Hunt List
8,523 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-41507 |
9.8 | 0.0039 | NET NO AUTH LOW CX NO UI | math-codegen generates code from mathematical expressions. Prior to version 0.4. | |
|
80
|
CVE-2026-10543 |
9.8 | 0.0039 | NET NO AUTH LOW CX NO UI | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privil | |
|
80
|
CVE-2025-52910 |
9.8 | 0.0039 | NET NO AUTH LOW CX NO UI | An issue was discovered in the GPU in Samsung Mobile Processor and Wearable Proc | |
|
78
|
CVE-2026-89270 |
9.1 | 0.0039 | NET NO AUTH LOW CX NO UI | The Popup Builder – Create highly converting, mobile friendly marketing popups. | |
|
78
|
CVE-2026-13380 |
9.0 | 0.0039 | NET NO AUTH LOW CX NO UI | VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials | |
|
77
|
CVE-2026-9220 |
8.7 | 0.0039 | NET NO AUTH LOW CX NO UI | Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior e | |
|
77
|
CVE-2026-48801 |
8.7 | 0.0039 | NET NO AUTH LOW CX NO UI | linkify-it is a links recognition library with full Unicode support. Prior to 5. | |
|
77
|
CVE-2026-40430 |
8.7 | 0.0039 | NET NO AUTH LOW CX NO UI | Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a pas | |
|
77
|
CVE-2026-40967 |
8.6 | 0.0039 | NET NO AUTH LOW CX NO UI | In Spring AI, various FilterExpressionConverter implementations accept a filter | |
|
77
|
CVE-2026-64814 |
8.6 | 0.0039 | NET NO AUTH LOW CX NO UI | In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible i | |
|
77
|
CVE-2026-14869 |
8.6 | 0.0039 | NET NO AUTH LOW CX NO UI | The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side req | |
|
77
|
CVE-2026-16328 |
8.6 | 0.0039 | NET NO AUTH LOW CX NO UI | In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul | |
|
77
|
CVE-2026-59505 |
8.6 | 0.0039 | NET NO AUTH LOW CX NO UI | : Improper Access Control vulnerability in Priority Portal Generator addon to Pr | |
|
77
|
CVE-2026-115924 |
8.6 | 0.0039 | NET NO AUTH LOW CX NO UI | Rembg is a tool to remove images background. Prior to 2.0.82, the public /api/re | |
|
77
|
CVE-2026-116191 |
8.7 | 0.0039 | NET NO AUTH LOW CX NO UI | Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav tha | |
|
76
|
CVE-2026-109257 |
8.2 | 0.0039 | NET NO AUTH LOW CX NO UI | FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initia | |
|
75
|
CVE-2026-34059 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Buffer Over-read vulnerability in Apache HTTP Server. This issue affects Apache | |
|
75
|
CVE-2026-43646 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apac | |
|
75
|
CVE-2026-54837 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Intranet & Private Site – All | |
|
75
|
CVE-2026-54839 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in Trinity Backup – Backup, Migrat | |
|
75
|
CVE-2026-54846 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Syncee Premium Dropshipping & Whole | |
|
75
|
CVE-2026-54847 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Stylish Cost Calculator <= 8.3.9 versio | |
|
75
|
CVE-2026-57727 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Missing Authorization vulnerability in Themeum Kirki kirki allows Exploiting Inc | |
|
75
|
CVE-2026-57729 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Missing Authorization vulnerability in UX-themes Flatsome flatsome allows Exploi | |
|
75
|
CVE-2026-32807 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | dataCycle is a data management system for centrally storing, managing, searching | |
|
75
|
CVE-2026-32806 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | dataCycle is a data management system for centrally storing, managing, searching | |
|
75
|
CVE-2026-63047 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect AC | |
|
75
|
CVE-2026-61943 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in WPDM – Premium Packages <= 6.2.0 versio | |
|
75
|
CVE-2026-65500 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base | |
|
75
|
CVE-2026-59529 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in Ebook Store <= 6.19 versions. | |
|
75
|
CVE-2026-65943 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI < 9. | |
|
75
|
CVE-2026-71234 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Documize Community's attachment download route (domain/attachment/endpoint.go, D | |
|
75
|
CVE-2026-65551 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incor | |
|
75
|
CVE-2026-65504 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versi | |
|
75
|
CVE-2026-65523 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Sig | |
|
75
|
CVE-2026-61984 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in WPMobile.App <= 11.77 versions. | |
|
75
|
CVE-2026-66441 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in MultiVendorX <= 5.0.10 versions. | |
|
75
|
CVE-2026-28567 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions. | |
|
75
|
CVE-2026-28571 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in FormyChat <= 2.15.7 versions. | |
|
75
|
CVE-2026-32472 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions | |
|
75
|
CVE-2026-32549 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in ThumbPress < 6.5 versions. | |
|
75
|
CVE-2026-33610 |
7.5 | 0.0039 | NET NO AUTH LOW CX NO UI | A rogue primary server may cause file descriptor exhaustion and eventually a den | |
|
69
|
CVE-2026-17681 |
9.6 | 0.0039 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Web Authentication in Google Chrom | |
|
69
|
CVE-2026-19166 |
9.6 | 0.0039 | NET NO AUTH LOW CX | Use after free in Web Authentication in Google Chrome prior to 151.0.7922.109 al | |
|
68
|
CVE-2026-94267 |
9.0 | 0.0039 | NET NO AUTH NO UI | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced C | |
|
68
|
CVE-2026-53793 |
9.1 | 0.0039 | NET NO AUTH NO UI | rsync before 3.5.0 contains a path confinement bypass vulnerability that allows | |
|
66
|
CVE-2026-48970 |
8.1 | 0.0039 | NET NO AUTH NO UI | Unauthenticated Broken Authentication in Really Simple SSL <= 9.5.10 versions. | |
|
66
|
CVE-2026-13779 |
8.1 | 0.0039 | NET NO AUTH NO UI | Use after free in Chromoting in Google Chrome on ChromeOS prior to 150.0.7871.47 | |
|
65
|
CVE-2026-119027 |
7.7 | 0.0039 | NET NO AUTH LOW CX | oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that all | |
|
57
|
CVE-2026-57272 |
8.3 | 0.0039 | NET NO AUTH | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe |