Hunt List
12,830 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-112847 |
9.8 | 0.0031 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allo | |
|
80
|
CVE-2026-112848 |
9.8 | 0.0031 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev | |
|
80
|
CVE-2026-112851 |
9.8 | 0.0031 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotloc | |
|
80
|
CVE-2026-112854 |
9.8 | 0.0031 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center h | |
|
80
|
CVE-2026-112855 |
9.8 | 0.0031 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows | |
|
80
|
CVE-2026-112856 |
9.8 | 0.0031 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vaga | |
|
80
|
CVE-2026-112858 |
9.8 | 0.0031 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos all | |
|
80
|
CVE-2026-112859 |
9.8 | 0.0031 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies | |
|
80
|
CVE-2026-62131 |
9.8 | 0.0031 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions. | |
|
80
|
CVE-2026-33519 |
9.8 | 0.0031 | NET NO AUTH LOW CX NO UI | An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, | |
|
80
|
CVE-2026-54433 |
10.0 | 0.0031 | NET NO AUTH LOW CX NO UI | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross | |
|
80
|
CVE-2026-49769 |
9.8 | 0.0031 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions. | |
|
80
|
CVE-2026-18108 |
9.8 | 0.0031 | NET NO AUTH LOW CX NO UI | Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _ve | |
|
79
|
CVE-2026-49080 |
9.3 | 0.0031 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in wpDataTables <= 7.3.6 versions. | |
|
78
|
CVE-2026-41691 |
9.1 | 0.0031 | NET NO AUTH LOW CX NO UI | Copilot said: i18nextify is a JavaScript library that adds i18nextify is a JavaS | |
|
78
|
CVE-2026-34751 |
9.1 | 0.0031 | NET NO AUTH LOW CX NO UI | Payload is a free and open source headless content management system. Prior to v | |
|
77
|
CVE-2026-6375 |
8.7 | 0.0031 | NET NO AUTH LOW CX NO UI | A vulnerability in SpiceJet’s booking API allows unauthenticated users to query | |
|
75
|
CVE-2026-59198 |
7.5 | 0.0031 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE en | |
|
75
|
CVE-2025-63895 |
7.5 | 0.0031 | NET NO AUTH LOW CX NO UI | An issue in the Bluetooth firmware of JXL 9 Inch Car Android Double Din Player A | |
|
75
|
CVE-2026-36837 |
7.5 | 0.0031 | NET NO AUTH LOW CX NO UI | TOTOLINK A3002RU V3 <= V3.0.0-B20220304.1804 was discovered to contain a stack-b | |
|
75
|
CVE-2026-39870 |
7.5 | 0.0031 | NET NO AUTH LOW CX NO UI | The issue was addressed with improved memory handling. This issue is fixed in ma | |
|
75
|
CVE-2026-39871 |
7.5 | 0.0031 | NET NO AUTH LOW CX NO UI | A path handling issue was addressed with improved logic. This issue is fixed in | |
|
75
|
CVE-2026-42348 |
7.5 | 0.0031 | NET NO AUTH LOW CX NO UI | OpenTelemetry.OpAmp.Client is the OpAMP client for OpenTelemetry .NET. Prior to | |
|
69
|
CVE-2026-37171 |
9.6 | 0.0031 | NET LOW CX NO UI | A lack of tenant separation in SuperTokens Inc. SuperTokens Core v6.0.0 to v11.4 | |
|
69
|
CVE-2026-61451 |
9.4 | 0.0031 | NET NO AUTH LOW CX | The Grav API plugin (grav-plugin-api) before 1.0.4 does not validate the origin | |
|
69
|
CVE-2026-115384 |
9.4 | 0.0031 | NET LOW CX NO UI | Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer o | |
|
68
|
CVE-2026-32999 |
9.0 | 0.0031 | NET NO AUTH NO UI | Insufficient character filtering in backup agent signing module on Comet Backup | |
|
68
|
CVE-2026-8558 |
8.8 | 0.0031 | NET NO AUTH LOW CX | Out of bounds write in Fonts in Google Chrome prior to 148.0.7778.168 allowed a | |
|
67
|
CVE-2026-18597 |
8.5 | 0.0031 | NET LOW CX NO UI | The PDF creation feature of Foxit PDF Services API supports referencing external | |
|
67
|
CVE-2026-4827 |
8.7 | 0.0031 | NET NO AUTH LOW CX | CWE‑331: Insufficient Entropy vulnerability exists that could lead to unauthoriz | |
|
67
|
CVE-2026-118669 |
8.4 | 0.0031 | NET LOW CX NO UI | OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+ | |
|
67
|
CVE-2026-104084 |
8.7 | 0.0031 | NET LOW CX NO UI | SmarterMail before build 9777 contains a privilege escalation vulnerability wher | |
|
66
|
CVE-2026-29206 |
8.1 | 0.0031 | NET NO AUTH LOW CX | Insufficient sanitization of SQL queries in the `sqloptimizer` utility script al | |
|
65
|
CVE-2026-40885 |
7.7 | 0.0031 | NET NO AUTH LOW CX | goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, go | |
|
64
|
CVE-2026-49339 |
7.1 | 0.0031 | NET LOW CX NO UI | gonic is a music streaming server / free-software subsonic server API implementa | |
|
64
|
CVE-2026-62387 |
7.1 | 0.0031 | NET NO AUTH LOW CX | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 shipped Access- | |
|
64
|
CVE-2026-67329 |
7.1 | 0.0031 | NET LOW CX NO UI | @better-auth/stripe versions >= 1.4.11 and < 1.6.21, and >= 1.7.0-beta.0 and < 1 | |
|
64
|
CVE-2026-50007 |
7.2 | 0.0031 | NET LOW CX NO UI | Actual is an open-source personal finance application. Prior to 26.7.0, a missin | |
|
64
|
CVE-2026-13227 |
7.1 | 0.0031 | NET LOW CX NO UI | An Improper Authorization vulnerability exists in ERPNext version <v16.25.0 and | |
|
64
|
CVE-2026-110829 |
7.1 | 0.0031 | NET NO AUTH LOW CX | FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in | |
|
64
|
CVE-2026-110834 |
7.1 | 0.0031 | NET NO AUTH LOW CX | FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerabili | |
|
64
|
CVE-2026-110836 |
7.1 | 0.0031 | NET NO AUTH LOW CX | FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http | |
|
59
|
CVE-2026-115251 |
7.2 | 0.0031 | NET LOW CX NO UI | The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click up | |
|
58
|
CVE-2026-34564 |
9.0 | 0.0031 | NET LOW CX | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo | |
|
57
|
CVE-2026-109290 |
8.4 | 0.0031 | NET LOW CX | Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vuln | |
|
57
|
CVE-2026-46870 |
8.5 | 0.0031 | NET NO UI | Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell for V | |
|
55
|
CVE-2026-27366 |
7.5 | 0.0031 | NET NO AUTH | Unauthenticated Broken Access Control in MainWP Child <= 6.1.1 versions. | |
|
55
|
CVE-2026-13807 |
7.5 | 0.0031 | NET NO AUTH | Use after free in Import in Google Chrome on iOS prior to 150.0.7871.47 allowed | |
|
55
|
CVE-2026-35295 |
7.5 | 0.0031 | NET NO UI | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware | |
|
55
|
CVE-2026-46934 |
7.5 | 0.0031 | NET NO UI | Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of |