Hunt List
12,911 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-27053 |
9.8 | 0.0039 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions. | |
|
80
|
CVE-2026-41120 |
9.8 | 0.0039 | NET NO AUTH LOW CX NO UI | Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance | |
|
80
|
CVE-2026-61992 |
9.8 | 0.0039 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions. | |
|
79
|
CVE-2026-44125 |
9.3 | 0.0039 | NET NO AUTH LOW CX NO UI | SEPPmail Secure Email Gateway before version 15.0.4 fails to enforce authorizati | |
|
79
|
CVE-2026-74254 |
9.3 | 0.0039 | NET NO AUTH LOW CX NO UI | Joomla Extension - joomlack.fr - SQL injection in Page Builder CK < 3.6.5 - The | |
|
79
|
CVE-2026-76602 |
9.3 | 0.0039 | NET NO AUTH LOW CX NO UI | Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in F | |
|
79
|
CVE-2026-77994 |
9.3 | 0.0039 | NET NO AUTH LOW CX NO UI | Joomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < | |
|
79
|
CVE-2026-102788 |
9.3 | 0.0039 | NET NO AUTH LOW CX NO UI | Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20 | |
|
78
|
CVE-2026-65876 |
9.2 | 0.0039 | NET NO AUTH LOW CX NO UI | Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Bu | |
|
78
|
CVE-2026-61845 |
8.9 | 0.0039 | NET NO AUTH LOW CX NO UI | Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 sp | |
|
78
|
CVE-2026-61684 |
8.8 | 0.0039 | NET NO AUTH LOW CX NO UI | FastGPT is a knowledge-based AI application platform. In 4.15.0-beta4, FastGPT p | |
|
78
|
CVE-2026-9006 |
9.1 | 0.0039 | NET NO AUTH LOW CX NO UI | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side reque | |
|
77
|
CVE-2026-19678 |
8.7 | 0.0039 | NET NO AUTH LOW CX NO UI | A server-side request forgery (SSRF) vulnerability in the unauthenticated form s | |
|
77
|
CVE-2026-59204 |
8.7 | 0.0039 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jp | |
|
77
|
CVE-2026-71255 |
8.6 | 0.0039 | NET NO AUTH LOW CX NO UI | nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client- | |
|
76
|
CVE-2026-94482 |
8.2 | 0.0039 | NET NO AUTH LOW CX NO UI | Next.js is a React framework for building full-stack web applications. From 13.0 | |
|
75
|
CVE-2026-28954 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | A file quarantine bypass was addressed with additional checks. This issue is fix | |
|
75
|
CVE-2026-44594 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | esm.sh is a no-build content delivery network (CDN) for web development. In 137 | |
|
75
|
CVE-2026-63683 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Joomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular | |
|
75
|
CVE-2026-70377 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | imagecli's pipeline operation (Scale::apply in src/image_ops.rs) computes output | |
|
75
|
CVE-2026-110747 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry' | |
|
75
|
CVE-2026-49068 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Subscriber Sensitive Data Exposure in Coupon Affiliates <= 7.8.1 versions. | |
|
75
|
CVE-2026-45357 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure Ja | |
|
75
|
CVE-2026-59199 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordin | |
|
75
|
CVE-2026-59205 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsT | |
|
75
|
CVE-2026-59200 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream | |
|
75
|
CVE-2026-106110 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, the TIFF CCITT Grou | |
|
75
|
CVE-2026-106112 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | ImageSharp is a 2D graphics library. From 4.0.0 until 4.1.2, ICC LUT16 conversio | |
|
75
|
CVE-2026-106115 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | ImageSharp is a 2D graphics library. From 2.1.0 until 4.1.2, the TIFF CCITT Grou | |
|
75
|
CVE-2026-106117 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, decoding a strip TI | |
|
69
|
CVE-2026-15062 |
9.6 | 0.0039 | NET LOW CX NO UI | SQL injection vulnerabilities in the Snowflake Snowpark Python SDK (snowpark-pyt | |
|
67
|
CVE-2026-65708 |
8.6 | 0.0039 | NET LOW CX NO UI | sysPass through version 3.2.11 contains an insecure direct object reference vuln | |
|
67
|
CVE-2026-54307 |
8.5 | 0.0039 | NET LOW CX NO UI | n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, a | |
|
67
|
CVE-2026-114125 |
8.6 | 0.0039 | NET NO AUTH LOW CX | Storybook is a frontend workshop for building user interface components and page | |
|
66
|
CVE-2026-55119 |
8.1 | 0.0039 | NET LOW CX NO UI | A malicious actor with access to the network and low privileges could exploit an | |
|
66
|
CVE-2026-75051 |
8.1 | 0.0039 | NET LOW CX NO UI | In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between | |
|
65
|
CVE-2026-47058 |
7.4 | 0.0039 | NET NO AUTH NO UI | Vulnerability in Oracle Java SE (component: Scripting). Supported versions that | |
|
65
|
CVE-2026-59546 |
7.4 | 0.0039 | NET NO AUTH NO UI | Subscriber Broken Authentication in Hide My WP Ghost <= 7.0.06 versions. | |
|
64
|
CVE-2026-50284 |
7.1 | 0.0039 | NET LOW CX NO UI | Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5. | |
|
64
|
CVE-2026-119049 |
7.2 | 0.0039 | NET LOW CX NO UI | FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows | |
|
64
|
CVE-2026-72782 |
7.1 | 0.0039 | NET LOW CX NO UI | Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 int | |
|
64
|
CVE-2026-40197 |
7.1 | 0.0039 | NET LOW CX NO UI | Incus is a system container and virtual machine manager. In versions before 7.0. | |
|
64
|
CVE-2026-39450 |
7.1 | 0.0039 | NET LOW CX NO UI | Subscriber Broken Authentication in FunnelKit Automations <= 3.7.3 versions. | |
|
64
|
CVE-2026-40785 |
7.1 | 0.0039 | NET LOW CX NO UI | Subscriber Broken Authentication in AutomatorWP <= 5.6.7 versions. | |
|
64
|
CVE-2026-49444 |
7.1 | 0.0039 | NET LOW CX NO UI | n8n is an open source workflow automation platform. Prior to 1.123.48, 2.21.8, a | |
|
64
|
CVE-2026-70557 |
7.1 | 0.0039 | NET LOW CX NO UI | diboot-core's POST /common/load-related-data endpoint resolves caller-supplied f | |
|
62
|
CVE-2026-116808 |
8.6 | 0.0039 | NET LOW CX NO UI | OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authe | |
|
56
|
CVE-2026-70213 |
8.0 | 0.0039 | NET LOW CX | Origin validation error in Microsoft Power Apps allows an authorized attacker to | |
|
55
|
CVE-2026-13925 |
7.5 | 0.0039 | NET NO AUTH | Inappropriate implementation in Downloads in Google Chrome on Windows prior to 1 | |
|
55
|
CVE-2026-18639 |
7.3 | 0.0039 | NET LOW CX | When Velociraptor is configured to use an OIDC IdP for authentication, it uses t |