Hunt List
8,496 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
85
|
CVE-2026-97206 |
7.5 | 0.0033 | NET NO AUTH LOW CX NO UI | 1 PoC | NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-ov |
|
80
|
CVE-2026-41267 |
9.8 | 0.0033 | NET NO AUTH LOW CX NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
80
|
CVE-2026-42731 |
9.8 | 0.0033 | NET NO AUTH LOW CX NO UI | Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verifi | |
|
80
|
CVE-2026-53914 |
9.8 | 0.0033 | NET NO AUTH LOW CX NO UI | In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deseria | |
|
80
|
CVE-2026-40494 |
9.8 | 0.0033 | NET NO AUTH LOW CX NO UI | SAIL is a cross-platform library for loading and saving images with support for | |
|
79
|
CVE-2026-22097 |
9.3 | 0.0033 | NET NO AUTH LOW CX NO UI | The firmware update mechanism does not include cryptographic signature validatio | |
|
79
|
CVE-2026-48616 |
9.3 | 0.0033 | NET NO AUTH LOW CX NO UI | Rocket.Chat versions <8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 | |
|
79
|
CVE-2026-68582 |
9.3 | 0.0033 | NET NO AUTH LOW CX NO UI | Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorizat | |
|
79
|
CVE-2026-112327 |
9.3 | 0.0033 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
78
|
CVE-2026-55203 |
9.0 | 0.0033 | NET NO AUTH LOW CX NO UI | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vul | |
|
78
|
CVE-2026-9270 |
9.1 | 0.0033 | NET NO AUTH LOW CX NO UI | DataDog::DogStatsd versions through 0.07 for Perl allow metric injections. Data | |
|
78
|
CVE-2026-71290 |
9.1 | 0.0033 | NET NO AUTH LOW CX NO UI | Improper TLS hostname verification vulnerability in Apache HttpComponents Client | |
|
78
|
CVE-2026-63159 |
9.1 | 0.0033 | NET NO AUTH LOW CX NO UI | Omnispace Agora Project before 26.10.0 contains a predictable password-reset tok | |
|
77
|
CVE-2026-116591 |
8.7 | 0.0033 | NET NO AUTH LOW CX NO UI | compress provides various compression algorithms. Prior to 1.20.2, the zstd Deco | |
|
77
|
CVE-2026-54284 |
8.7 | 0.0033 | NET NO AUTH LOW CX NO UI | sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, Token | |
|
77
|
CVE-2026-44886 |
8.7 | 0.0033 | NET NO AUTH LOW CX NO UI | Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. From 202 | |
|
76
|
CVE-2026-71264 |
8.2 | 0.0033 | NET NO AUTH LOW CX NO UI | WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serve | |
|
76
|
CVE-2026-62386 |
8.2 | 0.0033 | NET NO AUTH LOW CX NO UI | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT acc | |
|
76
|
CVE-2026-59731 |
8.2 | 0.0033 | NET NO AUTH LOW CX NO UI | Astro is a web framework for content-driven websites. Version 6.4.7 performs aut | |
|
76
|
CVE-2026-67213 |
8.2 | 0.0033 | NET NO AUTH LOW CX NO UI | nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet an | |
|
76
|
CVE-2026-93905 |
8.2 | 0.0033 | NET NO AUTH LOW CX NO UI | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allo | |
|
75
|
CVE-2026-40115 |
7.5 | 0.0033 | NET NO AUTH LOW CX NO UI | PraisonAI is a multi-agent teams system. Prior to 4.5.128, the WSGI-based recipe | |
|
75
|
CVE-2026-54299 |
7.5 | 0.0033 | NET NO AUTH LOW CX NO UI | Astro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error | |
|
75
|
CVE-2026-41324 |
7.5 | 0.0033 | NET NO AUTH LOW CX NO UI | basic-ftp is an FTP client for Node.js. Versions prior to 5.3.0 are vulnerable t | |
|
75
|
CVE-2026-34305 |
7.5 | 0.0033 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware | |
|
75
|
CVE-2026-95696 |
7.5 | 0.0033 | NET NO AUTH LOW CX NO UI | IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could all | |
|
74
|
CVE-2026-73367 |
7.2 | 0.0033 | NET NO AUTH LOW CX NO UI | Unauthenticated Remote File Inclusion in Easy Google Maps < 1.14.2 versions. | |
|
69
|
CVE-2026-109708 |
9.6 | 0.0033 | NET NO AUTH LOW CX | Sandbox escape due to incorrect boundary conditions in the Networking component. | |
|
69
|
CVE-2026-14101 |
9.6 | 0.0033 | NET NO AUTH LOW CX | Insufficient policy enforcement in Sandbox in Google Chrome on Mac prior to 150. | |
|
69
|
CVE-2026-75626 |
9.3 | 0.0033 | NET NO AUTH LOW CX | SpiderFoot fails to HTML-escape correlation titles built from external scan data | |
|
68
|
CVE-2026-6302 |
8.8 | 0.0033 | NET NO AUTH LOW CX | Use after free in Video in Google Chrome prior to 147.0.7727.101 allowed a remot | |
|
68
|
CVE-2026-6318 |
8.8 | 0.0033 | NET NO AUTH LOW CX | Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remo | |
|
68
|
CVE-2026-13825 |
8.8 | 0.0033 | NET NO AUTH LOW CX | Uninitialized Use in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remo | |
|
68
|
CVE-2026-118330 |
8.8 | 0.0033 | NET NO AUTH LOW CX | Use after free in Browser in Google Chrome on on Windows prior to 156.0.8078.73 | |
|
68
|
CVE-2026-13897 |
8.8 | 0.0033 | NET NO AUTH LOW CX | Insufficient policy enforcement in Chromecast in Google Chrome prior to 150.0.78 | |
|
68
|
CVE-2026-17868 |
8.8 | 0.0033 | NET NO AUTH LOW CX | Insufficient policy enforcement in USB in Google Chrome prior to 151.0.7922.72 a | |
|
68
|
CVE-2026-12439 |
8.8 | 0.0033 | NET NO AUTH LOW CX | Use after free in Digital Credentials in Google Chrome prior to 149.0.7827.155 a | |
|
68
|
CVE-2026-118307 |
8.8 | 0.0033 | NET NO AUTH LOW CX | Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote | |
|
67
|
CVE-2026-42275 |
8.7 | 0.0033 | NET NO AUTH NO UI | zrok is software for sharing web services, files, and network resources. Prior t | |
|
66
|
CVE-2026-114104 |
8.2 | 0.0033 | NET NO AUTH NO UI | adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability tha | |
|
66
|
CVE-2026-116178 |
8.2 | 0.0033 | NET NO AUTH NO UI | vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that a | |
|
65
|
CVE-2026-66661 |
7.7 | 0.0033 | NET NO AUTH NO UI | Subscriber Privilege Escalation in Directories Pro <= 2.0.5 versions. | |
|
65
|
CVE-2026-101775 |
7.4 | 0.0033 | NET NO AUTH NO UI | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon | |
|
64
|
CVE-2026-48856 |
7.1 | 0.0034 | NET NO AUTH LOW CX | Sensitive Data Exposure vulnerability in Erlang OTP inets (httpc_response module | |
|
58
|
CVE-2026-72807 |
8.8 | 0.0033 | NET NO AUTH | SiYuan versions before v3.7.4 contain a second-order SQL injection vulnerability | |
|
57
|
CVE-2026-35302 |
8.3 | 0.0033 | NET NO AUTH | Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (compon | |
|
57
|
CVE-2026-45049 |
8.3 | 0.0033 | NET NO AUTH | Open Access Management (OpenAM) is an access management solution. Prior to 16.1. | |
|
57
|
CVE-2026-13803 |
8.3 | 0.0033 | NET NO AUTH | Type Confusion in Chrome Tabs in Google Chrome prior to 150.0.7871.47 allowed a | |
|
57
|
CVE-2026-14151 |
8.3 | 0.0033 | NET NO AUTH | Inappropriate implementation in AI in Google Chrome prior to 150.0.7871.47 allow | |
|
55
|
CVE-2026-5277 |
7.5 | 0.0033 | NET NO AUTH | Integer overflow in ANGLE in Google Chrome on Windows prior to 146.0.7680.178 al |