Hunt List
18,654 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-76482 |
10.0 | 0.0023 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
80
|
CVE-2026-53407 |
9.8 | 0.0023 | NET NO AUTH LOW CX NO UI | Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before | |
|
78
|
CVE-2026-76483 |
9.1 | 0.0023 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
77
|
CVE-2026-22312 |
8.6 | 0.0023 | NET NO AUTH LOW CX NO UI | The device has a webserver that exposes a REST API authenticated with a constant | |
|
77
|
CVE-2026-40515 |
8.7 | 0.0023 | NET NO AUTH LOW CX NO UI | OpenHarness before commit bd4df81 contains a permission bypass vulnerability tha | |
|
76
|
CVE-2026-107324 |
8.2 | 0.0023 | NET NO AUTH LOW CX NO UI | An integer overflow in BSON value-length handling in the MongoDB Go Driver can c | |
|
76
|
CVE-2026-103602 |
8.2 | 0.0023 | NET NO AUTH LOW CX NO UI | Improper certificate validation in PkixNameConstraintValidator in Legion of the | |
|
76
|
CVE-2026-93389 |
8.2 | 0.0023 | NET NO AUTH LOW CX NO UI | The LiteSpeed Cache plugin for WordPress is vulnerable to unauthenticated disclo | |
|
75
|
CVE-2023-42346 |
7.5 | 0.0023 | NET NO AUTH LOW CX NO UI | Alkacon OpenCms before 16 allows XXE when the <!DOCTYPE> refers to an external h | |
|
75
|
CVE-2026-14114 |
7.5 | 0.0023 | NET NO AUTH LOW CX NO UI | Inappropriate implementation in WebAppInstalls in Google Chrome on Android prior | |
|
75
|
CVE-2026-124598 |
7.5 | 0.0023 | NET NO AUTH LOW CX NO UI | An API key is hardcoded and retrievable from the GV-Face package. Since Android | |
|
75
|
CVE-2026-35489 |
7.3 | 0.0023 | NET NO AUTH LOW CX NO UI | Tandoor Recipes is an application for managing recipes, planning meals, and buil | |
|
75
|
CVE-2025-56230 |
7.5 | 0.0023 | NET NO AUTH LOW CX NO UI | Tencent Docs Desktop 3.9.20 and earlier suffers from Missing SSL Certificate Val | |
|
75
|
CVE-2026-52699 |
7.5 | 0.0023 | NET NO AUTH LOW CX NO UI | Unauthenticated Insecure Direct Object References (IDOR) in VikRentCar <= 1.4.5 | |
|
75
|
CVE-2026-44567 |
7.3 | 0.0023 | NET NO AUTH LOW CX NO UI | Open WebUI is a self-hosted artificial intelligence platform designed to operate | |
|
74
|
CVE-2026-118645 |
7.0 | 0.0023 | NET NO AUTH LOW CX NO UI | n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a filt | |
|
69
|
CVE-2026-54378 |
9.3 | 0.0023 | NET LOW CX NO UI | VitaFit cloud API before 2026-10-30 contained a broken access control vulnerabil | |
|
69
|
CVE-2026-118312 |
9.6 | 0.0023 | NET NO AUTH LOW CX | Observable discrepancy in Paint in Google Chrome prior to 156.0.8078.73 allowed | |
|
68
|
CVE-2026-87784 |
8.8 | 0.0023 | NET LOW CX NO UI | The Cool Media Filter WordPress plugin through 1.0.1 does not perform any capabi | |
|
68
|
CVE-2026-121866 |
8.8 | 0.0023 | NET LOW CX NO UI | The iLeads SMS Gateway by Exsile WordPress plugin before 2.0.0 does not check ca | |
|
68
|
CVE-2026-123064 |
8.8 | 0.0023 | NET LOW CX NO UI | The WP BASE Booking of Appointments, Services and Events WordPress plugin before | |
|
68
|
CVE-2026-0151 |
8.8 | 0.0023 | NET LOW CX NO UI | In IntfGraphCreate of intfgraph.c, there is a possible out of bounds write due t | |
|
68
|
CVE-2026-0154 |
8.8 | 0.0023 | NET LOW CX NO UI | In Modem, there is a possible way to trigger a modem crash during a SIP REFER re | |
|
68
|
CVE-2026-0160 |
8.8 | 0.0023 | NET LOW CX NO UI | In TextRtpPayloadDecoderNode::DecodeT140 of TextRtpPayloadDecoderNode.cpp, there | |
