Hunt List
12,384 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-5735 |
9.8 | 0.0026 | NET NO AUTH LOW CX NO UI | Memory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1. Some of t | |
|
80
|
CVE-2026-41153 |
9.8 | 0.0026 | NET NO AUTH LOW CX NO UI | In JetBrains Junie before 252.549.29 command execution was possible via maliciou | |
|
79
|
CVE-2026-42300 |
9.3 | 0.0026 | NET NO AUTH LOW CX NO UI | DevGuard provides vulnerability management for the full software supply chain. P | |
|
78
|
CVE-2026-44699 |
9.1 | 0.0026 | NET NO AUTH LOW CX NO UI | LibJWT is a C JSON Web Token Library. From 3.0.0 to 3.3.2, libjwt accepts an RSA | |
|
78
|
CVE-2026-53661 |
8.8 | 0.0026 | NET NO AUTH LOW CX NO UI | Boruta is a standalone authorization server that aims to implement OAuth 2.0 and | |
|
78
|
CVE-2026-64623 |
8.8 | 0.0026 | NET NO AUTH LOW CX NO UI | Network-AI before 5.13.4 contains an improper cryptographic signature verificati | |
|
78
|
CVE-2026-92388 |
9.1 | 0.0026 | NET NO AUTH LOW CX NO UI | When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path | |
|
77
|
CVE-2026-9221 |
8.7 | 0.0026 | NET NO AUTH LOW CX NO UI | The Setracker2 Android Companion App (com.tgelec.setracker) versions 3.1.5 and e | |
|
77
|
CVE-2026-4931 |
8.6 | 0.0026 | NET NO AUTH LOW CX NO UI | Smart contract Marginal v1 performs unsafe downcast, allowing attackers to settl | |
|
76
|
CVE-2026-9535 |
8.2 | 0.0026 | NET NO AUTH LOW CX NO UI | A out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 func | |
|
75
|
CVE-2026-41712 |
7.5 | 0.0026 | NET NO AUTH LOW CX NO UI | Spring AI's chat memory component contained a problematic default that, when not | |
|
75
|
CVE-2026-29129 |
7.5 | 0.0026 | NET NO AUTH LOW CX NO UI | Configured cipher preference order not preserved vulnerability in Apache Tomcat. | |
|
75
|
CVE-2026-45441 |
7.5 | 0.0026 | NET NO AUTH LOW CX NO UI | Unauthenticated Other Vulnerability Type in WpEvently <= 5.3.3 versions. | |
|
75
|
CVE-2024-29371 |
7.5 | 0.0026 | NET NO AUTH LOW CX NO UI | In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) conditio | |
|
75
|
CVE-2026-6766 |
7.5 | 0.0026 | NET NO AUTH LOW CX NO UI | Incorrect boundary conditions in the Libraries component in NSS. This vulnerabil | |
|
75
|
CVE-2026-92390 |
7.5 | 0.0026 | NET NO AUTH LOW CX NO UI | When invoked with `--remote-header-name` (`-J`), curl fails to preserve its docu | |
|
75
|
CVE-2026-54425 |
7.5 | 0.0026 | NET NO AUTH LOW CX NO UI | Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 | |
|
69
|
CVE-2026-7321 |
9.6 | 0.0026 | NET NO AUTH LOW CX | Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking co | |
|
69
|
CVE-2026-55486 |
9.3 | 0.0026 | NET NO AUTH LOW CX | The Goobi viewer is a web application that allows digitised material to be displ | |
|
68
|
CVE-2026-8531 |
8.8 | 0.0026 | NET NO AUTH LOW CX | Heap buffer overflow in WebML in Google Chrome on Windows prior to 148.0.7778.16 | |
|
68
|
CVE-2026-65220 |
8.8 | 0.0026 | NET LOW CX NO UI | A logic flaw in the BMC IPMI implementation may allow an attacker to send specia | |
|
68
|
CVE-2026-12452 |
8.8 | 0.0026 | NET NO AUTH LOW CX | Use after free in Downloads in Google Chrome on Android prior to 149.0.7827.155 | |
|
68
|
CVE-2026-72578 |
8.8 | 0.0026 | NET NO AUTH LOW CX | A cross-site request forgery (CSRF) vulnerability in FreePBX Framework 17.0 allo | |
|
67
|
CVE-2026-27668 |
8.7 | 0.0026 | NET LOW CX NO UI | A vulnerability has been identified in RUGGEDCOM CROSSBOW Secure Access Manager | |
|
67
|
CVE-2026-49498 |
8.7 | 0.0026 | NET LOW CX NO UI | Ghidra 11.0 before 12.1 contains a SQL injection vulnerability in the changePass | |
|
67
|
CVE-2026-7491 |
8.6 | 0.0026 | NET LOW CX NO UI | School App developed by Zyosoft has an Insecure Direct Object Reference vulnerab | |
|
67
|
CVE-2026-71272 |
8.5 | 0.0026 | NET LOW CX NO UI | Memos' webhook dispatch function safeDialContext (internal/webhook/webhook.go) r | |
|
67
|
CVE-2026-72741 |
8.6 | 0.0026 | NET LOW CX NO UI | Rainbond through 6.9.7 contains a broken access control vulnerability in the Che | |
|
66
|
CVE-2026-54691 |
8.2 | 0.0026 | NET NO AUTH LOW CX | datamodel-code-generator generates Python data models from schema definitions. F | |
|
66
|
CVE-2026-39884 |
8.1 | 0.0026 | NET LOW CX NO UI | mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster | |
|
66
|
CVE-2026-92389 |
8.1 | 0.0026 | NET NO AUTH NO UI | libcurl's TFTP state machine fails to validate state transitions against the req | |
|
66
|
CVE-2026-112852 |
8.1 | 0.0026 | NET NO AUTH NO UI | Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion | |
|
65
|
CVE-2026-31945 |
7.7 | 0.0026 | NET LOW CX NO UI | LibreChat is a ChatGPT clone with additional features. Versions 0.8.2-rc2 throug | |
|
65
|
CVE-2026-96581 |
7.6 | 0.0026 | NET LOW CX NO UI | Authorization Bypass Through User-Controlled Key vulnerability in ash-project as | |
|
64
|
CVE-2026-32960 |
7.1 | 0.0026 | NET NO AUTH LOW CX | SD-330AC and AMC Manager provided by silex technology, Inc. contain an issue wit | |
|
64
|
CVE-2026-6834 |
7.1 | 0.0026 | NET LOW CX NO UI | The a+HRD developed by aEnrich has a Missing Authorization vulnerability, allowi | |
|
64
|
CVE-2026-61440 |
7.1 | 0.0026 | NET LOW CX NO UI | PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-labe | |
|
64
|
CVE-2026-8199 |
7.1 | 0.0026 | NET LOW CX NO UI | An authenticated user can cause excess memory usage via bitwise match expression | |
|
64
|
CVE-2026-54040 |
7.1 | 0.0026 | NET LOW CX NO UI | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prio | |
|
64
|
CVE-2026-109341 |
7.1 | 0.0026 | NET LOW CX NO UI | SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allow | |
|
62
|
CVE-2026-39459 |
8.6 | 0.0026 | NET LOW CX NO UI | A vulnerability exists in iControl REST and the TMOS Shell (tmsh) where a highly | |
|
57
|
CVE-2026-118648 |
8.4 | 0.0026 | NET LOW CX | n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a stor | |
|
57
|
CVE-2026-14427 |
8.3 | 0.0026 | NET NO AUTH | Heap buffer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a r | |
|
57
|
CVE-2026-53608 |
8.7 | 0.0026 | NET LOW CX | ApostropheCMS is an open-source Node.js content management system. Versions up t | |
|
55
|
CVE-2026-109089 |
7.5 | 0.0026 | NET NO AUTH | A buffer overflow when handling DEVICE_RESOLUTION in libXi before 1.8.4 could ov | |
|
55
|
CVE-2026-109090 |
7.5 | 0.0026 | NET NO AUTH | A malicious X server could cause a heap overflow by injecting a large DEVICE_ENA | |
|
55
|
CVE-2026-8547 |
7.5 | 0.0026 | NET NO AUTH | Insufficient policy enforcement in Passwords in Google Chrome on Windows prior t | |
|
54
|
CVE-2026-41272 |
7.1 | 0.0026 | NET NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
42
|
CVE-2026-92744 |
8.7 | 0.0026 | NET | Under certain conditions, privilege manager agent allows a remote unauthenticate | |
|
40
|
CVE-2026-42224 |
7.6 | 0.0026 | NET | ipl/web is a set of common web components for php projects. Prior to versions 0. |