Hunt List
12,269 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
64
|
CVE-2026-57674 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Timetics <= 1.0.58 versions. | |
|
64
|
CVE-2026-57675 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.2.02.004 | |
|
64
|
CVE-2026-57678 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57682 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Simple Link Directory <= 15.0.5 ve | |
|
64
|
CVE-2026-57686 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in WowAddons <= 1.6.14 versions. | |
|
64
|
CVE-2026-57363 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57368 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57369 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57376 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57379 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57380 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57381 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57382 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57383 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57388 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57394 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57396 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57398 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57403 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57409 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57411 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57415 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57416 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57417 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57421 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57422 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57423 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57668 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57695 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57706 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57708 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57712 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57715 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57718 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57725 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57728 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57732 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57733 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57734 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57741 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57745 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57814 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57816 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-59516 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-57370 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statisti | |
|
64
|
CVE-2026-57374 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3 | |
|
64
|
CVE-2026-57397 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Coaching <= 3.9.2 versions. | |
|
64
|
CVE-2026-57427 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Download Monitor - WPForms Lock <= | |
|
64
|
CVE-2026-57428 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Sprout Clients <= 3.2.3 versions. | |
|
64
|
CVE-2026-57699 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Subscriber Cross Site Scripting (XSS) in Slider Pro <= 4.8.13 versions. |