- Top reward
- $50
- Top severity paid
- Not published
- Assets in scope
- 3
- Public CVEs
- 8
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $50
- top reward, from $50.
- Report by email
- [email protected]
- No safe harbor
- No promise about legal action.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Top reward
-
$50
I will pay $50 USD for exploitable bugs in these categories:
- Lowest reward
-
$50
I will pay $50 USD for exploitable bugs in these categories:
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
3 assets you may test.
Products and areas 3
- Arbitrary code execution in the Browser when loading a remote web page
- Local privilege escalation
- Remote code execution
Rules
What the policy asks of you, and the bug types it won't reward, quoted from SerenityOS's policy.
While testing
-
The PoC exploit needs to work against the master branch at the time of claim.
-
Max 3 bounties per person.
-
No duplicates. If a bug is already reported, only the earliest reporter may claim the reward.
-
Remote bugs must be exploitable with an unmodified "default setup" of SerenityOS.
-
The PoC exploit needs to work on a QEMU-emulated CPU that supports SMAP, SMEP, UMIP, NX, WP, and TSD natively.
-
SerenityOS always runs with assertions enabled, so you'll need to find a way around them.
Not accepted
-
No rewards for bugs you caused yourself.
-
No rewards for bugs that require unlikely user interaction or social engineering.
-
Bugs in programs that are not started by default don't qualify.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 6 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2021-4327 | A vulnerability was found in SerenityOS. It has been rated as critical. Affected by this issue is the function initialize_typed_array_from_array_buffer in the library Userland/Libraries/LibJS/Runtime/TypedArray.cpp. The manipulation leads to integer overflow. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, | Medium 5.5 | 1 Mar 2023 |
| CVE-2021-31272 | SerenityOS before commit 3844e8569689dd476064a0759d704bc64fb3ca2c contains a directory traversal vulnerability in tar/unzip that may lead to command execution or privilege escalation. | Critical 9.8 | 18 Jun 2021 |
| CVE-2021-33185 | SerenityOS contains a buffer overflow in the set_range test in TestBitmap which could allow attackers to obtain sensitive information. | High 7.5 | 18 Jun 2021 |
| CVE-2021-33186 | SerenityOS in test-crypto.cpp contains a stack buffer overflow which could allow attackers to obtain sensitive information. | High 7.5 | 18 Jun 2021 |
| CVE-2021-30045 | SerenityOS 2021-03-27 contains a buffer overflow vulnerability in the EndOfCentralDirectory::read() function. | Critical 9.1 | 6 Apr 2021 |
| CVE-2021-27343 | SerenityOS Unspecified is affected by: Buffer Overflow. The impact is: obtain sensitive information (context-dependent). The component is: /Userland/Libraries/LibCrypto/ASN1/DER.h Crypto::der_decode_sequence() function. The attack vector is: Parsing RSA Key ASN.1. | High 7.5 | 6 Apr 2021 |
| CVE-2021-28874 | SerenityOS fixed as of c9f25bca048443e317f1994ba9b106f2386688c3 contains a buffer overflow vulnerability in LibTextCode through opening a crafted file. | High 7.8 | 6 Apr 2021 |
| CVE-2019-20172 | Kernel/VM/MemoryManager.cpp in SerenityOS before 2019-12-30 does not reject syscalls with pointers into the kernel-only virtual address space, which allows local users to gain privileges by overwriting a return address that was found on the kernel stack. | High 7.8 | 31 Dec 2019 |