Yahoo bug bounty programs
yahoo.com Updated
Yahoo runs one public program: an Intigriti bug bounty paying up to $15,000. It also owns AOL, which runs one more program.
- Top reward
- $15,000
- Intigriti
- Programs
- 2
- 2 pay cash
- Targets in scope
- 38
- 4 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program Yahoo runs itself.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Yahoo Bug Bounty
Intigriti · Bug bounty |
$15k | $10k | $3,000 | $500 | $15,000 | Full | – | – | Open |
-
- Critical
- $15k
- High
- $10k
- Medium
- $3,000
- Low
- $500
- Safe harbor
- Full
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
Companies Yahoo owns
1 company with 1 program of its own. Each has its own scope and rules: report to the one that owns the asset.
What is in scope
38 targets across all 2 programs, each listed once with the programs that cover it. 3 excluded.
No target matches. Try part of a host name, such as the company name.
Out of scope 3
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Flurry
Intigriti
-
TW eCommerce: Store
Intigriti
-
Yahoo Open Source Projects
Intigriti
Recent changes
Reward and scope changes across every Yahoo program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Yahoo products, from the NVD.
-
CVE-2026-34043 Medium
Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted "array-like" object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and han
-
CVE-2019-6035 Medium
Open redirect vulnerability in Athenz v1.8.24 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted page.
-
CVE-2017-2253 High
Untrusted search path vulnerability in Installer of Yahoo! Toolbar (for Internet explorer) v8.0.0.6 and earlier, with its timestamp prior to June 13, 2017, 18:18:55 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
-
CVE-2014-7216 High
Multiple stack-based buffer overflows in Yahoo! Messenger 11.5.0.228 and earlier allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the (1) shortcut or (2) title keys in an emoticons.xml file.
-
CVE-2014-5881 Medium
The Yahoo! Japan Box (aka jp.co.yahoo.android.ybox) application 1.5.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
-
CVE-2013-6853 Medium
Cross-site scripting (XSS) vulnerability in clickstream.js in Y! Toolbar plugin for FireFox 3.1.0.20130813024103 for Mac, and 2.5.9.2013418100420 for Windows, allows remote attackers to inject arbitrary web script or HTML via a crafted URL that is stored by the victim.
-
CVE-2013-6780 Medium
Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 2.5.0 through 2.9.0 allows remote attackers to inject arbitrary web script or HTML via the allowedDomain parameter.
-
CVE-2013-4700 Medium
The Yahoo! Japan Shopping application 1.4 and earlier for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
About this page
This page gathers every public program listed under yahoo.com and the companies Yahoo owns: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test. Ownership comes from settled, public acquisitions, or from a program's own text naming Yahoo.
Something wrong or missing? Report a correction.