Hunt List
8,525 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-49764 |
9.8 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.8.6 versions. | |
|
80
|
CVE-2026-18450 |
9.8 | 0.0040 | NET NO AUTH LOW CX NO UI | The BMC does not correctly enforce integrity and encryption requirements for IPM | |
|
79
|
CVE-2026-54843 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in MDTF <= 1.3.7 versions. | |
|
79
|
CVE-2026-54849 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce <= 1.1.11 ve | |
|
79
|
CVE-2026-54820 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions. | |
|
79
|
CVE-2026-54827 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in Real Estate 7 <= 3.5.9 versions. | |
|
79
|
CVE-2026-54831 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in GeoDirectory <= 2.8.162 versions. | |
|
79
|
CVE-2026-56034 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in Library Management System <= 3.5.7 versions. | |
|
79
|
CVE-2026-56036 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in 워드프레스 결제 심플페이 <= 5.5.6 versions. | |
|
79
|
CVE-2026-56068 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in JetEngine <= 3.8.10.2 versions. | |
|
79
|
CVE-2026-57679 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in GeekyBot <= 1.2.5 versions. | |
|
79
|
CVE-2026-57683 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in WP Fast Total Search <= 1.80.280 versions. | |
|
79
|
CVE-2026-57707 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
79
|
CVE-2026-57726 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
79
|
CVE-2026-57739 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
79
|
CVE-2026-59515 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
79
|
CVE-2026-59514 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in Buddyboss Platform <= 3.0.5 versions. | |
|
79
|
CVE-2026-59525 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in Participants Database <= 2.7.8.3 versions. | |
|
79
|
CVE-2026-59526 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions. | |
|
79
|
CVE-2026-61948 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions. | |
|
79
|
CVE-2026-61950 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in TrueBooker <= 1.2.3 versions. | |
|
79
|
CVE-2026-59527 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions. | |
|
79
|
CVE-2026-59533 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in Relevanssi Light <= 1.2.2 versions. | |
|
79
|
CVE-2026-59538 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in GamiPress <= 7.9.7 versions. | |
|
79
|
CVE-2026-59549 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress < | |
|
79
|
CVE-2026-59550 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in AWP Classifieds <= 4.4.7 versions. | |
|
79
|
CVE-2026-65508 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versi | |
|
79
|
CVE-2026-65520 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions. | |
|
79
|
CVE-2026-65546 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions. | |
|
79
|
CVE-2026-66447 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions. | |
|
79
|
CVE-2026-66659 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
79
|
CVE-2026-28001 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions. | |
|
79
|
CVE-2026-28142 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions. | |
|
79
|
CVE-2026-61966 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Subscriber SQL Injection in WPJAM Basic <= 7.0.1 versions. | |
|
79
|
CVE-2026-61969 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in Listdom <= 5.6.0 versions. | |
|
79
|
CVE-2026-66436 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in Active Products Tables for WooCommerce <= 1.1.1 | |
|
79
|
CVE-2026-66472 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in Everest Backup <= 2.3.12 versions. | |
|
79
|
CVE-2026-66478 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions. | |
|
79
|
CVE-2026-73187 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in Sticky Chat Widget <= 1.4.2 versions. | |
|
79
|
CVE-2026-73339 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in Modern Events Calendar < 7.35.0 versions. | |
|
79
|
CVE-2026-73355 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in Affiliates Manager <= 2.9.53 versions. | |
|
79
|
CVE-2026-73365 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in JetAppointment <= 2.5.2 versions. | |
|
79
|
CVE-2026-74015 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in Readabler < 2.0.18 versions. | |
|
75
|
CVE-2026-41882 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | In JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3. | |
|
74
|
CVE-2026-107743 |
7.2 | 0.0040 | NET NO AUTH LOW CX NO UI | The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scri | |
|
65
|
CVE-2026-46608 |
7.4 | 0.0040 | NET NO AUTH LOW CX | Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, | |
|
57
|
CVE-2026-57275 |
8.3 | 0.0040 | NET NO AUTH | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe | |
|
57
|
CVE-2026-57276 |
8.3 | 0.0040 | NET NO AUTH | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe | |
|
57
|
CVE-2026-57277 |
8.3 | 0.0040 | NET NO AUTH | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe | |
|
57
|
CVE-2026-57278 |
8.3 | 0.0040 | NET NO AUTH | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe |