HackerOne · July 2026

July: 123 valid and severity climbing, with 18 criticals.

July came loaded toward the top.

123 valid reports across 81 programs, but what changed was the severity: eighteen critical and forty-three high, well above the earlier months.

I passed through TikTok, Booking.com, PayPal, Stripe, Bumble, Vimeo, Ubiquiti, OPPO, Hilton and Kong, among others.

It is not just about finding a lot: July was about finding the ones that weigh.