Hunt List
12,364 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
79
|
CVE-2026-6911 |
9.3 | 0.0025 | NET NO AUTH LOW CX NO UI | Missing JWT signature verification in AWS Ops Wheel allows unauthenticated attac | |
|
79
|
CVE-2026-4320 |
9.3 | 0.0025 | NET NO AUTH LOW CX NO UI | Authorization Bypass vulnerability in Creartia's ICMS software could allow an at | |
|
78
|
CVE-2026-114820 |
9.1 | 0.0025 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente | |
|
77
|
CVE-2026-44700 |
8.7 | 0.0026 | NET NO AUTH LOW CX NO UI | Elixir WebRTC is an Elixir implementation of the W3C WebRTC API. Prior to 0.15.1 | |
|
77
|
CVE-2026-60085 |
8.7 | 0.0026 | NET NO AUTH LOW CX NO UI | PraisonAI before 4.6.78 contains an unenforced security policy vulnerability in | |
|
77
|
CVE-2026-61572 |
8.6 | 0.0025 | NET NO AUTH LOW CX NO UI | AVideo is a video-sharing Platform. Before the initial remediation attempt in 8. | |
|
76
|
CVE-2026-57959 |
8.2 | 0.0026 | NET NO AUTH LOW CX NO UI | Hi.Events through 1.9.0 contains a promo code validation vulnerability where res | |
|
76
|
CVE-2026-42735 |
8.2 | 0.0026 | NET NO AUTH LOW CX NO UI | Authentication Bypass Using an Alternate Path or Channel vulnerability in Iqonic | |
|
76
|
CVE-2026-42664 |
8.2 | 0.0025 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in AI Product Search for WooCommerce ̵ | |
|
76
|
CVE-2026-54184 |
8.2 | 0.0025 | NET NO AUTH LOW CX NO UI | Unauthenticated Insecure Direct Object References (IDOR) in Clean Login <= 1.15 | |
|
76
|
CVE-2026-29143 |
7.8 | 0.0025 | NET NO AUTH LOW CX NO UI | SEPPmail Secure Email Gateway before version 15.0.3 does not properly authentica | |
|
76
|
CVE-2026-14541 |
8.0 | 0.0025 | NET NO AUTH LOW CX NO UI | An authentication bypass and audience confusion vulnerability exists in the Goog | |
|
75
|
CVE-2026-44826 |
7.5 | 0.0026 | NET NO AUTH LOW CX NO UI | Vvveb is a powerful and easy to use CMS with page builder to build websites, blo | |
|
75
|
CVE-2026-42736 |
7.5 | 0.0026 | NET NO AUTH LOW CX NO UI | Authorization Bypass Through User-Controlled Key vulnerability in wordplus BP Be | |
|
75
|
CVE-2026-22743 |
7.5 | 0.0026 | NET NO AUTH LOW CX NO UI | Spring AI's spring-ai-neo4j-store contains a Cypher injection vulnerability in N | |
|
75
|
CVE-2026-22744 |
7.5 | 0.0026 | NET NO AUTH LOW CX NO UI | In RedisFilterExpressionConverter of spring-ai-redis-store, when a user-controll | |
|
75
|
CVE-2026-86977 |
7.5 | 0.0026 | NET NO AUTH LOW CX NO UI | An authorization issue was addressed with improved network restrictions. This is | |
|
75
|
CVE-2026-6782 |
7.5 | 0.0025 | NET NO AUTH LOW CX NO UI | Information disclosure in the IP Protection component. This vulnerability was fi | |
|
74
|
CVE-2026-39971 |
7.2 | 0.0026 | NET NO AUTH LOW CX NO UI | Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the | |
|
69
|
CVE-2026-16419 |
9.6 | 0.0026 | NET NO AUTH LOW CX | Out of bounds read and write in ANGLE in Google Chrome on Android prior to 150.0 | |
|
68
|
CVE-2026-12448 |
8.8 | 0.0026 | NET NO AUTH LOW CX | Inappropriate implementation in WebView in Google Chrome on Android prior to 149 | |
|
68
|
CVE-2026-59229 |
8.8 | 0.0026 | NET LOW CX NO UI | The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a hardcoded SU | |
|
68
|
CVE-2026-51905 |
8.8 | 0.0026 | NET LOW CX NO UI | TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in | |
|
68
|
CVE-2022-45846 |
8.8 | 0.0025 | NET NO AUTH LOW CX | Cross-Site Request Forgery (CSRF) vulnerability in Nickys Image Map Pro for Word | |
|
68
|
CVE-2026-39334 |
8.8 | 0.0025 | NET LOW CX NO UI | ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL inj | |
|
68
|
CVE-2026-6360 |
8.8 | 0.0025 | NET NO AUTH LOW CX | Use after free in FileSystem in Google Chrome prior to 147.0.7727.101 allowed a | |
|
68
|
CVE-2026-108303 |
8.8 | 0.0025 | NET LOW CX NO UI | Tanium addressed an unauthorized code execution vulnerability in Certificate Man | |
|
67
|
CVE-2026-34428 |
8.3 | 0.0026 | NET LOW CX NO UI | Vvveb prior to 1.0.8.1 contains a server-side request forgery vulnerability in t | |
|
67
|
CVE-2026-58497 |
8.6 | 0.0026 | NET NO AUTH LOW CX | Uni-CLI gives people and agents one command interface for websites, browsers, de | |
|
67
|
CVE-2026-85299 |
8.3 | 0.0026 | NET LOW CX NO UI | A Missing Authorization vulnerability in the disks.createSnapshot and regionDisk | |
|
67
|
CVE-2026-48007 |
8.6 | 0.0025 | NET LOW CX NO UI | Element Call is a native Matrix video conferencing application. Versions 0.5.17 | |
|
67
|
CVE-2026-116180 |
8.3 | 0.0025 | NET LOW CX NO UI | vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empt | |
|
67
|
CVE-2026-57829 |
8.7 | 0.0025 | NET NO AUTH LOW CX | Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Helix Ultimate | |
|
67
|
CVE-2026-18084 |
8.6 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation vulnerability in Bla | |
|
67
|
CVE-2026-24637 |
8.5 | 0.0025 | NET LOW CX NO UI | Contributor SQL Injection in PowerPress Podcasting <= 11.15.10 versions. | |
|
67
|
CVE-2026-61430 |
8.4 | 0.0025 | NET LOW CX NO UI | PraisonAI before 1.6.78 contains a server-side request forgery vulnerability in | |
|
66
|
CVE-2026-8018 |
8.1 | 0.0026 | NET NO AUTH NO UI | Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778 | |
|
66
|
CVE-2026-12746 |
8.1 | 0.0025 | NET NO AUTH LOW CX | Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not supp | |
|
66
|
CVE-2026-11348 |
8.1 | 0.0025 | NET NO AUTH NO UI | Improper verification of cryptographic signature vulnerability in HAVELSAN Inc. | |
|
66
|
CVE-2026-18098 |
8.1 | 0.0025 | NET LOW CX NO UI | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obta | |
|
65
|
CVE-2023-29054 |
7.4 | 0.0026 | NET NO AUTH NO UI | A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5 | |
|
64
|
CVE-2026-6914 |
7.1 | 0.0026 | NET LOW CX NO UI | Computing the MD5 checksum of a malformed BSON object under specific conditions | |
|
64
|
CVE-2026-116016 |
7.1 | 0.0025 | NET LOW CX NO UI | yudao-cloud through 2026.09 contains an authorization bypass vulnerability that | |
|
59
|
CVE-2026-39325 |
7.2 | 0.0025 | NET LOW CX NO UI | ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL inj | |
|
58
|
CVE-2026-58424 |
8.9 | 0.0025 | NET LOW CX | Permanent Fork PR Workflow Approval Gate Bypass | |
|
57
|
CVE-2026-8512 |
8.3 | 0.0025 | NET NO AUTH | Use after free in FileSystem in Google Chrome prior to 148.0.7778.168 allowed a | |
|
57
|
CVE-2026-12019 |
8.3 | 0.0025 | NET NO AUTH | Heap buffer overflow in Codecs in Google Chrome on Linux and ChromeOS prior to 1 | |
|
55
|
CVE-2026-17952 |
7.5 | 0.0026 | NET NO AUTH | Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.72 allow | |
|
55
|
CVE-2026-8336 |
7.7 | 0.0026 | NET NO UI | After invoking $_internalJsEmit, which is not intended to be directly accessible | |
|
49
|
CVE-2026-101822 |
7.2 | 0.0026 | NET NO UI | Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite |