Hunt List
12,787 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-16375 |
9.8 | 0.0029 | NET NO AUTH LOW CX NO UI | Site isolation issue in the Networking: HTTP component. This vulnerability was f | |
|
79
|
CVE-2026-39502 |
9.3 | 0.0029 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions. | |
|
79
|
CVE-2026-45439 |
9.3 | 0.0029 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in Realtyna Organic IDX plugin <= 5.1.0 versions. | |
|
78
|
CVE-2026-49002 |
9.1 | 0.0029 | NET NO AUTH LOW CX NO UI | Access control failure means that an application does not effectively check user | |
|
78
|
CVE-2026-116211 |
8.8 | 0.0029 | NET NO AUTH LOW CX NO UI | YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManage | |
|
78
|
CVE-2026-13872 |
9.1 | 0.0029 | NET NO AUTH LOW CX NO UI | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on | |
|
78
|
CVE-2025-66844 |
9.1 | 0.0029 | NET NO AUTH LOW CX NO UI | In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered | |
|
78
|
CVE-2024-25181 |
9.1 | 0.0029 | NET NO AUTH LOW CX NO UI | A critical vulnerability has been identified in givanz VvvebJs 1.7.2, which allo | |
|
77
|
CVE-2026-59248 |
8.7 | 0.0029 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits vulnerability in ninenines cowlib allows | |
|
77
|
CVE-2026-116177 |
8.7 | 0.0029 | NET NO AUTH LOW CX NO UI | vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vul | |
|
76
|
CVE-2026-6866 |
8.2 | 0.0029 | NET NO AUTH LOW CX NO UI | CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exi | |
|
75
|
CVE-2026-33359 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | In Meari IoT Cloud alert image storage on Alibaba OSS (latest observed; storage | |
|
75
|
CVE-2026-40691 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received o | |
|
75
|
CVE-2026-118035 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027 | |
|
74
|
CVE-2026-43874 |
7.2 | 0.0029 | NET NO AUTH LOW CX NO UI | WWBN AVideo is an open source video platform. In versions up to and including 29 | |
|
74
|
CVE-2026-109999 |
7.2 | 0.0029 | NET NO AUTH LOW CX NO UI | The AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer | |
|
69
|
CVE-2026-14387 |
9.6 | 0.0029 | NET NO AUTH LOW CX | Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remot | |
|
68
|
CVE-2026-98374 |
8.8 | 0.0029 | NET NO AUTH LOW CX | In the Linux kernel, the following vulnerability has been resolved: tcp: fix us | |
|
68
|
CVE-2026-7927 |
8.8 | 0.0029 | NET NO AUTH LOW CX | Type Confusion in Runtime in Google Chrome prior to 148.0.7778.96 allowed a remo | |
|
68
|
CVE-2023-28829 |
8.8 | 0.0029 | NET LOW CX NO UI | A vulnerability has been identified in SIMATIC NET PC Software V14 (All versions | |
|
68
|
CVE-2026-7957 |
8.8 | 0.0029 | NET NO AUTH LOW CX | Out of bounds write in Media in Google Chrome on Mac, iOS prior to 148.0.7778.96 | |
|
68
|
CVE-2026-8527 |
8.8 | 0.0029 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Downloads in Google Chrome prior t | |
|
67
|
CVE-2026-6819 |
8.7 | 0.0029 | NET NO AUTH LOW CX | HKUDS OpenHarness prior to PR #156 remediation exposes plugin lifecycle commands | |
|
67
|
CVE-2026-67424 |
8.5 | 0.0029 | NET LOW CX NO UI | Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior | |
|
66
|
CVE-2026-54652 |
8.1 | 0.0029 | NET LOW CX NO UI | Frigate is an open source network video recorder. In version 0.17.1, the GET /ap | |
