Hunt List
12,762 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
79
|
CVE-2026-55740 |
9.3 | 0.0028 | NET NO AUTH LOW CX NO UI | Nur-Alam39 bus-ticket (no released versions; latest commit 459cabdbeb99c00225b26 | |
|
78
|
CVE-2026-63687 |
9.1 | 0.0028 | NET NO AUTH LOW CX NO UI | Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT in | |
|
78
|
CVE-2026-116163 |
9.1 | 0.0028 | NET NO AUTH LOW CX NO UI | Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authenti | |
|
78
|
CVE-2026-47746 |
8.9 | 0.0028 | NET NO AUTH LOW CX NO UI | Misskey is an open source, federated social media platform. Versions 12.37.0 and | |
|
78
|
CVE-2026-34727 |
9.1 | 0.0028 | NET NO AUTH LOW CX NO UI | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, | |
|
78
|
CVE-2026-46713 |
9.2 | 0.0028 | NET NO AUTH LOW CX NO UI | Misskey is an open source, federated social media platform. Versions 12.37.0 and | |
|
77
|
CVE-2026-102556 |
8.6 | 0.0028 | NET NO AUTH LOW CX NO UI | A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, Sou | |
|
77
|
CVE-2026-102557 |
8.6 | 0.0028 | NET NO AUTH LOW CX NO UI | A flaw was found in libsoup. When reassembling fragmented WebSocket messages int | |
|
76
|
CVE-2026-45137 |
8.2 | 0.0028 | NET NO AUTH LOW CX NO UI | Anchor is a framework providing several convenient developer tools for writing S | |
|
75
|
CVE-2026-7528 |
7.5 | 0.0028 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.9.0 could allow a denial of service due to unco | |
|
75
|
CVE-2026-32995 |
7.5 | 0.0028 | NET NO AUTH LOW CX NO UI | The Rocket.Chat DDP method autoTranslate.translateMessage in versions <8.5.0, <8 | |
|
75
|
CVE-2026-106174 |
7.5 | 0.0028 | NET NO AUTH LOW CX NO UI | A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 throug | |
|
75
|
CVE-2026-61569 |
7.5 | 0.0028 | NET NO AUTH LOW CX NO UI | AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer | |
|
75
|
CVE-2026-55973 |
7.5 | 0.0028 | NET NO AUTH LOW CX NO UI | In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporti | |
|
70
|
CVE-2026-49774 |
9.9 | 0.0028 | NET LOW CX NO UI | Improper Control of Generation of Code ('Code Injection') vulnerability in Filip | |
|
69
|
CVE-2026-14382 |
9.6 | 0.0028 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 15 | |
|
68
|
CVE-2026-118359 |
8.8 | 0.0028 | NET NO AUTH LOW CX | Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote | |
|
68
|
CVE-2026-100801 |
8.8 | 0.0028 | NET NO AUTH LOW CX | Privilege escalation in the DLL Services component. This vulnerability was fixed | |
|
68
|
CVE-2026-7896 |
8.8 | 0.0028 | NET NO AUTH LOW CX | Integer overflow in Blink in Google Chrome prior to 148.0.7778.96 allowed a remo | |
|
68
|
CVE-2026-8518 |
8.8 | 0.0028 | NET NO AUTH LOW CX | Use after free in Blink in Google Chrome prior to 148.0.7778.168 allowed a remot | |
|
68
|
CVE-2026-8522 |
8.8 | 0.0028 | NET NO AUTH LOW CX | Use after free in Downloads in Google Chrome on Mac prior to 148.0.7778.168 allo | |
|
68
|
CVE-2026-8532 |
8.8 | 0.0028 | NET NO AUTH LOW CX | Integer overflow in XML in Google Chrome prior to 148.0.7778.168 allowed a remot | |
|
68
|
CVE-2026-8544 |
8.8 | 0.0028 | NET NO AUTH LOW CX | Use after free in Media in Google Chrome prior to 148.0.7778.168 allowed a remot | |
|
68
|
CVE-2026-8549 |
8.8 | 0.0028 | NET NO AUTH LOW CX | Use after free in Media in Google Chrome prior to 148.0.7778.168 allowed a remot | |
|
68
|
CVE-2026-8551 |
