Hunt List
8,525 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-8363 |
9.8 | 0.0040 | NET NO AUTH LOW CX NO UI | A stack-based buffer overflow condition exists in WOSDeviceDropFolder.dll when p | |
|
79
|
CVE-2026-111732 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses | |
|
78
|
CVE-2026-15089 |
9.1 | 0.0040 | NET NO AUTH LOW CX NO UI | Vulnerability in Drupal Commerce guest registration. This issue affects Commerce | |
|
78
|
CVE-2026-62414 |
9.1 | 0.0040 | NET NO AUTH LOW CX NO UI | Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3. | |
|
78
|
CVE-2026-14804 |
9.1 | 0.0040 | NET NO AUTH LOW CX NO UI | Use of hard-coded cryptographic key vulnerability in Bilin Software and Informat | |
|
78
|
CVE-2026-65766 |
9.2 | 0.0040 | NET NO AUTH LOW CX NO UI | Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Bu | |
|
78
|
CVE-2026-108142 |
9.1 | 0.0040 | NET NO AUTH LOW CX NO UI | A vulnerability allowing an unauthenticated attacker to bypass authorization on | |
|
78
|
CVE-2026-61426 |
8.8 | 0.0040 | NET NO AUTH LOW CX NO UI | PraisonAI before 1.7.3 contains an insecure default configuration that binds to | |
|
77
|
CVE-2025-34179 |
8.7 | 0.0040 | NET NO AUTH LOW CX NO UI | NetSupport Manager < 14.12.0001 contains an unauthenticated SQL injection vulner | |
|
77
|
CVE-2026-114088 |
8.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in th | |
|
77
|
CVE-2026-112775 |
8.7 | 0.0040 | NET NO AUTH LOW CX NO UI | Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerabili | |
|
77
|
CVE-2026-111731 |
8.7 | 0.0040 | NET NO AUTH LOW CX NO UI | P-Net before 1.0.3 enters an infinite loop when handling a read request for the | |
|
77
|
CVE-2026-57831 |
8.7 | 0.0040 | NET NO AUTH LOW CX NO UI | Joomla Extension - digital-peak.com - Unauthenticated blind SQL injection in DP | |
|
77
|
CVE-2026-57832 |
8.7 | 0.0040 | NET NO AUTH LOW CX NO UI | Joomla Extension - joomdonation.com - Unauthenticated blind SQL injection in EDo | |
|
76
|
CVE-2026-73937 |
8.2 | 0.0040 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
76
|
CVE-2026-87394 |
8.2 | 0.0040 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl | |
|
76
|
CVE-2026-24031 |
8.2 | 0.0040 | NET NO AUTH LOW CX NO UI | Dovecot SQL based authentication can be bypassed when auth_username_chars is cle | |
|
75
|
CVE-2026-23826 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | A vulnerability in a network management service of AOS-8 Operating System could | |
|
75
|
CVE-2026-62663 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | Banks generates meaningful LLM prompts using a simple template language. In vers | |
|
75
|
CVE-2026-5089 |
7.3 | 0.0040 | NET NO AUTH LOW CX NO UI | YAML::Syck versions before 1.38 for Perl has an out-of-bounds read. The base60 | |
|
75
|
CVE-2025-63561 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | Summer Pearl Group Vacation Rental Management Platform prior to 1.0.2 is suscept | |
|
75
|
CVE-2026-33662 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-s | |
|
75
|
CVE-2026-48615 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | A flaw in Node.js proxy tunnel error handling could expose proxy credentials in | |
|
69
|
CVE-2026-43899 |
9.6 | 0.0040 | NET NO AUTH LOW CX | DeepChat is an open-source artificial intelligence agent platform that unifies m | |
|
68
|
CVE-2026-13072 |
9.2 | 0.0040 | NET NO AUTH NO UI | When compute mode is enabled on a standalone mongod instance, insufficient valid | |
|
68
|
CVE-2026-119568 |
9.1 | 0.0040 | NET NO AUTH NO UI | vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data | |
|
68
|
CVE-2026-113083 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Memory corruption in Actor in Google Chrome on on Android prior to 156.0.8078.47 | |
|
68
|
CVE-2026-113175 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Improper input validation in FileSystem in Google Chrome prior to 156.0.8078.47 | |
|
68
|
CVE-2026-113176 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Memory corruption in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a r | |
|
68
|
CVE-2026-113177 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Use after free in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a r | |
|
68
|
CVE-2026-113200 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Use after free in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote | |
|
68
|
CVE-2026-113203 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Use after free in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote a | |
|
68
|
CVE-2026-113205 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Use after free in Variations in Google Chrome prior to 156.0.8078.47 allowed a r | |
|
68
|
CVE-2026-113208 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Use after free in ContextualSearch in Google Chrome prior to 156.0.8078.47 allow | |
|
68
|
CVE-2026-113216 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Use after free in Navigation in Google Chrome prior to 156.0.8078.47 allowed a r | |
|
68
|
CVE-2026-113218 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Use after free in DataTransfer in Google Chrome prior to 156.0.8078.47 allowed a | |
|
68
|
CVE-2026-113219 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Memory corruption in Contacts in Google Chrome prior to 156.0.8078.47 allowed a | |
|
68
|
CVE-2026-113251 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Use after free in PDF in Google Chrome prior to 156.0.8078.47 allowed a remote a | |
|
68
|
CVE-2026-16366 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Privilege escalation in the DOM: Navigation component. This vulnerability was fi | |
|
68
|
CVE-2026-16401 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Privilege escalation in the Data Loss Prevention component. This vulnerability w | |
|
68
|
CVE-2026-113266 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Memory corruption in ANGLE in Google Chrome on on Android prior to 156.0.8078.47 | |
|
68
|
CVE-2026-118328 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Improper input validation in WebRTC in Google Chrome prior to 156.0.8078.73 allo | |
|
67
|
CVE-2026-58078 |
8.7 | 0.0040 | NET NO AUTH LOW CX | Joomla Extension - themexpert.com - Unauthenticated SQL injection in Quix Page B | |
|
66
|
CVE-2026-116238 |
8.1 | 0.0040 | NET NO AUTH NO UI | In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS fail | |
|
66
|
CVE-2026-90867 |
8.1 | 0.0040 | NET NO AUTH NO UI | Improper access control in the Web Admin console of Progress Software WS_FTP Ser | |
|
64
|
CVE-2026-114043 |
7.1 | 0.0040 | NET NO AUTH LOW CX | FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipbo | |
|
64
|
CVE-2026-50163 |
7.1 | 0.0040 | NET NO AUTH LOW CX | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPa | |
|
58
|
CVE-2026-19002 |
8.8 | 0.0040 | NET NO AUTH | A missing bounds check when parsing stored procedure parameter metadata in the M | |
|
57
|
CVE-2026-57273 |
8.3 | 0.0040 | NET NO AUTH | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe | |
|
57
|
CVE-2026-57274 |
8.3 | 0.0040 | NET NO AUTH | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe |