Hunt List
18,635 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-121157 |
9.8 | 0.0023 | NET NO AUTH LOW CX NO UI | Incorrect authorization in Chromoting in Google Chrome prior to 157.0.8103.38 al | |
|
78
|
CVE-2026-42514 |
8.8 | 0.0023 | NET NO AUTH LOW CX NO UI | This vulnerability exists in e-Sushrut due to exposure of OTPs in plaintext with | |
|
78
|
CVE-2026-49454 |
9.1 | 0.0023 | NET NO AUTH LOW CX NO UI | Relyra is a strict-by-default SAML 2.0 Service Provider library for Elixir and P | |
|
77
|
CVE-2026-47074 |
8.7 | 0.0023 | NET NO AUTH LOW CX NO UI | Improper Certificate Validation vulnerability in ex-aws ex_aws_sns (ExAws.SNS, E | |
|
76
|
CVE-2026-2379 |
8.2 | 0.0023 | NET NO AUTH LOW CX NO UI | On affected platforms with hardware IPSec support running Arista EOS with certai | |
|
75
|
CVE-2026-12576 |
7.5 | 0.0023 | NET NO AUTH LOW CX NO UI | DVP80ES3 with Improper Enforcement of Message Integrity During Transmission in a | |
|
75
|
CVE-2026-8788 |
7.3 | 0.0023 | NET NO AUTH LOW CX NO UI | Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections. T | |
|
75
|
CVE-2026-9658 |
7.3 | 0.0023 | NET NO AUTH LOW CX NO UI | Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not bloc | |
|
69
|
CVE-2026-14398 |
9.6 | 0.0023 | NET NO AUTH LOW CX | Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote | |
|
69
|
CVE-2026-14419 |
9.6 | 0.0023 | NET NO AUTH LOW CX | Use after free in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote | |
|
69
|
CVE-2026-118337 |
9.3 | 0.0023 | NET NO AUTH LOW CX | Use after free in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote | |
|
69
|
CVE-2026-14425 |
9.6 | 0.0023 | NET NO AUTH LOW CX | Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote | |
|
68
|
CVE-2026-6769 |
8.8 | 0.0023 | NET NO AUTH LOW CX | Privilege escalation in the Debugger component. This vulnerability was fixed in | |
|
68
|
CVE-2026-1185 |
8.8 | 0.0023 | NET LOW CX NO UI | A configuration file on the local file system had improper input validation whic | |
|
67
|
CVE-2026-91873 |
8.7 | 0.0023 | NET NO AUTH NO UI | Dell OpenManage Ansible Modules, versions 2.1.2 through 10.0.3, contains an Impr | |
|
67
|
CVE-2026-122307 |
8.3 | 0.0023 | NET LOW CX NO UI | Kyverno before 1.19.2 contains a policy bypass vulnerability in the admissionpol | |
|
67
|
CVE-2026-116870 |
8.7 | 0.0023 | NET LOW CX NO UI | In affected versions of Octopus Server, OIDC token issuer validation was perform | |
|
67
|
CVE-2026-31943 |
8.5 | 0.0023 | NET LOW CX NO UI | LibreChat is a ChatGPT clone with additional features. Prior to version 0.8.3, ` | |
|
67
|
CVE-2026-82977 |
8.4 | 0.0023 | NET LOW CX NO UI | The Plesk GoAccess statistics integration in Plesk Obsidian for Linux, versions | |
|
67
|
CVE-2026-116766 |
8.3 | 0.0023 | NET LOW CX NO UI | CVE-2026-116766 is an improper input handling vulnerability in the Secure Access | |
|
66
|
CVE-2026-94257 |
8.1 | 0.0023 | NET NO AUTH NO UI | The SMS Alert WordPress plugin before 4.0.3 does not bind the account whose pass | |
|
66
|
CVE-2026-106015 |
8.1 | 0.0023 | NET NO AUTH NO UI | The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-tim | |
|
66
|
CVE-2026-76792 |
8.1 | 0.0023 | NET NO AUTH NO UI | The User Verification by PickPlugins WordPress plugin before 2.0.49 does not rat | |
|
65
|
CVE-2026-41688 |
