Up to 25 percent of valid vulnerabilities found in bug bounty programs are classified as being of high or critical severity.
Source: Threadpost