8.8 | 0.0028 | NET NO AUTH LOW CX | Use after free in Downloads in Google Chrome prior to 148.0.7778.168 allowed a r | |
|
68
|
CVE-2026-8555 |
8.8 | 0.0028 | NET NO AUTH LOW CX | Use after free in GTK in Google Chrome on Windows prior to 148.0.7778.168 allowe | |
|
67
|
CVE-2026-49478 |
8.7 | 0.0028 | NET NO AUTH NO UI | Fulcio is a certificate authority for issuing code signing certificates for an O | |
|
67
|
CVE-2026-62231 |
8.6 | 0.0028 | NET LOW CX NO UI | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 contains an authoriza | |
|
67
|
CVE-2025-14260 |
8.3 | 0.0028 | NET LOW CX NO UI | Due to the improper implementation of access control rules, the WSO2 product acc | |
|
66
|
CVE-2026-23708 |
8.1 | 0.0028 | NET NO AUTH NO UI | A improper authentication vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through | |
|
66
|
CVE-2026-39587 |
8.1 | 0.0028 | NET NO AUTH NO UI | Unauthenticated Privilege Escalation in WP BASE Booking <= 5.9.0 versions. | |
|
66
|
CVE-2026-45743 |
8.1 | 0.0028 | NET LOW CX NO UI | Termix is a web-based server management platform with SSH terminal, tunneling, a | |
|
66
|
CVE-2026-106457 |
8.1 | 0.0028 | NET LOW CX NO UI | Backstage is an open framework for building developer portals. From 0.1.0 until | |
|
65
|
CVE-2026-118510 |
7.7 | 0.0028 | NET LOW CX NO UI | A type-handling flaw in the relationship query building of this MongoDB integrat | |
|
65
|
CVE-2026-60629 |
7.5 | 0.0028 | NET NO AUTH NO UI | Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (comp | |
|
65
|
CVE-2026-61138 |
7.5 | 0.0028 | NET NO AUTH NO UI | Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of | |
|
65
|
CVE-2026-33376 |
7.4 | 0.0028 | NET NO AUTH NO UI | When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 add | |
|
65
|
CVE-2026-41414 |
7.4 | 0.0028 | NET NO AUTH LOW CX | Skim is a fuzzy finder designed to through files, lines, and commands. The gener | |
|
64
|
CVE-2026-101769 |
7.0 | 0.0028 | NET NO AUTH NO UI | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: | |
|
64
|
CVE-2026-41122 |
7.1 | 0.0028 | NET NO AUTH LOW CX | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release ver | |
|
63
|
CVE-2026-46872 |
9.0 | 0.0028 | NET LOW CX NO UI | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle E | |
|
63
|
CVE-2026-10141 |
9.1 | 0.0028 | NET LOW CX NO UI | A Unsigned Firmware vulnerability exists in the boa Firmware Update functionalit | |
|
58
|
CVE-2026-42523 |
9.0 | 0.0028 | NET LOW CX | Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job UR | |
|
57
|
CVE-2026-56663 |
8.5 | 0.0028 | NET NO UI | AutoGPT is a workflow automation platform for creating, deploying, and managing | |
|
57
|
CVE-2026-45392 |
8.4 | 0.0028 | NET LOW CX | DOM-based cross-site scripting (XSS) in Cribl Stream before 4.17.1 allows a remo | |
|
56
|
CVE-2026-42524 |
8.0 | 0.0028 | NET LOW CX | Jenkins HTML Publisher Plugin 427 and earlier does not escape job name and URL i | |
|
55
|
CVE-2026-97328 |
7.5 | 0.0028 | NET NO AUTH | The WebP Express WordPress plugin before 0.25.16 does not escape values that its | |
|
55
|
CVE-2026-109936 |
7.5 | 0.0028 | NET NO AUTH | The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a patte | |
|
55
|
CVE-2026-91405 |
7.5 | 0.0028 | NET NO AUTH | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl | |
|
54
|
CVE-2026-6966 |
7.0 | 0.0028 | NET NO UI | Improper verification of cryptographic signature uniqueness in delegated role va |