Hunt List
12,881 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-64025 |
9.8 | 0.0037 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: | |
|
80
|
CVE-2026-92885 |
9.8 | 0.0037 | NET NO AUTH LOW CX NO UI | The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass | |
|
80
|
CVE-2026-40493 |
9.8 | 0.0037 | NET NO AUTH LOW CX NO UI | SAIL is a cross-platform library for loading and saving images with support for | |
|
79
|
CVE-2026-61730 |
9.3 | 0.0037 | NET NO AUTH LOW CX NO UI | SOCFortress CoPilot focuses on providing a single pane of glass for all your sec | |
|
79
|
CVE-2026-41571 |
9.4 | 0.0037 | NET NO AUTH LOW CX NO UI | Note Mark is an open-source note-taking application. In version 0.19.2, IsPasswo | |
|
78
|
CVE-2026-72789 |
9.2 | 0.0037 | NET NO AUTH LOW CX NO UI | SiYuan before v3.7.4 fails to properly validate publish access for encrypted not | |
|
78
|
CVE-2026-118375 |
9.2 | 0.0037 | NET NO AUTH LOW CX NO UI | llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in t | |
|
78
|
CVE-2026-59807 |
8.9 | 0.0037 | NET NO AUTH LOW CX NO UI | Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerabil | |
|
77
|
CVE-2026-3868 |
8.7 | 0.0037 | NET NO AUTH LOW CX NO UI | An improper handling of the length parameter inconsistency vulnerability has bee | |
|
77
|
CVE-2026-32678 |
8.7 | 0.0037 | NET NO AUTH LOW CX NO UI | Authentication bypass issue exists in BUFFALO Wi-Fi router products, which may a | |
|
76
|
CVE-2026-42274 |
7.8 | 0.0037 | NET NO AUTH LOW CX NO UI | Heimdall is a cloud native Identity Aware Proxy and Access Control Decision serv | |
|
75
|
CVE-2025-10528 |
7.3 | 0.0037 | NET NO AUTH LOW CX NO UI | Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canva | |
|
75
|
CVE-2026-13089 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verificatio | |
|
75
|
CVE-2026-118803 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injec | |
|
70
|
CVE-2026-34037 |
9.9 | 0.0037 | NET LOW CX NO UI | Coolify is an open-source and self-hostable tool for managing servers, applicati | |
|
70
|
CVE-2026-46897 |
9.9 | 0.0037 | NET LOW CX NO UI | Vulnerability in the Oracle Enterprise Command Center Framework product of Oracl | |
|
70
|
CVE-2026-46901 |
9.9 | 0.0037 | NET LOW CX NO UI | Vulnerability in the Oracle Enterprise Command Center Framework product of Oracl | |
|
70
|
CVE-2026-106486 |
9.9 | 0.0037 | NET LOW CX NO UI | Backstage is an open framework for building developer portals. Prior to 0.3.10 i | |
|
69
|
CVE-2026-118305 |
9.6 | 0.0037 | NET NO AUTH LOW CX | Memory corruption in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a | |
|
69
|
CVE-2026-118306 |
9.6 | 0.0037 | NET NO AUTH LOW CX | Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.73 allowed | |
|
69
|
CVE-2026-103792 |
9.6 | 0.0037 | NET LOW CX NO UI | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1. | |
|
69
|
CVE-2026-17847 |
9.6 | 0.0037 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 15 | |
|
69
|
CVE-2026-104383 |
9.4 | 0.0037 | NET LOW CX NO UI | Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquil | |
|
68
|
CVE-2026-65616 |
8.8 | 0.0037 | NET LOW CX NO UI | Incorrect authorization validation in refresh token signature allows non-admin u | |
|
68
|
CVE-2026-45418 |
8.8 | 0.0037 | NET LOW CX NO UI | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - | |
|
68
|
CVE-2026-106076 |
