Hunt List
8,519 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-116386 |
9.8 | 0.0035 | NET NO AUTH LOW CX NO UI | Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 v | |
|
80
|
CVE-2026-13776 |
9.8 | 0.0035 | NET NO AUTH LOW CX NO UI | Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote | |
|
80
|
CVE-2026-103409 |
9.8 | 0.0035 | NET NO AUTH LOW CX NO UI | A Missing authentication for critical function vulnerability in Juniper Networks | |
|
80
|
CVE-2026-6853 |
9.8 | 0.0035 | NET NO AUTH LOW CX NO UI | Improper restriction of excessive authentication attempts vulnerability in Başbe | |
|
79
|
CVE-2026-111402 |
9.3 | 0.0035 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
79
|
CVE-2026-49079 |
9.3 | 0.0035 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in JetSearch <= 3.5.17 versions. | |
|
78
|
CVE-2025-31699 |
9.1 | 0.0035 | NET NO AUTH LOW CX NO UI | Apache Traffic Server can return an origin connection to the shared pool while t | |
|
78
|
CVE-2026-116557 |
9.1 | 0.0035 | NET NO AUTH LOW CX NO UI | The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to u | |
|
78
|
CVE-2026-41930 |
9.2 | 0.0035 | NET NO AUTH LOW CX NO UI | Vvveb before version 1.0.8.2 contains a hard-coded credentials vulnerability in | |
|
78
|
CVE-2026-34287 |
9.1 | 0.0035 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion | |
|
77
|
CVE-2026-9219 |
8.3 | 0.0035 | NET NO AUTH LOW CX NO UI | Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior h | |
|
77
|
CVE-2026-114110 |
8.7 | 0.0035 | NET NO AUTH LOW CX NO UI | Astral uv before 0.11.6 contains a path traversal vulnerability that allows atta | |
|
77
|
CVE-2026-118686 |
8.7 | 0.0035 | NET NO AUTH LOW CX NO UI | EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulner | |
|
77
|
CVE-2026-32965 |
8.7 | 0.0035 | NET NO AUTH LOW CX NO UI | Initialization of a resource with an insecure default vulnerability exists in SD | |
|
76
|
CVE-2026-112381 |
8.2 | 0.0035 | NET NO AUTH LOW CX NO UI | Apache Traffic Server can crash with a null pointer dereference when a client PO | |
|
76
|
CVE-2026-41907 |
8.1 | 0.0035 | NET NO AUTH LOW CX NO UI | uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v | |
|
76
|
CVE-2026-41471 |
8.2 | 0.0035 | NET NO AUTH LOW CX NO UI | The Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contain | |
|
75
|
CVE-2026-115417 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adap | |
|
75
|
CVE-2026-115907 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | zip is a zip library for Rust that supports reading and writing simple ZIP files | |
|
75
|
CVE-2026-33597 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | PRSD detection denial of service | |
|
75
|
CVE-2026-28990 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | The issue was addressed with improved memory handling. This issue is fixed in iO | |
|
75
|
CVE-2026-43654 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | The issue was addressed with improved memory handling. This issue is fixed in iO | |
|
75
|
CVE-2026-57873 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | An unauthenticated NULL pointer dereference vulnerability exists in IEEE8021x_up | |
|
75
|
CVE-2026-16837 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
75
|
CVE-2026-40396 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Varnish Cache 9 before 9.0.1 allows a "workspace overflow" denial of service (da | |
|
75
|
CVE-2026-57111 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Permissive Cross-Origin Resource Sharing (CORS) in the REST API (helix-rest, org | |
|
75
|
CVE-2026-33692 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | WWBN AVideo is an open source video platform. Versions prior to 29.0 expose .env | |
|
75
|
CVE-2026-40890 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdow | |
|
75
|
CVE-2026-48872 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in EmbedPress <= 4.5.2 versions. | |
|
75
|
CVE-2026-54828 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Motors <= 1.4.109 versions. | |
|
75
|
CVE-2026-54830 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Five Star Restaurant Reservations <= 2. | |
|
75
|
CVE-2026-54844 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in CheckView Automated Testing <= 2.1.0 ve | |
|
75
|
CVE-2026-54832 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Gutenverse Companion <= 2.5.0 versions. | |
|
75
|
CVE-2026-54835 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Five Star Restaurant Menu <= 2.5.2 vers | |
|
75
|
CVE-2026-56025 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Paymob for WooCommerce <= 4.1.2 version | |
|
75
|
CVE-2026-56061 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Subscriptions for WooCommerce <= 1.9.5 | |
|
67
|
CVE-2026-63346 |
8.6 | 0.0035 | NET NO AUTH LOW CX | Refitter is a tool for generating a C# REST API client using the Refit library. | |
|
67
|
CVE-2026-63345 |
8.6 | 0.0035 | NET NO AUTH LOW CX | Refitter is a tool for generating a C# REST API client using the Refit library. | |
|
67
|
CVE-2026-12043 |
8.7 | 0.0035 | NET NO AUTH LOW CX | Improper handling of HPACK dynamic table size updates in the AWS Common Runtime | |
|
66
|
CVE-2026-101834 |
8.1 | 0.0035 | NET NO AUTH NO UI | Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suit | |
|
66
|
CVE-2026-83409 |
8.1 | 0.0035 | NET NO AUTH NO UI | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware ( | |
|
66
|
CVE-2026-87305 |
8.1 | 0.0035 | NET NO AUTH NO UI | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards | |
|
66
|
CVE-2026-91313 |
8.1 | 0.0035 | NET NO AUTH NO UI | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards | |
|
66
|
CVE-2026-13791 |
8.1 | 0.0035 | NET NO AUTH NO UI | Insufficient validation of untrusted input in Downloads in Google Chrome prior t | |
|
66
|
CVE-2026-57645 |
8.1 | 0.0035 | NET NO AUTH LOW CX | newsletters_subscribers Broken Access Control in Newsletters <= 4.13 versions. | |
|
64
|
CVE-2026-7017 |
7.1 | 0.0035 | NET NO AUTH LOW CX | HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-or | |
|
57
|
CVE-2026-54662 |
8.3 | 0.0035 | NET NO AUTH | swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI spe | |
|
57
|
CVE-2026-19154 |
8.3 | 0.0035 | NET NO AUTH | Use after free in Skia in Google Chrome on Android prior to 151.0.7922.109 allow | |
|
55
|
CVE-2026-5284 |
7.5 | 0.0035 | NET NO AUTH | Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote | |
|
55
|
CVE-2026-101719 |
7.5 | 0.0035 | NET NO AUTH | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: |