Hunt List
13,782 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-8402 |
9.8 | 0.0047 | NET NO AUTH LOW CX NO UI | Improper neutralization of special elements used in an SQL command ('SQL injecti | |
|
80
|
CVE-2026-4321 |
9.8 | 0.0047 | NET NO AUTH LOW CX NO UI | Improper neutralization of special elements used in an SQL command ('SQL injecti | |
|
80
|
CVE-2026-13020 |
9.8 | 0.0047 | NET NO AUTH LOW CX NO UI | A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal | |
|
80
|
CVE-2026-8307 |
9.8 | 0.0047 | NET NO AUTH LOW CX NO UI | Improper neutralization of special elements used in an SQL command ('SQL injecti | |
|
80
|
CVE-2026-5955 |
9.8 | 0.0047 | NET NO AUTH LOW CX NO UI | Improper neutralization of special elements used in an SQL command ('SQL injecti | |
|
80
|
CVE-2026-8297 |
9.8 | 0.0047 | NET NO AUTH LOW CX NO UI | Improper neutralization of special elements used in an SQL command ('SQL injecti | |
|
80
|
CVE-2026-1617 |
9.8 | 0.0047 | NET NO AUTH LOW CX NO UI | Improper neutralization of special elements used in an SQL command ('SQL injecti | |
|
80
|
CVE-2026-16360 |
9.8 | 0.0047 | NET NO AUTH LOW CX NO UI | Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some o | |
|
80
|
CVE-2026-2395 |
9.8 | 0.0047 | NET NO AUTH LOW CX NO UI | Improper neutralization of special elements used in an SQL command ('SQL injecti | |
|
80
|
CVE-2026-64691 |
9.8 | 0.0047 | NET NO AUTH LOW CX NO UI | A buffer overflow was addressed with improved size validation. This issue is fix | |
|
80
|
CVE-2026-4978 |
9.8 | 0.0047 | NET NO AUTH LOW CX NO UI | Improper neutralization of special elements used in an SQL command ('SQL injecti | |
|
80
|
CVE-2025-55787 |
9.8 | 0.0047 | NET NO AUTH LOW CX NO UI | In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerabili | |
|
78
|
CVE-2026-54061 |
9.1 | 0.0047 | NET NO AUTH LOW CX NO UI | Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, | |
|
77
|
CVE-2026-32689 |
8.7 | 0.0047 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in phoenixfra | |
|
77
|
CVE-2018-25439 |
8.7 | 0.0047 | NET NO AUTH LOW CX NO UI | MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /inclu | |
|
77
|
CVE-2026-116588 |
8.7 | 0.0047 | NET NO AUTH LOW CX NO UI | Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 an | |
|
77
|
CVE-2026-20268 |
8.6 | 0.0047 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
77
|
CVE-2026-20269 |
8.6 | 0.0047 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
77
|
CVE-2026-20270 |
8.6 | 0.0047 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
77
|
CVE-2026-20271 |
8.6 | 0.0047 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
77
|
CVE-2026-20273 |
8.6 | 0.0047 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
77
|
CVE-2026-102556 |
8.6 | 0.0047 | NET NO AUTH LOW CX NO UI | A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, Sou | |
|
75
|
CVE-2026-41565 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | CryptX versions before 0.088_001 for Perl have a stack buffer overflow in four A | |
|
75
|
CVE-2026-14899 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | The code to parse MIME headers for display when forwarding a message (if the set | |
|
75
|
CVE-2026-55523 |
7.7 | 0.0047 | NET NO AUTH LOW CX NO UI | PraisonAI is a multi-agent teams system. In versions 1.5.128 through 1.6.57, the | |
|
75
|
CVE-2026-76505 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | A vulnerability in the IPv4 packet processing functionality of Cisco IOS XR Soft | |
|
75
|
CVE-2026-105482 |
7.4 | 0.0047 | NET NO AUTH NO UI | 3 PoC | A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be si |
|
70
|
CVE-2026-55115 |
9.9 | 0.0047 | NET LOW CX NO UI | A malicious actor with access to the network and low privileges could exploit a | |
|
70
|
CVE-2026-54051 |
9.9 | 0.0047 | NET LOW CX NO UI | Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5. | |
|
69
|
CVE-2026-17701 |
9.6 | 0.0047 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in ANGLE in Google Chrome on Mac prio | |
|
68
|
CVE-2026-28805 |
8.8 | 0.0047 | NET LOW CX NO UI | OpenSTAManager is an open source management software for technical assistance an | |
|
68
|
CVE-2026-12256 |
8.8 | 0.0047 | NET LOW CX NO UI | Deserialization of Untrusted Data vulnerability in ThemeFusion Fusion Builder fu | |
|
68
|
CVE-2026-55114 |
8.8 | 0.0047 | NET LOW CX NO UI | A malicious actor with access to the network and low privileges could exploit an | |
|
68
|
CVE-2026-113148 |
8.8 | 0.0047 | NET NO AUTH LOW CX | Incorrect authorization in WebUI in Google Chrome prior to 156.0.8078.47 allowed | |
|
68
|
CVE-2026-113217 |
8.8 | 0.0047 | NET NO AUTH LOW CX | Use after free in WebAppInstalls in Google Chrome on on Android prior to 156.0.8 | |
|
68
|
CVE-2026-62516 |
8.8 | 0.0047 | NET LOW CX NO UI | Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply | |
|
68
|
CVE-2026-116778 |
8.8 | 0.0047 | NET LOW CX NO UI | FOG is a free open-source cloning/imaging/rescue suite/inventory management syst | |
|
67
|
CVE-2026-75836 |
8.7 | 0.0047 | NET LOW CX NO UI | The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav's admin-next/API | |
|
67
|
CVE-2026-72826 |
8.7 | 0.0047 | NET LOW CX NO UI | The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scop | |
|
67
|
CVE-2026-61463 |
8.7 | 0.0047 | NET LOW CX NO UI | Shiori contains a privilege escalation vulnerability in the account update endpo | |
|
67
|
CVE-2026-103779 |
8.3 | 0.0047 | NET LOW CX NO UI | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS | |
|
67
|
CVE-2026-47722 |
8.7 | 0.0047 | NET LOW CX NO UI | nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private | |
|
67
|
CVE-2026-53777 |
8.6 | 0.0047 | NET NO AUTH LOW CX | Perry before 0.5.1159 contains a path traversal vulnerability that allows a mali | |
|
66
|
CVE-2026-41058 |
8.1 | 0.0047 | NET LOW CX NO UI | WWBN AVideo is an open source video platform. In versions 29.0 and below, the in | |
|
65
|
CVE-2026-118205 |
7.4 | 0.0047 | NET NO AUTH NO UI | The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugi | |
|
65
|
CVE-2026-29783 |
7.5 | 0.0047 | NET NO AUTH LOW CX | The shell tool within GitHub Copilot CLI versions prior to and including 0.0.422 | |
|
64
|
CVE-2026-109298 |
7.1 | 0.0047 | NET LOW CX NO UI | Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowl | |
|
62
|
CVE-2026-6643 |
8.6 | 0.0047 | NET LOW CX NO UI | A stack-based buffer overflow vulnerability was found in the VPN Clients on the | |
|
61
|
CVE-2026-66491 |
8.2 | 0.0047 | NET LOW CX NO UI | Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 | |
|
51
|
CVE-2026-48080 |
8.0 | 0.0047 | NET NO UI | OpenReception's appointment booking software provides an end-to-end encrypted ap |