Hunt List
12,825 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-6771 |
9.8 | 0.0031 | NET NO AUTH LOW CX NO UI | Mitigation bypass in the DOM: Security component. This vulnerability was fixed i | |
|
79
|
CVE-2026-105207 |
9.3 | 0.0031 | NET NO AUTH LOW CX NO UI | ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user | |
|
79
|
CVE-2025-58628 |
9.3 | 0.0031 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
79
|
CVE-2026-64024 |
9.4 | 0.0031 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: tcp: fix st | |
|
79
|
CVE-2026-54808 |
9.3 | 0.0031 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
79
|
CVE-2026-75835 |
9.3 | 0.0031 | NET NO AUTH LOW CX NO UI | Grav API plugin (getgrav/grav-plugin-api) before 1.0.14 contains a missing autho | |
|
78
|
CVE-2026-13851 |
9.1 | 0.0031 | NET NO AUTH LOW CX NO UI | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on | |
|
78
|
CVE-2026-13852 |
9.1 | 0.0031 | NET NO AUTH LOW CX NO UI | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on | |
|
78
|
CVE-2026-0481 |
9.2 | 0.0031 | NET NO AUTH LOW CX NO UI | Unrestricted IP address binding in the AMD Device Metrics Exporter (ROCm ecosyst | |
|
78
|
CVE-2026-111816 |
9.2 | 0.0031 | NET NO AUTH LOW CX NO UI | Apache Traffic Server forwarded a malformed 302 response that should have been r | |
|
77
|
CVE-2023-54346 |
8.7 | 0.0031 | NET NO AUTH LOW CX NO UI | WordPress Plugin Backup Migration 1.2.8 contains an information disclosure vulne | |
|
77
|
CVE-2026-41690 |
8.6 | 0.0031 | NET NO AUTH LOW CX NO UI | 18next-http-middleware is a middleware to be used with Node.js web frameworks li | |
|
77
|
CVE-2026-61454 |
8.7 | 0.0031 | NET NO AUTH LOW CX NO UI | The Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 embeds a global | |
|
75
|
CVE-2026-45088 |
7.5 | 0.0031 | NET NO AUTH LOW CX NO UI | Dalfox is a powerful open-source XSS scanner and utility focused on automation. | |
|
75
|
CVE-2026-50578 |
7.5 | 0.0031 | NET NO AUTH LOW CX NO UI | ePA 3.x Integration implements the authorization workflow and writes Medical Inf | |
|
75
|
CVE-2026-40198 |
7.5 | 0.0031 | NET NO AUTH LOW CX NO UI | Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count | |
|
75
|
CVE-2026-7287 |
7.5 | 0.0031 | NET NO AUTH LOW CX NO UI | ** UNSUPPORTED WHEN ASSIGNED ** A buffer overflow vulnerability in the formWep() | |
|
75
|
CVE-2026-58101 |
7.5 | 0.0031 | NET NO AUTH LOW CX NO UI | Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via | |
|
68
|
CVE-2026-107672 |
8.8 | 0.0031 | NET NO AUTH LOW CX | A maliciously crafted .stack.json file can trigger a trusted Markdown injection | |
|
68
|
CVE-2026-7898 |
8.8 | 0.0031 | NET NO AUTH LOW CX | Use after free in Chromoting in Google Chrome on Linux prior to 148.0.7778.96 al | |
|
68
|
CVE-2026-46916 |
8.8 | 0.0031 | NET LOW CX NO UI | Vulnerability in the Oracle Process Manufacturing Product Development product of | |
|
68
|
CVE-2026-46928 |
8.8 | 0.0031 | NET LOW CX NO UI | Vulnerability in the Oracle Spares Management product of Oracle E-Business Suite | |
|
67
|
CVE-2026-83426 |
8.7 | 0.0031 | NET NO AUTH NO UI | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware ( | |
|
67
|
CVE-2026-52758 |
8.7 | 0.0031 | NET LOW CX NO UI | Ghidra before 12.1 contains a SQL injection vulnerability in BSim filter types t | |
|
66
|
CVE-2026-115193 |
8.2 | 0.0031 | NET NO AUTH LOW CX | A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail v | |
|
66
|
CVE-2026-39443 |
8.1 | 0.0031 | NET NO AUTH NO UI | Unauthenticated PHP Object Injection in EmallShop <= 2.4.21 versions. | |
|
66
|
CVE-2026-39446 |
8.1 | 0.0031 | NET NO AUTH NO UI | Unauthenticated PHP Object Injection in Kapee < 1.7.0 versions. | |
|
66
|
CVE-2026-39539 |
8.1 | 0.0031 | NET NO AUTH NO UI | Unauthenticated PHP Object Injection in Alloggio - Hotel Booking <= 2.1.2 versio | |
|
66
|
CVE-2026-39554 |
8.1 | 0.0031 | NET NO AUTH NO UI | Unauthenticated PHP Object Injection in Fidalgo <= 1.2.2 versions. | |
|
65
|
CVE-2026-54826 |
7.6 | 0.0031 | NET LOW CX NO UI | Subscriber Insecure Direct Object References (IDOR) in SupportCandy <= 3.4.6 ver | |
|
65
|
CVE-2026-61644 |
7.7 | 0.0031 | NET LOW CX NO UI | FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0- | |
|
65
|
CVE-2026-54660 |
7.4 | 0.0031 | NET NO AUTH LOW CX | swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI spe | |
|
64
|
CVE-2026-40482 |
7.1 | 0.0031 | NET LOW CX NO UI | ChurchCRM is an open-source church management system. Versions prior to 7.2.0 ha | |
|
64
|
CVE-2026-61442 |
7.1 | 0.0031 | NET LOW CX NO UI | PraisonAI Platform (praisonai-platform) before 0.1.9 fails to enforce owner/admi | |
|
64
|
CVE-2026-11889 |
7.1 | 0.0031 | NET LOW CX NO UI | SALTO ProAccess Space software using the tenancy feature / logical partition is | |
|
64
|
CVE-2026-53792 |
7.1 | 0.0031 | NET NO AUTH LOW CX | rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-si | |
|
64
|
CVE-2026-109822 |
7.1 | 0.0031 | NET NO AUTH LOW CX | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an iss | |
|
64
|
CVE-2026-61873 |
7.2 | 0.0031 | NET LOW CX NO UI | Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plu | |
|
64
|
CVE-2026-109164 |
7.1 | 0.0031 | NET LOW CX NO UI | TDuck survey form through 6.0 contains an insecure direct object reference vulne | |
|
59
|
CVE-2026-23705 |
7.2 | 0.0031 | NET LOW CX NO UI | An Improper Neutralization of Special Elements used in an SQL Command ('SQL Inje | |
|
57
|
CVE-2026-42197 |
8.7 | 0.0031 | NET LOW CX | RELATE is a web-based courseware package. Versions prior to commit 555f0efb1c5bd | |
|
57
|
CVE-2026-6361 |
8.3 | 0.0031 | NET NO AUTH | Heap buffer overflow in PDFium in Google Chrome on Windows prior to 147.0.7727.1 | |
|
57
|
CVE-2026-40262 |
8.7 | 0.0031 | NET LOW CX | Note Mark is an open-source note-taking application. In versions 0.19.1 and prio | |
|
57
|
CVE-2026-91651 |
8.5 | 0.0031 | NET NO UI | Vulnerability in Oracle Essbase (component: Essbase Web Platform). The support | |
|
57
|
CVE-2026-35574 |
8.7 | 0.0031 | NET LOW CX | ChurchCRM is an open-source church management system. Prior to 6.5.3, a stored C | |
|
56
|
CVE-2026-64954 |
8.2 | 0.0031 | NET NO UI | Velociraptor allows scheduling new collections via VQL queries in notebooks. For | |
|
55
|
CVE-2026-46957 |
7.5 | 0.0031 | NET NO UI | Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite | |
|
55
|
CVE-2026-46966 |
7.5 | 0.0031 | NET NO UI | Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Su | |
|
55
|
CVE-2026-101428 |
7.5 | 0.0031 | NET NO UI | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS | |
|
55
|
CVE-2026-48972 |
7.5 | 0.0031 | NET NO UI | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP |