Hunt List
12,861 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-27395 |
9.8 | 0.0034 | NET NO AUTH LOW CX NO UI | Unauthenticated Privilege Escalation in Support Board < 3.8.9 versions. | |
|
80
|
CVE-2026-28148 |
9.8 | 0.0034 | NET NO AUTH LOW CX NO UI | Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions. | |
|
75
|
CVE-2026-59530 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Stripe For WooCommerce <= 4.0.7 version | |
|
75
|
CVE-2026-59534 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Post My CF7 Form <= 6.2.0 versions. | |
|
75
|
CVE-2026-59536 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in CoCart – Headless ecommerce <= 4.8.4 ve | |
|
75
|
CVE-2026-59539 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Subscriber Insecure Direct Object References (IDOR) in Paid Member Subscriptions | |
|
75
|
CVE-2026-66473 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Xendit Payment <= 7.1.0 versions. | |
|
75
|
CVE-2026-28140 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 versions. | |
|
75
|
CVE-2026-66712 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions. | |
|
75
|
CVE-2026-27345 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= | |
|
75
|
CVE-2026-66431 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for W | |
|
75
|
CVE-2026-66466 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for Wo | |
|
75
|
CVE-2026-66469 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Arvow AI SEO Writer <= 1.5.3 versions. | |
|
75
|
CVE-2026-73377 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 vers | |
|
75
|
CVE-2026-73994 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions. | |
|
69
|
CVE-2026-13789 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote a | |
|
69
|
CVE-2026-13792 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in Touchbar in Google Chrome on Mac prior to 150.0.7871.47 allowe | |
|
69
|
CVE-2026-13843 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on | |
|
69
|
CVE-2026-13846 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in USB in Google Chrome on Mac prior to 150.0.7871.47 allowed a r | |
|
69
|
CVE-2026-13869 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in Device in Google Chrome on Windows prior to 150.0.7871.47 allo | |
|
69
|
CVE-2026-13901 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Insufficient policy enforcement in Serial in Google Chrome prior to 150.0.7871.4 | |
|
69
|
CVE-2026-13909 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Insufficient policy enforcement in DevTools in Google Chrome prior to 150.0.7871 | |
|
69
|
CVE-2026-13920 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Media in Google Chrome on Windows | |
|
69
|
CVE-2026-13934 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Dawn in Google Chrome on Android p | |
|
69
|
CVE-2026-14017 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Inappropriate implementation in Navigation in Google Chrome prior to 150.0.7871. | |
|
69
|
CVE-2026-14037 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Insufficient policy enforcement in GPU in Google Chrome prior to 150.0.7871.47 a | |
|
69
|
CVE-2026-14043 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in GetUserMedia in Google Chrome prior to 150.0.7871.47 allowed a | |
|
69
|
CVE-2026-14055 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Device Trust in Google Chrome on W | |
|
69
|
CVE-2026-14106 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Text in Google Chrome on Android p | |
|
69
|
CVE-2026-14109 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Insufficient policy enforcement in Mojo in Google Chrome prior to 150.0.7871.47 | |
|
69
|
CVE-2026-14120 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 | |
|
69
|
CVE-2026-14392 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Out of bounds write in Tint in Google Chrome prior to 150.0.7871.46 allowed a re | |
|
69
|
CVE-2026-14416 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Out of bounds read in Dawn in Google Chrome prior to 150.0.7871.46 allowed a rem | |
|
69
|
CVE-2026-14417 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote | |
|
69
|
CVE-2026-14420 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Out of bounds read and write in Dawn in Google Chrome prior to 150.0.7871.46 all | |
|
69
|
CVE-2026-14424 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in Dawn in Google Chrome on Mac prior to 150.0.7871.46 allowed a | |
|
69
|
CVE-2026-15113 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in Autofill in Google Chrome on Android prior to 150.0.7871.115 a | |
|
69
|
CVE-2026-15773 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in Core in Google Chrome on Windows prior to 150.0.7871.125 allow | |
|
69
|
CVE-2026-15899 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in CameraCapture in Google Chrome on Mac prior to 150.0.7871.128 | |
|
69
|
CVE-2026-15900 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in GPU in Google Chrome on Android prior to 150.0.7871.128 allowe | |
|
69
|
CVE-2026-15901 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in Network in Google Chrome prior to 150.0.7871.128 allowed a rem | |
|
69
|
CVE-2026-16424 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in GPU in Google Chrome on Android prior to 150.0.7871.182 allowe | |
|
69
|
CVE-2026-17651 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Dawn in Google Chrome on Android p | |
|
69
|
CVE-2026-17652 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in Views in Google Chrome prior to 151.0.7922.72 allowed a remote | |
|
69
|
CVE-2026-17656 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in Ozone in Google Chrome prior to 151.0.7922.72 allowed a remote | |
|
69
|
CVE-2026-17669 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to | |
|
69
|
CVE-2026-17670 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in Views in Google Chrome prior to 151.0.7922.72 allowed a remote | |
|
64
|
CVE-2026-72825 |
7.2 | 0.0035 | NET LOW CX NO UI | The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap b | |
|
64
|
CVE-2026-55197 |
7.1 | 0.0035 | NET LOW CX NO UI | Hermes WebUI before 0.51.443 contains a broken access control vulnerability in t | |
|
64
|
CVE-2026-55198 |
7.1 | 0.0035 | NET LOW CX NO UI | Hermes WebUI before 0.51.443 contains an authorization bypass vulnerability in t |