- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 0
- Public CVEs
- 15
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report as the policy says
- The policy page explains how.
- Partial safe harbor
- Some legal protection; read the terms.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Hall of fame
-
Yes
Netflix would like to thank the following researchers for participating in our responsible disclosure program.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
0 assets you may test.
Self-hosted does not list the scope of this program publicly. Check its policy.
Changes
Tracked since 11 Nov 2026. Last checked 6 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2024-9301 | A path traversal issue in E2Nest prior to commit 8a41948e553c89c56b14410c6ed395e9cfb9250a | High 8.7 | 27 Sep 2024 |
| CVE-2023-40171 | Dispatch is an open source security incident management tool. The server response includes the JWT Secret Key used for signing JWT tokens in error message when the `Dispatch Plugin - Basic Authentication Provider` plugin encounters an error when attempting to decode a JWT token. Any Dispatch users who own their instance and rely on the `Dispatch Plugin - Basic Authentication Provider` plugin for a | Critical 9.1 | 17 Aug 2023 |
| CVE-2023-30797 | Netflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. The insufficiently random values may allow an attacker to guess the credentials and gain access to resources managed by Lemur. | High 7.5 | 19 Apr 2023 |
| CVE-2022-27177 | A Python format string issue leading to information disclosure and potentially remote code execution in ConsoleMe for all versions prior to 1.2.2 | Critical 9.8 | 1 Apr 2022 |
| CVE-2021-28099 | In Netflix OSS Hollow, since the Files.exists(parent) is run before creating the directories, an attacker can pre-create these directories with wide permissions. Additionally, since an insecure source of randomness is used, the file names to be created can be deterministically calculated. | Medium 4.4 | 23 Mar 2021 |
| CVE-2021-28100 | Priam uses File.createTempFile, which gives the permissions on that file -rw-r--r--. An attacker with read access to the local filesystem can read anything written there by the Priam process. | Medium 5.5 | 23 Mar 2021 |
| CVE-2020-2322 | Jenkins Chaos Monkey Plugin 0.3 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to generate load and to generate memory leaks. | High 7.5 | 3 Dec 2020 |
| CVE-2020-2323 | Jenkins Chaos Monkey Plugin 0.4 and earlier does not perform permission checks in an HTTP endpoint, allowing attackers with Overall/Read permission to access the Chaos Monkey page and to see the history of actions. | Medium 5.3 | 3 Dec 2020 |
| CVE-2020-9299 | There were XSS vulnerabilities discovered and reported in the Dispatch application, affecting name and description parameters of Incident Priority, Incident Type, Tag Type, and Incident Filter. This vulnerability can be exploited by an authenticated user. | Medium 5.4 | 9 Nov 2020 |
| CVE-2020-9300 | The Access Control issues include allowing a regular user to view a restricted incident, user role escalation to admin, users adding themselves as a participant in a restricted incident, and users able to view restricted incidents via the search feature. If your install has followed the secure deployment guidelines the risk of this is lowered, as this may only be exploited by an authenticated user | Medium 6.5 | 9 Nov 2020 |
| CVE-2020-9297 | Netflix Titus, all versions prior to version v0.1.1-rc.274, uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary data in the error message template being passed to ConstraintValidatorContext.buildConstraintViolatio | Critical 9.8 | 14 Jul 2020 |
| CVE-2020-9296 | Netflix Titus uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary data in the error message template being passed to ConstraintValidatorContext.buildConstraintViolationWithTemplate() argument, they will be able to | Critical 9.8 | 16 Jun 2020 |
| CVE-2019-10028 | Denial of Service (DOS) in Dial Reference Source Code Used before June 18th, 2019. | High 7.5 | 21 Jun 2019 |
| CVE-2015-7764 | Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode. | High 7.5 | 9 Aug 2017 |
| CVE-2017-7266 | Netflix Security Monkey before 0.8.0 has an Open Redirect. The logout functionality accepted the "next" parameter which then redirects to any domain irrespective of the Host header. | Medium 6.1 | 26 Mar 2017 |