Hunt List
8,520 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-47137 |
10.0 | 0.0038 | NET NO AUTH LOW CX NO UI | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the fix f | |
|
80
|
CVE-2026-0163 |
9.8 | 0.0038 | NET NO AUTH LOW CX NO UI | In multiple functions of vpu_ioctl.c, there is a possible use after free due to | |
|
80
|
CVE-2026-76886 |
9.8 | 0.0038 | NET NO AUTH LOW CX NO UI | C12.22 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows den | |
|
80
|
CVE-2026-76301 |
9.8 | 0.0038 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
80
|
CVE-2025-51511 |
9.8 | 0.0038 | NET NO AUTH LOW CX NO UI | Cadmium CMS v.0.4.9 has a background arbitrary file upload vulnerability in /adm | |
|
80
|
CVE-2026-13446 |
9.8 | 0.0038 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a | |
|
80
|
CVE-2026-10094 |
9.8 | 0.0038 | NET NO AUTH LOW CX NO UI | A Path Traversal vulnerability affecting SOLIDWORKS Visualize from SOLIDWORKS De | |
|
80
|
CVE-2026-8364 |
9.8 | 0.0038 | NET NO AUTH LOW CX NO UI | Gladinet Triofox Cloud Server Agent Access Service (GladServerAgentService.exe) | |
|
78
|
CVE-2026-55202 |
8.8 | 0.0038 | NET NO AUTH LOW CX NO UI | Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate th | |
|
78
|
CVE-2026-54466 |
9.2 | 0.0038 | NET NO AUTH LOW CX NO UI | websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0. | |
|
78
|
CVE-2026-114493 |
9.2 | 0.0038 | NET NO AUTH LOW CX NO UI | LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerabil | |
|
78
|
CVE-2026-40010 |
9.1 | 0.0038 | NET NO AUTH LOW CX NO UI | Missing invocation of Servlet http web request method changeSessionId after sess | |
|
77
|
CVE-2026-114109 |
8.7 | 0.0038 | NET NO AUTH LOW CX NO UI | uv before 0.11.15 contains a path traversal vulnerability that allows malicious | |
|
77
|
CVE-2026-65635 |
8.3 | 0.0038 | NET NO AUTH LOW CX NO UI | Improper Isolation or Compartmentalization vulnerability in malach-it boruta (El | |
|
77
|
CVE-2026-62230 |
8.7 | 0.0038 | NET NO AUTH LOW CX NO UI | Grav before 2.0.4 ships a default .htaccess (and reference webserver-configs/hta | |
|
77
|
CVE-2026-61654 |
8.3 | 0.0038 | NET NO AUTH LOW CX NO UI | Lightdash is an open source business intelligence platform. In affected versions | |
|
77
|
CVE-2026-55950 |
8.7 | 0.0038 | NET NO AUTH LOW CX NO UI | Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Erlang/OTP ss | |
|
76
|
CVE-2026-8466 |
8.2 | 0.0038 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in ninenines | |
|
76
|
CVE-2026-57030 |
8.2 | 0.0038 | NET NO AUTH LOW CX NO UI | A Concurrent Execution using Shared Resource with Improper Synchronization ('Rac | |
|
76
|
CVE-2026-60255 |
8.2 | 0.0038 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (compo | |
|
76
|
CVE-2026-60592 |
8.2 | 0.0038 | NET NO AUTH LOW CX NO UI | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: | |
|
76
|
CVE-2026-70993 |
8.2 | 0.0038 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
75
|
CVE-2025-58629 |
7.5 | 0.0038 | NET NO AUTH LOW CX NO UI | Missing Authorization vulnerability in kamleshyadav Miraculous miraculous allows | |
|
75
|
CVE-2026-50151 |
7.5 | 0.0038 | NET NO AUTH LOW CX NO UI | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/rem | |
|
75
|
CVE-2026-44765 |
7.3 | 0.0038 | NET NO AUTH LOW CX NO UI | Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integrat | |
|
75
|
CVE-2026-33593 |
7.5 | 0.0038 | NET NO AUTH LOW CX NO UI | A client can trigger a divide by zero error leading to crash by sending a crafte | |
|
75
|
CVE-2026-13463 |
7.5 | 0.0038 | NET NO AUTH LOW CX NO UI | IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive in | |
|
75
|
CVE-2026-28860 |
7.5 | 0.0038 | NET NO AUTH LOW CX NO UI | The issue was addressed with improved input validation. This issue is fixed in i | |
|
75
|
CVE-2026-104895 |
7.5 | 0.0038 | NET NO AUTH LOW CX NO UI | The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary len | |
|
75
|
CVE-2026-44335 |
7.7 | 0.0038 | NET NO AUTH LOW CX NO UI | PraisonAI is a multi-agent teams system. Prior to version 1.6.32, the URL checki | |
|
75
|
CVE-2026-58419 |
7.5 | 0.0038 | NET NO AUTH LOW CX NO UI | Notification API leaks private issue metadata after access revocation | |
|
75
|
CVE-2026-43870 |
7.3 | 0.0038 | NET NO AUTH LOW CX NO UI | Origin Validation Error, Improper Limitation of a Pathname to a Restricted Direc | |
|
74
|
CVE-2026-109234 |
7.2 | 0.0038 | NET NO AUTH LOW CX NO UI | The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Script | |
|
74
|
CVE-2026-116520 |
7.2 | 0.0038 | NET NO AUTH LOW CX NO UI | The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored C | |
|
74
|
CVE-2026-42789 |
7.0 | 0.0038 | NET NO AUTH LOW CX NO UI | Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP | |
|
69
|
CVE-2026-54458 |
9.6 | 0.0038 | NET NO AUTH LOW CX | WWBN AVideo is an open source video platform. Versions prior to 29.0 contain a s | |
|
69
|
CVE-2026-45035 |
9.4 | 0.0038 | NET NO AUTH LOW CX | Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1 | |
|
69
|
CVE-2026-13859 |
9.6 | 0.0038 | NET NO AUTH LOW CX | Inappropriate implementation in ANGLE in Google Chrome prior to 150.0.7871.47 al | |
|
69
|
CVE-2026-40157 |
9.4 | 0.0038 | NET NO AUTH LOW CX | PraisonAI is a multi-agent teams system. Prior to 4.5.128, cmd_unpack in the rec | |
|
68
|
CVE-2026-17778 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Use after free in Extensions in Google Chrome prior to 151.0.7922.72 allowed a r | |
|
68
|
CVE-2026-17875 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Use after free in PDFium in Google Chrome prior to 151.0.7922.72 allowed a remot | |
|
68
|
CVE-2026-18012 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Use after free in PDFium in Google Chrome prior to 151.0.7922.72 allowed a remot | |
|
68
|
CVE-2026-13125 |
8.8 | 0.0038 | NET NO AUTH LOW CX | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe | |
|
68
|
CVE-2026-113081 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a | |
|
68
|
CVE-2026-113087 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote | |
|
68
|
CVE-2026-113231 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 | |
|
68
|
CVE-2026-116838 |
8.8 | 0.0038 | NET NO AUTH LOW CX | A malicious actor who lures an authenticated user to a malicious page could expl | |
|
67
|
CVE-2026-63161 |
8.6 | 0.0038 | NET NO AUTH LOW CX | Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability | |
|
66
|
CVE-2026-24899 |
8.2 | 0.0038 | NET NO AUTH NO UI | Fleet is open source device management software. Prior to version 4.82.0, a vuln | |
|
64
|
CVE-2026-113912 |
7.1 | 0.0038 | NET NO AUTH LOW CX | An out-of-bounds access issue was addressed with improved bounds checking. This |