Hunt List
13,128 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-40393 |
9.8 | 0.0043 | NET NO AUTH LOW CX NO UI | In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occu | |
|
80
|
CVE-2026-33707 |
9.8 | 0.0043 | NET NO AUTH LOW CX NO UI | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, th | |
|
80
|
CVE-2026-2347 |
9.8 | 0.0043 | NET NO AUTH LOW CX NO UI | Authorization bypass through User-Controlled key vulnerability in Akilli Commerc | |
|
78
|
CVE-2026-64798 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extensi | |
|
78
|
CVE-2026-59503 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | : Exposure of Sensitive Information to an Unauthorized Actor : Exposure of Priva | |
|
78
|
CVE-2026-59504 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | : Client-Side Enforcement of Server-Side Security vulnerability in Priority Port | |
|
78
|
CVE-2026-62325 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | goshs is a feature-rich single-binary file server for red teamers and developers | |
|
78
|
CVE-2026-73501 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, Valida | |
|
78
|
CVE-2026-16002 |
8.8 | 0.0043 | NET NO AUTH LOW CX NO UI | The affected product is vulnerable to an Out-of-bounds read, which may allow an | |
|
77
|
CVE-2026-62968 |
8.7 | 0.0043 | NET NO AUTH LOW CX NO UI | Dream Displays provides in-game screens for streaming videos in Minecraft. From | |
|
77
|
CVE-2026-44023 |
8.6 | 0.0043 | NET NO AUTH LOW CX NO UI | Docling Core defines core data types and transformations for the document proces | |
|
77
|
CVE-2026-56248 |
8.7 | 0.0043 | NET NO AUTH LOW CX NO UI | Cap-go capgo (capgo-backend) before 12.128.12 contains an unauthenticated denial | |
|
77
|
CVE-2026-63574 |
8.7 | 0.0043 | NET NO AUTH LOW CX NO UI | Memory allocation with excessive size value in the OpenPGP signature and user at | |
|
77
|
CVE-2026-104384 |
8.7 | 0.0043 | NET NO AUTH LOW CX NO UI | Insufficiently Protected Credentials in tunnel gateway and provisioning interfac | |
|
76
|
CVE-2026-10745 |
7.9 | 0.0043 | NET NO AUTH LOW CX NO UI | Improper output neutralization for logs vulnerability in upKeeper Solutions upKe | |
|
76
|
CVE-2026-35147 |
8.2 | 0.0043 | NET NO AUTH LOW CX NO UI | HCL DFXServer is affected by a Broken Authentication vulnerability via direct AP | |
|
75
|
CVE-2026-11331 |
7.5 | 0.0043 | NET NO AUTH LOW CX NO UI | An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME | |
|
75
|
CVE-2026-64799 |
7.5 | 0.0043 | NET NO AUTH LOW CX NO UI | Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles | |
|
75
|
CVE-2026-43823 |
7.5 | 0.0043 | NET NO AUTH LOW CX NO UI | When initializing an RSA public key from DER or PEM bytes throws an error, the E | |
|
75
|
CVE-2026-49007 |
7.5 | 0.0043 | NET NO AUTH LOW CX NO UI | By accessing unencrypted information in the device firmware, an attacker can obt | |
|
75
|
CVE-2026-102483 |
7.5 | 0.0043 | NET NO AUTH LOW CX NO UI | Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to te | |
|
75
|
CVE-2026-39320 |
7.5 | 0.0043 | NET NO AUTH LOW CX NO UI | Signal K Server is a server application that runs on a central hub in a boat. Ve | |
|
75
|
CVE-2026-42668 |
7.5 | 0.0043 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Authentication in Email Marketing for WooCommerce by Omni | |
|
75
|
CVE-2026-5439 |
7.5 | 0.0043 | NET NO AUTH LOW CX NO UI | A memory exhaustion vulnerability exists in ZIP archive processing. Orthanc auto | |
|
75
|
CVE-2026-32228 |
7.5 | 0.0043 | NET NO AUTH LOW CX NO UI | UI / API User with asset materialize permission could trigger dags they had no a | |
|
75
|
CVE-2026-56029 |
7.5 | 0.0043 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Authentication in CorvusPay WooCommerce Payment Gateway < | |
|
69
|
CVE-2026-28192 |
9.6 | 0.0043 | NET NO AUTH LOW CX | Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro <= 7.1 | |
|
68
|
CVE-2026-41086 |
8.8 | 0.0043 | NET LOW CX NO UI | Improper access control in Windows Admin Center allows an authorized attacker to | |
|
68
|
CVE-2026-34158 |
8.8 | 0.0043 | NET LOW CX NO UI | Coolify is an open-source and self-hostable tool for managing servers, applicati | |
|
68
|
CVE-2026-113250 |
8.8 | 0.0043 | NET NO AUTH LOW CX | Use after free in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote | |
|
68
|
CVE-2026-12447 |
8.8 | 0.0043 | NET NO AUTH LOW CX | Heap buffer overflow in WebRTC in Google Chrome prior to 149.0.7827.155 allowed | |
|
68
|
CVE-2026-12466 |
8.8 | 0.0043 | NET NO AUTH LOW CX | Heap buffer overflow in WebRTC in Google Chrome on Windows prior to 149.0.7827.1 | |
|
68
|
CVE-2026-113152 |
8.8 | 0.0043 | NET NO AUTH LOW CX | Memory corruption in SignIn in Google Chrome prior to 156.0.8078.47 allowed a re | |
|
68
|
CVE-2026-113227 |
8.8 | 0.0043 | NET NO AUTH LOW CX | Use after free in Editing in Google Chrome prior to 156.0.8078.47 allowed a remo | |
|
68
|
CVE-2026-113241 |
8.8 | 0.0043 | NET NO AUTH LOW CX | Memory corruption in Toolbar in Google Chrome on on Android prior to 156.0.8078. | |
|
68
|
CVE-2026-113330 |
8.8 | 0.0043 | NET NO AUTH LOW CX | Memory corruption in CustomTabs in Google Chrome on on Android prior to 156.0.80 | |
|
68
|
CVE-2026-92372 |
8.8 | 0.0043 | NET NO AUTH LOW CX | An out-of-bounds write vulnerability in the screen-image decoder of TeamViewer F | |
|
67
|
CVE-2024-58305 |
8.6 | 0.0043 | NET NO AUTH LOW CX | WonderCMS 4.3.2 contains a cross-site scripting vulnerability that allows attack | |
|
67
|
CVE-2026-115419 |
8.6 | 0.0043 | NET LOW CX NO UI | The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 a | |
|
66
|
CVE-2026-28744 |
8.1 | 0.0043 | NET LOW CX NO UI | Gitea versions up to and including 1.26.1 allow Git smart HTTP requests authenti | |
|
66
|
CVE-2026-101768 |
8.1 | 0.0043 | NET NO AUTH NO UI | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connec | |
|
65
|
CVE-2026-69257 |
7.6 | 0.0043 | NET LOW CX NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
65
|
CVE-2026-33516 |
7.7 | 0.0043 | NET NO AUTH LOW CX | xrdp is an open source RDP server. Versions through 0.10.5 contain an out-of-bou | |
|
64
|
CVE-2026-10763 |
7.0 | 0.0043 | NET NO AUTH LOW CX | PROMOD V is using insecure HTTP communication instead of HTTPS. The vulnerabilit | |
|
64
|
CVE-2026-50141 |
7.1 | 0.0043 | NET LOW CX NO UI | Woodpecker is a CI/CD engine. Starting in version 3.0.0 and prior to version 3.1 | |
|
64
|
CVE-2026-54005 |
7.1 | 0.0043 | NET LOW CX NO UI | Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kir | |
|
64
|
CVE-2026-13229 |
7.1 | 0.0043 | NET LOW CX NO UI | Zammad 7.1.0 contains an authenticated improper authorization vulnerability in t | |
|
64
|
CVE-2026-55707 |
7.1 | 0.0043 | NET LOW CX NO UI | In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verif | |
|
62
|
CVE-2026-60437 |
8.7 | 0.0043 | NET LOW CX NO UI | Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middlewar | |
|
55
|
CVE-2026-4296 |
7.5 | 0.0043 | NET LOW CX | An incorrect regular expression vulnerability was identified in GitHub Enterpris |