9.0 | 0.0037 | NET LOW CX NO UI | A vulnerability allowing an authenticated organization-transfer peer to inject S | |
|
68
|
CVE-2026-7868 |
8.8 | 0.0037 | NET LOW CX NO UI | IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows | |
|
68
|
CVE-2026-17950 |
8.8 | 0.0037 | NET NO AUTH LOW CX | Inappropriate implementation in Safebrowsing in Google Chrome on Mac prior to 15 | |
|
68
|
CVE-2026-86378 |
8.8 | 0.0037 | NET LOW CX NO UI | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS | |
|
67
|
CVE-2026-56225 |
8.7 | 0.0037 | NET LOW CX NO UI | Capgo before 12.128.2 contains an authorization bypass vulnerability in its publ | |
|
67
|
CVE-2026-115935 |
8.7 | 0.0037 | NET LOW CX NO UI | The app/process-api-response-headers action accepts fake Craft API response head | |
|
67
|
CVE-2026-115938 |
8.7 | 0.0037 | NET LOW CX NO UI | Craft CMS allows any authenticated control panel user to submit an element-searc | |
|
67
|
CVE-2026-118668 |
8.6 | 0.0037 | NET LOW CX NO UI | langgraph-api implements the LangGraph API for rapid development and testing. Fr | |
|
67
|
CVE-2026-62234 |
8.4 | 0.0037 | NET LOW CX NO UI | Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing | |
|
67
|
CVE-2026-45229 |
8.7 | 0.0037 | NET LOW CX NO UI | Quark Drive before 0.8.5 contains a mass assignment vulnerability in the POST /u | |
|
67
|
CVE-2026-13381 |
8.7 | 0.0037 | NET LOW CX NO UI | VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference (ID | |
|
66
|
CVE-2026-62967 |
8.1 | 0.0037 | NET LOW CX NO UI | ZTNET is a ZeroTier web UI for private controllers with multiuser and organizati | |
|
65
|
CVE-2026-42141 |
7.7 | 0.0037 | NET LOW CX NO UI | Xibo is an open source digital signage platform with a web content management sy | |
|
65
|
CVE-2026-54607 |
7.7 | 0.0037 | NET LOW CX NO UI | FastGPT is a knowledge-based AI application platform. Prior to 4.15.0-beta4, the | |
|
65
|
CVE-2026-112304 |
7.7 | 0.0037 | NET NO AUTH LOW CX | docTR through 1.1.0 contains an unsafe deserialization vulnerability in load_pre | |
|
64
|
CVE-2026-46355 |
7.1 | 0.0037 | NET LOW CX NO UI | BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButto | |
|
64
|
CVE-2026-13066 |
7.1 | 0.0037 | NET LOW CX NO UI | Improper handling of DBPointer objects during BSON serialization in MongoDB's se | |
|
64
|
CVE-2026-42142 |
7.1 | 0.0037 | NET LOW CX NO UI | TypeBot is a chatbot builder tool. Prior to version 3.17.0, the `handleGetSheets | |
|
64
|
CVE-2026-63177 |
7.1 | 0.0037 | NET LOW CX NO UI | Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role | |
|
64
|
CVE-2026-69087 |
7.1 | 0.0037 | NET NO AUTH LOW CX | The Grav form plugin (getgrav/grav-plugin-form) before 9.1.13 contains an open r | |
|
59
|
CVE-2026-40852 |
7.2 | 0.0037 | NET LOW CX NO UI | A highly authenticated attacker can alter the config generator injecting a paylo | |
|
59
|
CVE-2026-42701 |
7.2 | 0.0037 | NET LOW CX NO UI | Shop manager PHP Object Injection in YayMail <= 4.4.6 versions. | |
|
54
|
CVE-2026-100413 |
7.0 | 0.0037 | NET NO AUTH | SeaweedFS is a distributed storage system for files and blobs. From 4.0.388 unti | |
|
52
|
CVE-2026-25705 |
8.4 | 0.0037 | NET LOW CX | A vulnerability has been identified in [Rancher's Extensions](https://rancherman | |
|
51
|
CVE-2026-15371 |
8.1 | 0.0037 | NET LOW CX | Velociraptor's web GUI allows specifying a custom type for columns in tables. Th |