Hunt List
8,506 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
79
|
CVE-2026-25784 |
9.3 | 0.0034 | NET NO AUTH LOW CX NO UI | Initialization of a Resource with an Insecure Default vulnerability in Hallo Wel | |
|
69
|
CVE-2026-17726 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Integer overflow in WebGL in Google Chrome on Android prior to 151.0.7922.72 all | |
|
69
|
CVE-2026-17727 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Out of bounds write in WebGL in Google Chrome on Android prior to 151.0.7922.72 | |
|
69
|
CVE-2026-17738 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Payments in Google Chrome prior to | |
|
69
|
CVE-2026-17768 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in WebSockets in Google Chrome prior | |
|
69
|
CVE-2026-17804 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in Media in Google Chrome prior to 151.0.7922.72 allowed a remote | |
|
69
|
CVE-2026-17834 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Passwords in Google Chrome prior t | |
|
69
|
CVE-2026-17837 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in DevTools in Google Chrome prior to | |
|
69
|
CVE-2026-17856 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Inappropriate implementation in Network in Google Chrome on Mac prior to 151.0.7 | |
|
69
|
CVE-2026-17865 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Inappropriate implementation in Crypto in Google Chrome on Mac prior to 151.0.79 | |
|
69
|
CVE-2026-17924 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in DNS in Google Chrome prior to 151.0.7922.72 allowed a remote a | |
|
69
|
CVE-2026-17940 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Picture-in-Picture in Google Chrom | |
|
69
|
CVE-2026-17947 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in WebSockets in Google Chrome prior to 151.0.7922.72 allowed a r | |
|
69
|
CVE-2026-17991 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in AI in Google Chrome prior to 151.0 | |
|
69
|
CVE-2026-18002 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Google Lens in Google Chrome prior | |
|
69
|
CVE-2026-18015 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Inappropriate implementation in Tint in Google Chrome on Mac prior to 151.0.7922 | |
|
69
|
CVE-2026-19149 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed | |
|
69
|
CVE-2026-19164 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Codecs in Google Chrome prior to 1 | |
|
69
|
CVE-2026-19170 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allo | |
|
69
|
CVE-2026-19171 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109 allo | |
|
69
|
CVE-2026-19175 |
9.6 | 0.0034 | NET NO AUTH LOW CX | Use after free in Payments in Google Chrome prior to 151.0.7922.109 allowed a re | |
|
68
|
CVE-2026-13817 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Glic in Google Chrome prior to 150 | |
|
68
|
CVE-2026-13835 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Inappropriate implementation in XML in Google Chrome prior to 150.0.7871.47 allo | |
|
68
|
CVE-2026-13903 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.787 | |
|
68
|
CVE-2026-13915 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 | |
|
68
|
CVE-2026-13918 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 | |
|
68
|
CVE-2026-13928 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Enterprise in Google Chrome prior | |
|
68
|
CVE-2026-13938 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Integer overflow in Fonts in Google Chrome prior to 150.0.7871.47 allowed a remo | |
|
68
|
CVE-2026-14005 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Use after free in Omnibox in Google Chrome on Android prior to 150.0.7871.47 all | |
|
68
|
CVE-2026-14009 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Inappropriate implementation in Passwords in Google Chrome prior to 150.0.7871.4 | |
|
68
|
CVE-2026-14024 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allowed | |
|
68
|
CVE-2026-14025 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Use after free in Views in Google Chrome on Mac prior to 150.0.7871.47 allowed a | |
|
68
|
CVE-2026-14027 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Use after free in SignIn in Google Chrome prior to 150.0.7871.47 allowed a remot | |
|
68
|
CVE-2026-14036 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.787 | |
|
68
|
CVE-2026-14041 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Insufficient policy enforcement in Serial in Google Chrome prior to 150.0.7871.4 | |
|
68
|
CVE-2026-14078 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in WebRTC in Google Chrome prior to 1 | |
|
68
|
CVE-2026-14102 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Use after free in Passwords in Google Chrome prior to 150.0.7871.47 allowed a re | |
|
68
|
CVE-2026-14394 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote at | |
|
68
|
CVE-2026-14415 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allow | |
|
68
|
CVE-2026-15112 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Use after free in Ozone in Google Chrome prior to 150.0.7871.115 allowed a remot | |
|
68
|
CVE-2026-15123 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Inappropriate implementation in DOM in Google Chrome prior to 150.0.7871.115 all | |
|
68
|
CVE-2026-15129 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Use after free in Views in Google Chrome prior to 150.0.7871.115 allowed a remot | |
|
68
|
CVE-2026-15904 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.128 allowe | |
|
68
|
CVE-2026-16423 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Use after free in UI in Google Chrome prior to 150.0.7871.182 allowed a remote a | |
|
68
|
CVE-2026-16807 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Out of bounds write in Codecs in Google Chrome prior to 150.0.7871.186 allowed a | |
|
68
|
CVE-2026-17752 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Use after free in Views in Google Chrome on Mac prior to 151.0.7922.72 allowed a | |
|
68
|
CVE-2026-17784 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Use after free in Audio in Google Chrome on Mac prior to 151.0.7922.72 allowed a | |
|
68
|
CVE-2026-17884 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Object lifecycle issue in WebRTC in Google Chrome prior to 151.0.7922.72 allowed | |
|
68
|
CVE-2026-17886 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Use after free in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a r | |
|
68
|
CVE-2026-17894 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Use after free in Views in Google Chrome on Linux prior to 151.0.7922.72 allowed |