|
66
|
CVE-2026-61726 |
8.1 | 0.0029 | NET LOW CX NO UI | Tandoor Recipes is an application for managing recipes, planning meals, and buil | |
|
66
|
CVE-2026-107928 |
8.1 | 0.0029 | NET NO AUTH NO UI | When curl is built with GnuTLS, a malicious WebSocket server can make curl send | |
|
65
|
CVE-2026-45226 |
7.6 | 0.0029 | NET LOW CX NO UI | Heym before 0.0.21 contains an authorization bypass vulnerability in workflow ex | |
|
65
|
CVE-2026-50631 |
7.4 | 0.0029 | NET NO AUTH NO UI | A race condition in AbstractOAuthDataProvider allows concurrent requests using t | |
|
65
|
CVE-2023-36749 |
7.4 | 0.0029 | NET NO AUTH NO UI | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.1 | |
|
64
|
CVE-2026-17750 |
7.1 | 0.0029 | NET NO AUTH LOW CX | Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote | |
|
64
|
CVE-2026-35000 |
7.1 | 0.0029 | NET LOW CX NO UI | ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerab | |
|
64
|
CVE-2026-57949 |
7.1 | 0.0029 | NET LOW CX NO UI | ruoyi-vue-pro through 2026.05, fixed in commit c779a47, contains a missing autho | |
|
64
|
CVE-2026-118678 |
7.1 | 0.0029 | NET LOW CX NO UI | n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulner | |
|
64
|
CVE-2026-46999 |
7.0 | 0.0029 | NET NO AUTH NO UI | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle E | |
|
64
|
CVE-2026-70676 |
7.0 | 0.0029 | NET NO AUTH NO UI | Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyper | |
|
64
|
CVE-2026-95713 |
7.0 | 0.0029 | NET NO AUTH NO UI | An unauthenticated buffer overflow vulnerability exists in the command line inte | |
|
64
|
CVE-2026-32682 |
7.1 | 0.0029 | NET LOW CX NO UI | When NGINX Gateway Fabric is configured using GRPCRoutes, an authenticated, remo | |
|
64
|
CVE-2026-15641 |
7.1 | 0.0029 | NET LOW CX NO UI | Improper authorization in the access request status endpoint in Devolutions Serv | |
|
64
|
CVE-2026-52729 |
7.1 | 0.0029 | NET LOW CX NO UI | Xibo is an open source digital signage platform with a web content management sy | |
|
64
|
CVE-2026-115373 |
7.0 | 0.0029 | NET LOW CX NO UI | Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missin | |
|
62
|
CVE-2026-66399 |
8.5 | 0.0029 | NET LOW CX NO UI | phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupCont | |
|
57
|
CVE-2026-34748 |
8.7 | 0.0029 | NET LOW CX | Payload is a free and open source headless content management system. Prior to v | |
|
57
|
CVE-2026-15774 |
8.3 | 0.0029 | NET NO AUTH | Use after free in Skia in Google Chrome prior to 150.0.7871.125 allowed a remote | |
|
55
|
CVE-2026-6308 |
7.5 | 0.0029 | NET NO AUTH | Out of bounds read in Media in Google Chrome prior to 147.0.7727.101 allowed a r | |
|
55
|
CVE-2026-6319 |
7.5 | 0.0029 | NET NO AUTH | Use after free in Payments in Google Chrome on Android prior to 147.0.7727.101 a | |
|
55
|
CVE-2026-17816 |
7.5 | 0.0029 | NET NO AUTH | Insufficient policy enforcement in Speech in Google Chrome on Android prior to 1 | |
|
55
|
CVE-2025-61312 |
7.3 | 0.0029 | NET LOW CX | A reflected cross-site scripted (XSS) vulnerability in the acc-menu_pricess.php | |
|
55
|
CVE-2025-61313 |
7.3 | 0.0029 | NET LOW CX | A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_markeralerts | |
|
55
|
CVE-2025-61314 |
7.3 | 0.0029 | NET LOW CX | A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_orderopt.php |