|
68
|
CVE-2026-0161 |
8.8 | 0.0023 | NET LOW CX NO UI | In numberOfReportBlocks of RtpSession.cpp, there is a possible out of bounds wri | |
|
68
|
CVE-2026-0162 |
8.8 | 0.0023 | NET LOW CX NO UI | In ParsePayloads of AudioSdpParser.cpp, there is a possible memory corruption du | |
|
68
|
CVE-2026-0164 |
8.8 | 0.0023 | NET LOW CX NO UI | In Modem, there is a possible out of bounds write due to a missing bounds check. | |
|
68
|
CVE-2026-57786 |
8.8 | 0.0023 | NET NO AUTH LOW CX | Cross-Site Request Forgery (CSRF) vulnerability in purethemes WorkScout-Core wor | |
|
68
|
CVE-2026-55280 |
8.8 | 0.0023 | NET LOW CX NO UI | In multiple locations, there is a possible out-of-bounds write due to uninitiali | |
|
68
|
CVE-2026-91880 |
8.9 | 0.0023 | NET NO AUTH NO UI | Dell Terraform Provider for PowerFlex, versions 1.5.0 through 1.8.0, contains an | |
|
68
|
CVE-2026-119270 |
8.8 | 0.0023 | NET NO AUTH LOW CX | Incorrect reference resolution in CacheStorage in Google Chrome prior to 156.0.8 | |
|
67
|
CVE-2026-5781 |
8.5 | 0.0023 | NET LOW CX NO UI | An authorization vulnerability in MphRx's Minerva V3.6.0, specifically in the '/ | |
|
67
|
CVE-2026-73292 |
8.3 | 0.0023 | NET NO AUTH LOW CX | Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the | |
|
66
|
CVE-2026-43993 |
8.2 | 0.0023 | NET NO AUTH LOW CX | JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-securit | |
|
66
|
CVE-2026-39340 |
8.1 | 0.0023 | NET LOW CX NO UI | ChurchCRM is an open-source church management system. Prior to 7.1.0, a SQL inje | |
|
65
|
CVE-2026-59950 |
7.6 | 0.0023 | NET NO AUTH LOW CX | The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model | |
|
64
|
CVE-2026-69136 |
7.1 | 0.0023 | NET LOW CX NO UI | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (C | |
|
64
|
CVE-2026-41359 |
7.1 | 0.0023 | NET LOW CX NO UI | OpenClaw before 2026.3.28 contains a privilege escalation vulnerability allowing | |
|
64
|
CVE-2026-54383 |
7.1 | 0.0023 | NET LOW CX NO UI | VitaFit cloud API before 2026-10-30 contained an excessive data exposure vulnera | |
|
64
|
CVE-2026-100364 |
7.1 | 0.0023 | NET LOW CX NO UI | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (C | |
|
64
|
CVE-2026-125388 |
7.1 | 0.0023 | NET LOW CX NO UI | Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a missing | |
|
64
|
CVE-2026-45349 |
7.1 | 0.0023 | NET LOW CX NO UI | Open WebUI is a self-hosted artificial intelligence platform designed to operate | |
|
60
|
CVE-2026-42646 |
7.6 | 0.0023 | NET LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
55
|
CVE-2026-123528 |
7.6 | 0.0023 | NET NO UI | Vikunja before 2.7.1 contains an insufficient session expiration vulnerability t | |
|
55
|
CVE-2026-118201 |
7.5 | 0.0023 | NET NO UI | The Limit Login Attempts Security WordPress plugin before 3.4.1 does not enforc | |
|
55
|
CVE-2026-123091 |
7.5 | 0.0023 | NET NO UI | The Vigilant WordPress plugin before 2.11.0 does not enforce its two-factor aut | |
|
55
|
CVE-2026-42501 |
7.5 | 0.0023 | NET NO AUTH | A malicious module proxy can exploit a flaw in the go command's validation of mo | |
|
55
|
CVE-2026-119040 |
7.5 | 0.0023 | NET NO UI | The Defender Security WordPress plugin before 6.4.1 does not limit the number o | |
|
54
|
CVE-2026-116242 |
7.1 | 0.0023 | NET NO UI | pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_ | |
|
54
|
CVE-2026-54302 |
7.0 | 0.0023 | NET LOW CX | n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, a |