Hunt List
8,506 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-27395 |
9.8 | 0.0034 | NET NO AUTH LOW CX NO UI | Unauthenticated Privilege Escalation in Support Board < 3.8.9 versions. | |
|
80
|
CVE-2026-28148 |
9.8 | 0.0034 | NET NO AUTH LOW CX NO UI | Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions. | |
|
75
|
CVE-2026-28140 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 versions. | |
|
75
|
CVE-2026-66712 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions. | |
|
75
|
CVE-2026-27345 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= | |
|
75
|
CVE-2026-66431 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for W | |
|
75
|
CVE-2026-66466 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for Wo | |
|
75
|
CVE-2026-66469 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Arvow AI SEO Writer <= 1.5.3 versions. | |
|
75
|
CVE-2026-73377 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 vers | |
|
75
|
CVE-2026-73994 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions. | |
|
69
|
CVE-2026-13789 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote a | |
|
69
|
CVE-2026-13792 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in Touchbar in Google Chrome on Mac prior to 150.0.7871.47 allowe | |
|
69
|
CVE-2026-13843 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on | |
|
69
|
CVE-2026-13846 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in USB in Google Chrome on Mac prior to 150.0.7871.47 allowed a r | |
|
69
|
CVE-2026-13869 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in Device in Google Chrome on Windows prior to 150.0.7871.47 allo | |
|
69
|
CVE-2026-13901 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Insufficient policy enforcement in Serial in Google Chrome prior to 150.0.7871.4 | |
|
69
|
CVE-2026-13909 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Insufficient policy enforcement in DevTools in Google Chrome prior to 150.0.7871 | |
|
69
|
CVE-2026-13920 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Media in Google Chrome on Windows | |
|
69
|
CVE-2026-13934 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Dawn in Google Chrome on Android p | |
|
69
|
CVE-2026-14017 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Inappropriate implementation in Navigation in Google Chrome prior to 150.0.7871. | |
|
69
|
CVE-2026-14037 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Insufficient policy enforcement in GPU in Google Chrome prior to 150.0.7871.47 a | |
|
69
|
CVE-2026-14043 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in GetUserMedia in Google Chrome prior to 150.0.7871.47 allowed a | |
|
69
|
CVE-2026-14055 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Device Trust in Google Chrome on W | |
|
69
|
CVE-2026-14106 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Text in Google Chrome on Android p | |
|
69
|
CVE-2026-14109 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Insufficient policy enforcement in Mojo in Google Chrome prior to 150.0.7871.47 | |
|
69
|
CVE-2026-14120 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 | |
|
69
|
CVE-2026-14392 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Out of bounds write in Tint in Google Chrome prior to 150.0.7871.46 allowed a re | |
|
69
|
CVE-2026-14416 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Out of bounds read in Dawn in Google Chrome prior to 150.0.7871.46 allowed a rem | |
|
69
|
CVE-2026-14417 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote | |
|
69
|
CVE-2026-14420 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Out of bounds read and write in Dawn in Google Chrome prior to 150.0.7871.46 all | |
|
69
|
CVE-2026-14424 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in Dawn in Google Chrome on Mac prior to 150.0.7871.46 allowed a | |
|
69
|
CVE-2026-15113 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in Autofill in Google Chrome on Android prior to 150.0.7871.115 a | |
|
69
|
CVE-2026-15773 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in Core in Google Chrome on Windows prior to 150.0.7871.125 allow | |
|
69
|
CVE-2026-15899 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in CameraCapture in Google Chrome on Mac prior to 150.0.7871.128 | |
|
69
|
CVE-2026-15900 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in GPU in Google Chrome on Android prior to 150.0.7871.128 allowe | |
|
69
|
CVE-2026-15901 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in Network in Google Chrome prior to 150.0.7871.128 allowed a rem | |
|
69
|
CVE-2026-16424 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in GPU in Google Chrome on Android prior to 150.0.7871.182 allowe | |
|
69
|
CVE-2026-17651 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Dawn in Google Chrome on Android p | |
|
69
|
CVE-2026-17652 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in Views in Google Chrome prior to 151.0.7922.72 allowed a remote | |
|
69
|
CVE-2026-17656 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in Ozone in Google Chrome prior to 151.0.7922.72 allowed a remote | |
|
69
|
CVE-2026-17669 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to | |
|
69
|
CVE-2026-17670 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in Views in Google Chrome prior to 151.0.7922.72 allowed a remote | |
|
69
|
CVE-2026-17672 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Chromecast in Google Chrome prior | |
|
69
|
CVE-2026-17673 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Integer overflow in QUIC in Google Chrome prior to 151.0.7922.72 allowed a remot | |
|
69
|
CVE-2026-17684 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on | |
|
69
|
CVE-2026-17688 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in Input in Google Chrome prior to 151.0.7922.72 allowed a remote | |
|
69
|
CVE-2026-17692 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in DataTransfer in Google Chrome on Windows prior to 151.0.7922.7 | |
|
69
|
CVE-2026-17708 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in Audio in Google Chrome prior to 151.0.7922.72 allowed a remote | |
|
69
|
CVE-2026-17710 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Inappropriate implementation in MHTML in Google Chrome on Mac prior to 151.0.792 | |
|
69
|
CVE-2026-17713 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Accessibility in Google Chrome on |