Hunt List
8,520 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-48114 |
9.8 | 0.0037 | NET NO AUTH LOW CX NO UI | Metacat is data repository software that helps researchers preserve, share, and | |
|
80
|
CVE-2026-64025 |
9.8 | 0.0037 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: | |
|
80
|
CVE-2026-92885 |
9.8 | 0.0037 | NET NO AUTH LOW CX NO UI | The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass | |
|
80
|
CVE-2026-40493 |
9.8 | 0.0037 | NET NO AUTH LOW CX NO UI | SAIL is a cross-platform library for loading and saving images with support for | |
|
80
|
CVE-2026-4101 |
9.8 | 0.0037 | NET NO AUTH LOW CX NO UI | IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify | |
|
79
|
CVE-2026-61730 |
9.3 | 0.0037 | NET NO AUTH LOW CX NO UI | SOCFortress CoPilot focuses on providing a single pane of glass for all your sec | |
|
79
|
CVE-2026-41571 |
9.4 | 0.0037 | NET NO AUTH LOW CX NO UI | Note Mark is an open-source note-taking application. In version 0.19.2, IsPasswo | |
|
79
|
CVE-2026-5963 |
9.3 | 0.0037 | NET NO AUTH LOW CX NO UI | EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing u | |
|
79
|
CVE-2026-5964 |
9.3 | 0.0037 | NET NO AUTH LOW CX NO UI | EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing u | |
|
79
|
CVE-2026-42155 |
9.3 | 0.0037 | NET NO AUTH LOW CX NO UI | Magento Long Term Support (LTS) is an unofficial, community-driven project provi | |
|
78
|
CVE-2026-72789 |
9.2 | 0.0037 | NET NO AUTH LOW CX NO UI | SiYuan before v3.7.4 fails to properly validate publish access for encrypted not | |
|
78
|
CVE-2026-118375 |
9.2 | 0.0037 | NET NO AUTH LOW CX NO UI | llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in t | |
|
78
|
CVE-2026-59807 |
8.9 | 0.0037 | NET NO AUTH LOW CX NO UI | Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerabil | |
|
78
|
CVE-2026-42889 |
9.1 | 0.0037 | NET NO AUTH LOW CX NO UI | Relay adds real-time collaboration to Obsidian. Relay Server versions 0.9.0 thro | |
|
78
|
CVE-2026-107034 |
9.1 | 0.0037 | NET NO AUTH LOW CX NO UI | Insecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) allows unauth | |
|
77
|
CVE-2026-3868 |
8.7 | 0.0037 | NET NO AUTH LOW CX NO UI | An improper handling of the length parameter inconsistency vulnerability has bee | |
|
77
|
CVE-2026-32678 |
8.7 | 0.0037 | NET NO AUTH LOW CX NO UI | Authentication bypass issue exists in BUFFALO Wi-Fi router products, which may a | |
|
77
|
CVE-2026-116871 |
8.7 | 0.0037 | NET NO AUTH LOW CX NO UI | Semantic MediaWiki 3.0.0 before 7.3.1 contains an uncontrolled recursion vulnera | |
|
76
|
CVE-2026-42274 |
7.8 | 0.0037 | NET NO AUTH LOW CX NO UI | Heimdall is a cloud native Identity Aware Proxy and Access Control Decision serv | |
|
76
|
CVE-2026-79886 |
8.2 | 0.0037 | NET NO AUTH LOW CX NO UI | An unauthenticated buffer overflow vulnerability exists in the PAPI protocol of | |
|
76
|
CVE-2026-62162 |
8.2 | 0.0037 | NET NO AUTH LOW CX NO UI | Hydra is a layer-two scalability solution for Cardano. Prior to 2.1.0, the `Clai | |
|
75
|
CVE-2026-54802 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Authentication in SMS Alert Order Notifications <= 3.9.3 | |
|
75
|
CVE-2026-43253 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: iommu/amd: | |
|
75
|
CVE-2025-10528 |
7.3 | 0.0037 | NET NO AUTH LOW CX NO UI | Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canva | |
|
75
|
CVE-2026-13089 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verificatio | |
|
75
|
CVE-2026-118803 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injec | |
|
75
|
CVE-2026-40586 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, the logi | |
|
75
|
CVE-2026-8651 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Limited authentication bypass by spoofing vulnerability in Progress MOVEit Trans | |
|
75
|
CVE-2026-51105 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Buffer Overflow vulnerability in aMULE-Project aMule v.2.3.3 allows a remote att | |
|
75
|
CVE-2026-59532 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Unauthenticated Other Vulnerability Type in Booking and Rental Manager <= 2.7.2 | |
|
75
|
CVE-2026-116587 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Go JOSE provides an implementation of the Javascript Object Signing and Encrypti | |
|
69
|
CVE-2026-118305 |
9.6 | 0.0037 | NET NO AUTH LOW CX | Memory corruption in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a | |
|
69
|
CVE-2026-118306 |
9.6 | 0.0037 | NET NO AUTH LOW CX | Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.73 allowed | |
|
69
|
CVE-2026-17847 |
9.6 | 0.0037 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 15 | |
|
68
|
CVE-2026-6303 |
8.8 | 0.0037 | NET NO AUTH LOW CX | Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remo | |
|
68
|
CVE-2026-113046 |
8.8 | 0.0037 | NET NO AUTH LOW CX | Improper input validation in Passwords in Google Chrome prior to 156.0.8078.47 a | |
|
68
|
CVE-2026-113048 |
8.8 | 0.0037 | NET NO AUTH LOW CX | Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a | |
|
68
|
CVE-2026-113086 |
8.8 | 0.0037 | NET NO AUTH LOW CX | Improper input validation in Input in Google Chrome prior to 156.0.8078.47 allow | |
|
68
|
CVE-2026-113112 |
8.8 | 0.0037 | NET NO AUTH LOW CX | Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a r | |
|
68
|
CVE-2026-113221 |
8.8 | 0.0037 | NET NO AUTH LOW CX | Use after free in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a | |
|
68
|
CVE-2026-113170 |
8.8 | 0.0037 | NET NO AUTH LOW CX | Use after free in Autofill in Google Chrome on on Android prior to 156.0.8078.47 | |
|
68
|
CVE-2026-17950 |
8.8 | 0.0037 | NET NO AUTH LOW CX | Inappropriate implementation in Safebrowsing in Google Chrome on Mac prior to 15 | |
|
67
|
CVE-2026-43907 |
8.3 | 0.0037 | NET NO AUTH LOW CX | OpenImageIO is a toolset for reading, writing, and manipulating image files of a | |
|
65
|
CVE-2026-55113 |
7.5 | 0.0037 | NET NO AUTH NO UI | A malicious actor with access to the network could exploit a Server-Side Request | |
|
65
|
CVE-2026-112304 |
7.7 | 0.0037 | NET NO AUTH LOW CX | docTR through 1.1.0 contains an unsafe deserialization vulnerability in load_pre | |
|
64
|
CVE-2026-97023 |
7.1 | 0.0037 | NET NO AUTH LOW CX | A path traversal vulnerability in Flatpak's handling of the export/bin directory | |
|
64
|
CVE-2026-69087 |
7.1 | 0.0037 | NET NO AUTH LOW CX | The Grav form plugin (getgrav/grav-plugin-form) before 9.1.13 contains an open r | |
|
57
|
CVE-2026-76046 |
8.3 | 0.0037 | NET NO AUTH | Buffer overflow in ANGLE in Google Chrome on on Android prior to 151.0.7922.169 | |
|
55
|
CVE-2026-45804 |
7.5 | 0.0037 | NET NO AUTH | Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, Dif | |
|
54
|
CVE-2026-100413 |
7.0 | 0.0037 | NET NO AUTH | SeaweedFS is a distributed storage system for files and blobs. From 4.0.388 unti |