in PyTorch Package",
      "url": "https://huntr.com/bounties/99067cca-b093-4ef3-9167-b465e575196c",
      "payout": "$1500",
      "date": "Mar 29th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via torch.utils.cpp_extension.load_inline — Compile and Execute Arbitrary C++ in PyTorch Package",
      "url": "https://huntr.com/bounties/5946997a-d899-4ecf-a124-120ef84a6b0b",
      "payout": "$3000",
      "date": "Mar 29th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "ONNX Shape Inference SIGSEGV via Self-Referencing Model-Local Function (Uncontrolled Recursion) in ONNX",
      "url": "https://huntr.com/bounties/776e4c7f-902d-4937-8fac-5e15f6785989",
      "payout": "up to $4000",
      "date": "Mar 29th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "GGUF Python Parser Stack Overflow via Unbounded Recursive Array Parsing in GGUF",
      "url": "https://huntr.com/bounties/dc4ec004-709d-499f-b8e3-1f151ff508fd",
      "payout": "up to $4000",
      "date": "Mar 29th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "GGUF Python Parser Infinite Loop DoS via Unvalidated Array Length in GGUF",
      "url": "https://huntr.com/bounties/c7b3c234-46bc-4b38-b325-47c10d228579",
      "payout": "up to $4000",
      "date": "Mar 29th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Pickle Scanner Bypass via torch.ops.load_library → Arbitrary Code Execution (9 novel unblocked callables) in PyTorch Package",
      "url": "https://huntr.com/bounties/986f1150-277d-4404-acfc-063337f35e06",
      "payout": "$3000",
      "date": "Mar 29th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Unauthenticated Denial of Service via Elastic Endpoint Scaling API in vllm-project/vllm",
      "url": "https://huntr.com/bounties/f9bfd1d5-a77c-485e-be2d-26ef77e8e7df",
      "payout": "$0",
      "date": "Mar 29th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Unauthenticated Arbitrary Worker Method Execution via collective_rpc API in vllm-project/vllm",
      "url": "https://huntr.com/bounties/bac2bb7d-3033-46aa-94d1-2c85691f3388",
      "payout": "$0",
      "date": "Mar 29th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Reflected XSS via HuggingFace Model Install Endpoint in invoke-ai/invokeai",
      "url": "https://huntr.com/bounties/71a5cd8f-8b1c-47c9-ac5d-96a39d17fa00",
      "payout": "$0",
      "date": "Mar 29th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Reflected XSS via HuggingFace Model Install Endpoint in invoke-ai/invokeai",
      "url": "https://huntr.com/bounties/afc37b22-5499-4292-8db2-d9e6ce6851b4",
      "payout": "$0",
      "date": "Mar 29th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "SSRF + Arbitrary File Write via Download Queue API (No Auth) in invoke-ai/invokeai",
      "url": "https://huntr.com/bounties/1f024249-4872-4422-89ab-0b382b540712",
      "payout": "$0",
      "date": "Mar 29th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Arbitrary File Read via VALIDATE_INPUTS Bypass in /prompt API in comfyanonymous/comfyui",
      "url": "https://huntr.com/bounties/8dbdde58-c1db-4a77-b47b-fc2a571404bb",
      "payout": "$0",
      "date": "Mar 29th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Path Traversal via Malicious Weight Names in np_cache Loading in vllm-project/vllm",
      "url": "https://huntr.com/bounties/d66dd274-607b-4517-8e0c-61fc64fddcd8",
      "payout": "$0",
      "date": "Mar 29th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Sandbox Escape via Shallow AST Import Check in PandasQueryEngine exec_utils.py in run-llama/llama_index",
      "url": "https://huntr.com/bounties/4814dc40-1720-407f-b404-1b63ae090683",
      "payout": "$750",
      "date": "Mar 28th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "SSRF via Multimodal Media URLs + Authentication Bypass on Non-/v1 Endpoints in vllm-project/vllm",
      "url": "https://huntr.com/bounties/b2404928-c517-4c10-b0ce-c3eb3c0b107f",
      "payout": "$0",
      "date": "Mar 28th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Unauthenticated RCE via SecurePythonAnalyzer Bypass in Sandbox Executor — Container Escape via Docker Socket in infiniflow/ragflow",
      "url": "https://huntr.com/bounties/334dbe83-11eb-4fa6-89ae-672546b467ed",
      "payout": "$0",
      "date": "Mar 28th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Unauthenticated Arbitrary File Write via Path Traversal in Python File Upload Leading to RCE in eosphoros-ai/db-gpt",
      "url": "https://huntr.com/bounties/fbaddd12-5545-41c8-925c-f64d3dba950f",
      "payout": "$0",
      "date": "Mar 28th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Unauthenticated Arbitrary JavaScript Execution via /execute_script endpoint in Web Browser Server in princeton-nlp/swe-agent",
      "url": "https://huntr.com/bounties/bf5de500-05fc-468b-93db-bbc347d83607",
      "payout": "$0",
      "date": "Mar 26th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Path Traversal in Inspector Server /trajectory/ endpoint — arbitrary file read without authentication in princeton-nlp/swe-agent",
      "url": "https://huntr.com/bounties/ed6ed51e-0fdf-4809-bc6a-561f3749fc08",
      "payout": "$0",
      "date": "Mar 26th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "SSRF and Local File Read via /goto endpoint in Web Browser Server — No Auth, file:// protocol allowed in princeton-nlp/swe-agent",
      "url": "https://huntr.com/bounties/04418b01-5ba2-48d6-8e9a-f5273e72b541",
      "payout": "$0",
      "date": "Mar 26th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "SSRF protection bypass via IPv6-mapped IPv4 addresses in Open WebUI — cloud metadata extraction confirmed in open-webui/open-webui",
      "url": "https://huntr.com/bounties/f06bb4ba-7cb6-43ac-bf47-1dc864142144",
      "payout": "$0",
      "date": "Mar 25th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "IDOR in /v2/key/info — any authenticated user reads other users key metadata including secrets in berriai/litellm",
      "url": "https://huntr.com/bounties/d7ecc136-a69e-4757-95d8-9983be4dec9f",
      "payout": "$0",
      "date": "Mar 25th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "SSRF via user-controlled api_base in /chat/completions — CVE-2024-6587 bypass/regression in berriai/litellm",
      "url": "https://huntr.com/bounties/3c02c871-a03a-4689-a062-25ddeb5d2847",
      "payout": "$0",
      "date": "Mar 25th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Unauthenticated RCE via unsandboxed Jinja2 template rendering in /prompts/test endpoint in berriai/litellm",
      "url": "https://huntr.com/bounties/7a52ac2e-fe5c-4a0f-b4a3-846bf69b08dd",
      "payout": "$0",
      "date": "Mar 25th 2026",
      "source": "dashboard_html"
    },
    {
      "title": "Caffe prototxt invalid UTF-8 bottom blob crashes OpenCV DNN Caffe loader",
      "url": "https://huntr.com/bounties/94bca908-89c4-4ee0-9374-d814e2ecece7",
      "payout": "",
      "date": "",
      "source": "manual_extra"
    },
    {
      "title": "Keras Native .keras load_model builds attacker-declared Dense state before missing-weights validation",
      "url": "https://huntr.com/bounties/e8d27565-6eca-43be-b671-0751e0894430",
      "payout": "",
      "date": "",
      "source": "manual_extra"
    },
    {
      "title": "Arm NN TFLite parser SIGSEGV on invalid subgraph output tensor index",
      "url": "https://huntr.com/bounties/20b35320-83d9-447a-81ad-c54fec7c4ce4",
      "payout": "",
      "date": "",
      "source": "manual_extra"
    },
    {
      "title": "PyTorch Mobile .ptl invalid bytecode opcode is coerced to OP and crashes applyUpgrader during load",
      "url": "https://huntr.com/bounties/06233860-06be-46f2-aa51-9ed5a112da77",
      "payout": "",
      "date": "",
      "source": "manual_extra"
    },
    {
      "title": "PyORC Reader SIGSEGV on single-byte corrupted ZSTD-compressed ORC stream",
      "url": "https://huntr.com/bounties/f984075a-4afe-4f25-bec6-9bb83945eca5",
      "payout": "",
      "date": "",
      "source": "manual_extra"
    }
  ],
  "queries": {
    "cv2.imwrite": {
      "match_count": 0,
      "matches": []
    },
    "OpenCV imwrite": {
      "match_count": 0,
      "matches": []
    },
    "opencv imwrite": {
      "match_count": 0,
      "matches": []
    },
    "Pickle scanner bypass via OpenCV": {
      "match_count": 0,
      "matches": []
    }
  }
}