Hunt List
8,490 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-62131 |
9.8 | 0.0031 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions. | |
|
80
|
CVE-2026-33519 |
9.8 | 0.0031 | NET NO AUTH LOW CX NO UI | An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, | |
|
80
|
CVE-2026-54433 |
10.0 | 0.0031 | NET NO AUTH LOW CX NO UI | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross | |
|
80
|
CVE-2026-49769 |
9.8 | 0.0031 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions. | |
|
80
|
CVE-2026-18108 |
9.8 | 0.0031 | NET NO AUTH LOW CX NO UI | Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _ve | |
|
80
|
CVE-2026-6771 |
9.8 | 0.0031 | NET NO AUTH LOW CX NO UI | Mitigation bypass in the DOM: Security component. This vulnerability was fixed i | |
|
79
|
CVE-2026-49080 |
9.3 | 0.0031 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in wpDataTables <= 7.3.6 versions. | |
|
79
|
CVE-2026-105207 |
9.3 | 0.0031 | NET NO AUTH LOW CX NO UI | ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user | |
|
79
|
CVE-2025-58628 |
9.3 | 0.0031 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
79
|
CVE-2026-64024 |
9.4 | 0.0031 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: tcp: fix st | |
|
79
|
CVE-2026-54808 |
9.3 | 0.0031 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
78
|
CVE-2026-41691 |
9.1 | 0.0031 | NET NO AUTH LOW CX NO UI | Copilot said: i18nextify is a JavaScript library that adds i18nextify is a JavaS | |
|
78
|
CVE-2026-34751 |
9.1 | 0.0031 | NET NO AUTH LOW CX NO UI | Payload is a free and open source headless content management system. Prior to v | |
|
78
|
CVE-2026-13851 |
9.1 | 0.0031 | NET NO AUTH LOW CX NO UI | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on | |
|
78
|
CVE-2026-13852 |
9.1 | 0.0031 | NET NO AUTH LOW CX NO UI | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on | |
|
77
|
CVE-2026-6375 |
8.7 | 0.0031 | NET NO AUTH LOW CX NO UI | A vulnerability in SpiceJet’s booking API allows unauthenticated users to query | |
|
77
|
CVE-2023-54346 |
8.7 | 0.0031 | NET NO AUTH LOW CX NO UI | WordPress Plugin Backup Migration 1.2.8 contains an information disclosure vulne | |
|
77
|
CVE-2026-41690 |
8.6 | 0.0031 | NET NO AUTH LOW CX NO UI | 18next-http-middleware is a middleware to be used with Node.js web frameworks li | |
|
77
|
CVE-2026-61454 |
8.7 | 0.0031 | NET NO AUTH LOW CX NO UI | The Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 embeds a global | |
|
75
|
CVE-2026-59198 |
7.5 | 0.0031 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE en | |
|
75
|
CVE-2025-63895 |
7.5 | 0.0031 | NET NO AUTH LOW CX NO UI | An issue in the Bluetooth firmware of JXL 9 Inch Car Android Double Din Player A | |
|
75
|
CVE-2026-36837 |
7.5 | 0.0031 | NET NO AUTH LOW CX NO UI | TOTOLINK A3002RU V3 <= V3.0.0-B20220304.1804 was discovered to contain a stack-b | |
|
75
|
CVE-2026-39870 |
7.5 | 0.0031 | NET NO AUTH LOW CX NO UI | The issue was addressed with improved memory handling. This issue is fixed in ma | |
|
75
|
CVE-2026-39871 |
7.5 | 0.0031 | NET NO AUTH LOW CX NO UI | A path handling issue was addressed with improved logic. This issue is fixed in | |
|
75
|
CVE-2026-42348 |
7.5 | 0.0031 | NET NO AUTH LOW CX NO UI | OpenTelemetry.OpAmp.Client is the OpAMP client for OpenTelemetry .NET. Prior to | |
|
75
|
CVE-2026-45088 |
7.5 | 0.0031 | NET NO AUTH LOW CX NO UI | Dalfox is a powerful open-source XSS scanner and utility focused on automation. | |
|
75
|
CVE-2026-50578 |
7.5 | 0.0031 | NET NO AUTH LOW CX NO UI | ePA 3.x Integration implements the authorization workflow and writes Medical Inf | |
|
75
|
CVE-2026-40198 |
7.5 | 0.0031 | NET NO AUTH LOW CX NO UI | Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count | |
|
75
|
CVE-2026-7287 |
7.5 | 0.0031 | NET NO AUTH LOW CX NO UI | ** UNSUPPORTED WHEN ASSIGNED ** A buffer overflow vulnerability in the formWep() | |
|
75
|
CVE-2026-58101 |
7.5 | 0.0031 | NET NO AUTH LOW CX NO UI | Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via | |
|
69
|
CVE-2026-61451 |
9.4 | 0.0031 | NET NO AUTH LOW CX | The Grav API plugin (grav-plugin-api) before 1.0.4 does not validate the origin | |
|
68
|
CVE-2026-32999 |
9.0 | 0.0031 | NET NO AUTH NO UI | Insufficient character filtering in backup agent signing module on Comet Backup | |
|
68
|
CVE-2026-8558 |
8.8 | 0.0031 | NET NO AUTH LOW CX | Out of bounds write in Fonts in Google Chrome prior to 148.0.7778.168 allowed a | |
|
68
|
CVE-2026-107672 |
8.8 | 0.0031 | NET NO AUTH LOW CX | A maliciously crafted .stack.json file can trigger a trusted Markdown injection | |
|
68
|
CVE-2026-7898 |
8.8 | 0.0031 | NET NO AUTH LOW CX | Use after free in Chromoting in Google Chrome on Linux prior to 148.0.7778.96 al | |
|
67
|
CVE-2026-4827 |
8.7 | 0.0031 | NET NO AUTH LOW CX | CWE‑331: Insufficient Entropy vulnerability exists that could lead to unauthoriz | |
|
67
|
CVE-2026-83426 |
8.7 | 0.0031 | NET NO AUTH NO UI | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware ( | |
|
66
|
CVE-2026-29206 |
8.1 | 0.0031 | NET NO AUTH LOW CX | Insufficient sanitization of SQL queries in the `sqloptimizer` utility script al | |
|
66
|
CVE-2026-115193 |
8.2 | 0.0031 | NET NO AUTH LOW CX | A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail v | |
|
65
|
CVE-2026-40885 |
7.7 | 0.0031 | NET NO AUTH LOW CX | goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, go | |
|
65
|
CVE-2026-54660 |
7.4 | 0.0031 | NET NO AUTH LOW CX | swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI spe | |
|
64
|
CVE-2026-62387 |
7.1 | 0.0031 | NET NO AUTH LOW CX | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 shipped Access- | |
|
64
|
CVE-2026-110829 |
7.1 | 0.0031 | NET NO AUTH LOW CX | FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in | |
|
64
|
CVE-2026-110834 |
7.1 | 0.0031 | NET NO AUTH LOW CX | FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerabili | |
|
64
|
CVE-2026-110836 |
7.1 | 0.0031 | NET NO AUTH LOW CX | FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http | |
|
64
|
CVE-2026-53792 |
7.1 | 0.0031 | NET NO AUTH LOW CX | rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-si | |
|
64
|
CVE-2026-109822 |
7.1 | 0.0031 | NET NO AUTH LOW CX | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an iss | |
|
57
|
CVE-2026-6361 |
8.3 | 0.0031 | NET NO AUTH | Heap buffer overflow in PDFium in Google Chrome on Windows prior to 147.0.7727.1 | |
|
55
|
CVE-2026-27366 |
7.5 | 0.0031 | NET NO AUTH | Unauthenticated Broken Access Control in MainWP Child <= 6.1.1 versions. | |
|
55
|
CVE-2026-13807 |
7.5 | 0.0031 | NET NO AUTH | Use after free in Import in Google Chrome on iOS prior to 150.0.7871.47 allowed |