7.7 | 0.0023 | NET LOW CX NO UI | Wallos is an open-source, self-hostable personal subscription tracker. In versio | |
|
65
|
CVE-2026-117341 |
7.7 | 0.0023 | NET LOW CX NO UI | In affected versions of Octopus Server, creating a user invitation writes the in | |
|
65
|
CVE-2026-121197 |
7.4 | 0.0023 | NET NO AUTH LOW CX | Out of bounds read in ANGLE in Google Chrome on on Mac prior to 157.0.8103.38 al | |
|
65
|
CVE-2026-47832 |
7.3 | 0.0023 | NET LOW CX NO UI | The vulnerability lies in the way application credentials are handled within the | |
|
64
|
CVE-2026-105077 |
7.1 | 0.0023 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.19 versions. | |
|
64
|
CVE-2026-28160 |
7.1 | 0.0023 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-39786 |
7.1 | 0.0023 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versi | |
|
64
|
CVE-2026-48201 |
7.1 | 0.0023 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 vers | |
|
64
|
CVE-2026-54855 |
7.1 | 0.0023 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions. | |
|
64
|
CVE-2026-109884 |
7.1 | 0.0023 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-121765 |
7.1 | 0.0023 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-121863 |
7.1 | 0.0023 | NET NO AUTH LOW CX | The Knowledge Building WordPress plugin before 0.7.3 does not escape several use | |
|
64
|
CVE-2026-32991 |
7.1 | 0.0023 | NET LOW CX NO UI | Improper authorization checks of team members privileges allow a team member to | |
|
64
|
CVE-2026-17811 |
7.1 | 0.0023 | NET NO AUTH LOW CX | Use after free in ANGLE in Google Chrome on Windows prior to 151.0.7922.72 allow | |
|
64
|
CVE-2026-124479 |
7.1 | 0.0023 | NET LOW CX NO UI | OpenEMR before 8.4.0 contains an arbitrary local file read vulnerability in REST | |
|
64
|
CVE-2026-101583 |
7.0 | 0.0023 | NET NO AUTH NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: hel | |
|
64
|
CVE-2026-3259 |
7.1 | 0.0023 | NET LOW CX NO UI | A Generation of Error Message Containing Sensitive Information vulnerability in | |
|
64
|
CVE-2026-42515 |
7.1 | 0.0023 | NET LOW CX NO UI | This vulnerability exists in e-Sushrut due to improper access control in resourc | |
|
60
|
CVE-2026-33923 |
7.5 | 0.0023 | NET LOW CX NO UI | A signature verification vulnerability was discovered in the update installation | |
|
60
|
CVE-2026-45213 |
7.6 | 0.0023 | NET LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
59
|
CVE-2026-128049 |
9.4 | 0.0023 | NET LOW CX | OpenMage Magento LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contain | |
|
56
|
CVE-2026-120408 |
8.0 | 0.0023 | NET LOW CX | The All-in-One Video Gallery WordPress plugin before 5.1.0 does not escape a vi | |
|
55
|
CVE-2026-55583 |
7.6 | 0.0023 | NET LOW CX | Twenty is an open-source CRM (customer relationship management) platform. Prior | |
|
55
|
CVE-2026-12455 |
7.5 | 0.0023 | NET NO AUTH | Use after free in Tab Strip in Google Chrome prior to 149.0.7827.155 allowed a r | |
|
55
|
CVE-2026-123092 |
7.5 | 0.0023 | NET NO UI | The WP Remote Users Sync WordPress plugin before 2.3.0 does not restrict which u | |
|
55
|
CVE-2026-41020 |
7.5 | 0.0023 | NET NO AUTH | Eaton easyE4 uses a static nonce during authentication, which could allow an una | |
|
50
|
CVE-2026-120807 |
7.5 | 0.0023 | NET NO UI | A flaw in MongoDB’s X.509 cluster-membership authentication guard could allow a |