Browse / DuckDuckGo

DuckDuckGo

See its reports on the map

Attack surface: 765 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to DuckDuckGo

• Cross-site Scripting7
• Server-Side Request Forgery4
• Injection and Smuggling2
• Code Execution2
• Business Logic1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. DOM XSS on duckduckgo.com searchCross-site Scripting (XSS) - DOM · high
   326 votes
2. XXE on https://duckduckgo.comXML External Entities (XXE) · critical
   218 votes
3. SSRF on duckduckgo.com/iu/Server-Side Request Forgery (SSRF) · high
   165 votes
4. Partial bypass of #483774 with Blind XXE on https://duckduckgo.comXML External Entities (XXE) · high
   159 votes
5. Reflected/Stored XSS on duckduckgo.comCross-site Scripting (XSS) - Reflected · high
   135 votes
6. SSRF with bypass leads to client side hosting / vulnerabilities ( XSS and others )Server-Side Request Forgery (SSRF) · medium
   $50077 votes
7. DOM XSS on duckduckgo.com searchCross-site Scripting (XSS) - Reflected · medium
   74 votes
8. XSS on Videos IACross-site Scripting (XSS) - Stored · medium
   67 votes
9. RCE + PAT Exfiltration via pull_request_target in privacy-configuration/auto-respond-pr.yml — Direct Supply Chain to All DDG BrowsersCode Injection · critical
   66 votes
10. RCE + Supply Chain Attack via pull_request_target in content-scope-scripts/semver-label.yml — Affects All DuckDuckGo BrowsersCode Injection · critical
    41 votes
11. DOM XSS on duckduckgo.com searchCross-site Scripting (XSS) - DOM · medium
    30 votes
12. SSRF vulnerability on proxy.duckduckgo.com (access to metadata server on AWS)Server-Side Request Forgery (SSRF) · critical
    25 votes
13. com.duckduckgo.mobile.android - Cache corruptionBusiness Logic Errors · medium
    17 votes
14. DOM XSS on 50x.html pageCross-site Scripting (XSS) - DOM · high
    16 votes
15. SSRF in proxy.duckduckgo.com via the image_host parameterServer-Side Request Forgery (SSRF) · high
    16 votes
16. DOM XSS on 50x.html page on proxy.duckduckgo.comCross-site Scripting (XSS) - DOM · high
    14 votes