Hunt List
8,520 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2025-61163 |
9.8 | 0.0036 | NET NO AUTH LOW CX NO UI | Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-do | |
|
80
|
CVE-2026-110956 |
9.8 | 0.0036 | NET NO AUTH LOW CX NO UI | The asVereinbase WordPress plugin before 1.1.8 does not require a valid passwor | |
|
80
|
CVE-2026-40772 |
10.0 | 0.0036 | NET NO AUTH LOW CX NO UI | Unauthenticated Arbitrary File Upload in GeekyBot <= 1.2.2 versions. | |
|
80
|
CVE-2025-50229 |
9.8 | 0.0036 | NET NO AUTH LOW CX NO UI | Jizhicms v2.5.4 is vulnerable to SQL injection in the product editing module. | |
|
80
|
CVE-2026-7852 |
9.8 | 0.0036 | NET NO AUTH LOW CX NO UI | Unrestricted upload of file with dangerous type vulnerability in Limatek System | |
|
80
|
CVE-2026-41157 |
9.8 | 0.0036 | NET NO AUTH LOW CX NO UI | A web page that contains unusual WebGPU content loaded into the GPU GLES render | |
|
79
|
CVE-2025-48089 |
9.3 | 0.0036 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
79
|
CVE-2026-6887 |
9.3 | 0.0036 | NET NO AUTH LOW CX NO UI | Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has | |
|
78
|
CVE-2026-33896 |
9.1 | 0.0036 | NET NO AUTH LOW CX NO UI | Forge (also called `node-forge`) is a native implementation of Transport Layer S | |
|
78
|
CVE-2026-59107 |
9.2 | 0.0036 | NET NO AUTH LOW CX NO UI | A security vulnerability has been identified in the vSolution Matrix file sharin | |
|
78
|
CVE-2025-52544 |
8.8 | 0.0036 | NET NO AUTH LOW CX NO UI | E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature | |
|
77
|
CVE-2026-13311 |
8.7 | 0.0036 | NET NO AUTH LOW CX NO UI | shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.protot | |
|
77
|
CVE-2026-56339 |
8.7 | 0.0036 | NET NO AUTH LOW CX NO UI | Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerab | |
|
77
|
CVE-2026-111810 |
8.7 | 0.0036 | NET NO AUTH LOW CX NO UI | Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic | |
|
77
|
CVE-2026-103600 |
8.7 | 0.0036 | NET NO AUTH LOW CX NO UI | Uncontrolled recursion in the ASN.1 parser (Asn1InputStream, Asn1StreamParser) i | |
|
77
|
CVE-2026-63163 |
8.7 | 0.0036 | NET NO AUTH LOW CX NO UI | Omnispace Agora Project before 26.10.0 contains a broken access control vulnerab | |
|
77
|
CVE-2026-119119 |
8.7 | 0.0036 | NET NO AUTH LOW CX NO UI | Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker A | |
|
77
|
CVE-2026-22742 |
8.6 | 0.0036 | NET NO AUTH LOW CX NO UI | Spring AI's spring-ai-bedrock-converse contains a Server-Side Request Forgery (S | |
|
77
|
CVE-2026-47139 |
8.6 | 0.0036 | NET NO AUTH LOW CX NO UI | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM su | |
|
76
|
CVE-2026-10564 |
8.2 | 0.0036 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery (SSR | |
|
76
|
CVE-2026-44483 |
8.2 | 0.0036 | NET NO AUTH LOW CX NO UI | RVF (formerly Remix Validated Form) provides easy form validation and state mana | |
|
75
|
CVE-2026-41205 |
7.7 | 0.0036 | NET NO AUTH LOW CX NO UI | Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.ge | |
|
75
|
CVE-2026-13189 |
7.5 | 0.0036 | NET NO AUTH LOW CX NO UI | In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation | |
|
75
|
CVE-2026-1345 |
7.3 | 0.0036 | NET NO AUTH LOW CX NO UI | IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify | |
|
75
|
CVE-2026-35611 |
7.5 | 0.0036 | NET NO AUTH LOW CX NO UI | Addressable is an alternative implementation to the URI implementation that is p | |
|
75
|
CVE-2025-61162 |
7.5 | 0.0036 | NET NO AUTH LOW CX NO UI | Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrari | |
|
75
|
CVE-2026-76491 |
7.5 | 0.0036 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
75
|
CVE-2026-76492 |
7.5 | 0.0036 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
75
|
CVE-2026-76493 |
7.5 | 0.0036 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
75
|
CVE-2025-64213 |
7.5 | 0.0036 | NET NO AUTH LOW CX NO UI | Insertion of Sensitive Information Into Sent Data vulnerability in StylemixTheme | |
|
75
|
CVE-2026-112921 |
7.3 | 0.0036 | NET NO AUTH LOW CX NO UI | Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as im | |
|
74
|
CVE-2026-111812 |
7.0 | 0.0036 | NET NO AUTH LOW CX NO UI | Apache Traffic Server's origin_server_auth plugin lets a client force signing of | |
|
74
|
CVE-2026-46681 |
7.2 | 0.0036 | NET NO AUTH LOW CX NO UI | @nevware21/ts-utils is a comprehensive TypeScript/JavaScript utility library. Pr | |
|
69
|
CVE-2026-40872 |
9.3 | 0.0036 | NET NO AUTH LOW CX | mailcow: dockerized is an open source groupware/email suite based on docker. In | |
|
68
|
CVE-2023-30901 |
8.8 | 0.0036 | NET NO AUTH LOW CX | A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All vers | |
|
68
|
CVE-2026-118358 |
8.8 | 0.0036 | NET NO AUTH LOW CX | Memory corruption in WebAudio in Google Chrome prior to 156.0.8078.73 allowed a | |
|
66
|
CVE-2026-44752 |
8.2 | 0.0036 | NET NO AUTH LOW CX | SAP NetWeaver Application Server Java allows an unauthenticated attacker to inje | |
|
66
|
CVE-2026-66318 |
8.1 | 0.0036 | NET NO AUTH LOW CX | Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorize | |
|
65
|
CVE-2026-101707 |
7.4 | 0.0036 | NET NO AUTH NO UI | Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business S | |
|
64
|
CVE-2026-107858 |
7.2 | 0.0036 | NET NO AUTH LOW CX | Missing Origin Validation in WebSockets (CWE-1385) and Permissive Cross-domain P | |
|
64
|
CVE-2026-6409 |
7.1 | 0.0036 | NET NO AUTH LOW CX | A Denial of Service (DoS) vulnerability exists in the Protobuf PHP library durin | |
|
64
|
CVE-2026-50348 |
7.0 | 0.0036 | NET NO AUTH NO UI | Concurrent execution using shared resource with improper synchronization ('race | |
|
64
|
CVE-2026-50452 |
7.0 | 0.0036 | NET NO AUTH NO UI | Concurrent execution using shared resource with improper synchronization ('race | |
|
64
|
CVE-2026-48029 |
7.1 | 0.0036 | NET NO AUTH LOW CX | libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 thro | |
|
57
|
CVE-2026-54666 |
8.3 | 0.0036 | NET NO AUTH | swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI | |
|
55
|
CVE-2026-14064 |
7.5 | 0.0036 | NET NO AUTH | Use after free in PageInfo in Google Chrome on Android prior to 150.0.7871.47 al | |
|
55
|
CVE-2026-14409 |
7.5 | 0.0036 | NET NO AUTH | Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allow | |
|
55
|
CVE-2026-14426 |
7.5 | 0.0036 | NET NO AUTH | Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote at | |
|
55
|
CVE-2026-17896 |
7.5 | 0.0036 | NET NO AUTH | Use after free in DevTools in Google Chrome prior to 151.0.7922.72 allowed a rem | |
|
55
|
CVE-2026-91406 |
7.5 | 0.0036 | NET NO AUTH | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl |