Hunt List
12,309 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-25208 |
9.8 | 0.0025 | NET NO AUTH LOW CX NO UI | Integer overflow vulnerability in Samsung Open Source Escargot allows Overflow B | |
|
78
|
CVE-2026-25209 |
9.1 | 0.0025 | NET NO AUTH LOW CX NO UI | Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource | |
|
78
|
CVE-2026-12315 |
9.1 | 0.0025 | NET NO AUTH LOW CX NO UI | Mitigation bypass in the DOM: Security component. This vulnerability was fixed i | |
|
78
|
CVE-2026-14571 |
9.1 | 0.0025 | NET NO AUTH LOW CX NO UI | A Blind SQL Injection vulnerability in Futurum Software’s management software, c | |
|
78
|
CVE-2026-7300 |
8.8 | 0.0025 | NET NO AUTH LOW CX NO UI | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerabi | |
|
76
|
CVE-2020-37287 |
8.2 | 0.0025 | NET NO AUTH LOW CX NO UI | Vyper before 0.2.6 contains a call stack corruption vulnerability that causes in | |
|
75
|
CVE-2026-12310 |
7.5 | 0.0025 | NET NO AUTH LOW CX NO UI | Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Fire | |
|
75
|
CVE-2026-12312 |
7.5 | 0.0025 | NET NO AUTH LOW CX NO UI | Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Fire | |
|
75
|
CVE-2026-12314 |
7.5 | 0.0025 | NET NO AUTH LOW CX NO UI | Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Fire | |
|
75
|
CVE-2026-34886 |
7.5 | 0.0025 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Simple Membership <= 4.7.1 versions. | |
|
69
|
CVE-2026-12440 |
9.6 | 0.0025 | NET NO AUTH LOW CX | Use after free in DigitalCredentials in Google Chrome on Windows prior to 149.0. | |
|
65
|
CVE-2026-65824 |
7.4 | 0.0025 | NET NO AUTH NO UI | OpenReception's appointment booking software provides an end-to-end encrypted ap | |
|
65
|
CVE-2026-40762 |
7.5 | 0.0025 | NET NO AUTH NO UI | Unauthenticated SQL Injection in WPGraphQL < 2.11.1 versions. | |
|
64
|
CVE-2026-42749 |
7.1 | 0.0025 | NET LOW CX NO UI | Authentication Bypass Using an Alternate Path or Channel vulnerability in Themei | |
|
64
|
CVE-2026-118038 |
7.1 | 0.0025 | NET LOW CX NO UI | In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027 | |
|
64
|
CVE-2026-56005 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-56014 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-56042 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Customer Cross Site Scripting (XSS) in Advanced Order Export For WooCommerce <= | |
|
64
|
CVE-2026-56071 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.53.1 versions. | |
|
64
|
CVE-2026-56011 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in MapPress Maps for WordPress <= 2.9 | |
|
64
|
CVE-2026-56039 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Quick Interest Slider <= 3.1.6 ver | |
|
64
|
CVE-2026-56040 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Gutenverse Form <= 2.4.7 versions. | |
|
64
|
CVE-2026-56041 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Responsive Lightbox <= 2.7.6 versi | |
|
64
|
CVE-2026-56043 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Customer Reviews for WooCommerce < | |
|
64
|
CVE-2026-56044 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Blog2Social <= 8.9.2 versions. | |
|
64
|
CVE-2026-56045 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Automatic < 3.135.1 versions. | |
|
64
|
CVE-2026-56047 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.3 versions. | |
|
64
|
CVE-2026-56072 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in WoodMart <= 8.5.3 versions. | |
|
64
|
CVE-2026-57312 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Everest Forms <= 3.4.8 versions. | |
|
64
|
CVE-2026-57319 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in FOX <= 1.4.8 versions. | |
|
64
|
CVE-2026-57322 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57325 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in NanoMag <= 1.8 versions. | |
|
64
|
CVE-2026-57320 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in BEAR <= 1.1.8 versions. | |
|
64
|
CVE-2026-57333 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Link Whisper Free <= 0.9.4 version | |
|
64
|
CVE-2026-57336 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Jobify <= 4.3.2 versions. | |
|
64
|
CVE-2026-57337 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Landing Page Builder <= 1.5.3.5 ve | |
|
64
|
CVE-2026-57338 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions. | |
|
64
|
CVE-2026-27402 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Kids Life | Children School WordPr | |
|
64
|
CVE-2026-27404 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in LMS <= 9.7 versions. | |
|
64
|
CVE-2026-27408 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-27425 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Automotive Listings <= 18.6 versio | |
|
64
|
CVE-2026-27426 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Automotive Car Dealership Business | |
|
64
|
CVE-2026-27430 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in TheFox <= 3.9.76 versions. | |
|
64
|
CVE-2026-57343 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Real Estate 7 <= 3.5.9 versions. | |
|
64
|
CVE-2026-57344 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.4.2 versio | |
|
57
|
CVE-2026-6304 |
8.3 | 0.0025 | NET NO AUTH | Use after free in Graphite in Google Chrome prior to 147.0.7727.101 allowed a re | |
|
57
|
CVE-2026-6309 |
8.3 | 0.0025 | NET NO AUTH | Use after free in Viz in Google Chrome prior to 147.0.7727.101 allowed a remote | |
|
57
|
CVE-2026-6310 |
8.3 | 0.0025 | NET NO AUTH | Use after free in Dawn in Google Chrome prior to 147.0.7727.101 allowed a remote | |
|
57
|
CVE-2026-14412 |
8.3 | 0.0025 | NET NO AUTH | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 15 | |
|
55
|
CVE-2026-70791 |
7.6 | 0.0025 | NET LOW CX | Vulnerability in the Oracle Transportation Execution product of Oracle E-Busines |