Hunt List
8,487 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
78
|
CVE-2026-105869 |
9.2 | 0.0030 | NET NO AUTH LOW CX NO UI | Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with al | |
|
77
|
CVE-2026-91219 |
8.6 | 0.0030 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo | |
|
75
|
CVE-2026-47835 |
7.5 | 0.0030 | NET NO AUTH LOW CX NO UI | In Spring AI Vector Stores, special characters could be used to force the execut | |
|
75
|
CVE-2026-39533 |
7.5 | 0.0030 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.4 versions. | |
|
75
|
CVE-2026-34891 |
7.5 | 0.0030 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in IDPay Payment Gateway for Woocommerce | |
|
75
|
CVE-2026-91307 |
7.5 | 0.0030 | NET NO AUTH LOW CX NO UI | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards | |
|
75
|
CVE-2026-91308 |
7.5 | 0.0030 | NET NO AUTH LOW CX NO UI | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards | |
|
75
|
CVE-2026-91465 |
7.5 | 0.0030 | NET NO AUTH LOW CX NO UI | Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product | |
|
75
|
CVE-2026-100164 |
7.5 | 0.0030 | NET NO AUTH LOW CX NO UI | Observable response discrepancy vulnerability in Rolantis Information Technologi | |
|
74
|
CVE-2026-20035 |
7.2 | 0.0030 | NET NO AUTH LOW CX NO UI | A vulnerability in the web UI of Cisco Unity Connection Web Inbox could allow an | |
|
68
|
CVE-2026-7498 |
8.8 | 0.0030 | NET NO AUTH LOW CX | Improper neutralization of input during web page generation ('cross-site scripti | |
|
68
|
CVE-2026-17920 |
8.8 | 0.0030 | NET NO AUTH LOW CX | Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker | |
|
66
|
CVE-2026-28907 |
8.1 | 0.0030 | NET NO AUTH LOW CX | The issue was addressed with improved input validation. This issue is fixed in S | |
|
66
|
CVE-2026-13774 |
8.1 | 0.0030 | NET NO AUTH NO UI | Use after free in Extensions in Google Chrome prior to 150.0.7871.47 allowed an | |
|
65
|
CVE-2026-55201 |
7.4 | 0.0030 | NET NO AUTH LOW CX | Evil-WinRM through 3.9, fixed in commit 6ecd570, contains a path traversal vulne | |
|
65
|
CVE-2026-105483 |
7.4 | 0.0030 | NET NO AUTH NO UI | A flaw in Node.js TLS hostname verification allows a certificate without a match | |
|
65
|
CVE-2026-106069 |
7.4 | 0.0030 | NET NO AUTH NO UI | A flaw in Node.js TLS hostname verification can cause a server certificate to be | |
|
64
|
CVE-2026-119208 |
7.1 | 0.0030 | NET NO AUTH LOW CX | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf | |
|
64
|
CVE-2026-119204 |
7.1 | 0.0030 | NET NO AUTH LOW CX | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf | |
|
64
|
CVE-2026-119205 |
7.1 | 0.0030 | NET NO AUTH LOW CX | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf | |
|
64
|
CVE-2026-119206 |
7.1 | 0.0030 | NET NO AUTH LOW CX | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf | |
|
64
|
CVE-2026-119207 |
7.1 | 0.0030 | NET NO AUTH LOW CX | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf | |
|
64
|
CVE-2026-119203 |
7.1 | 0.0030 | NET NO AUTH LOW CX | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.4, pypdf | |
|
57
|
CVE-2026-17650 |
8.3 | 0.0030 | NET NO AUTH | Use after free in Compositing in Google Chrome prior to 151.0.7922.72 allowed a | |
|
57
|
CVE-2026-17657 |
8.3 | 0.0030 | NET NO AUTH | Use after free in Navigation in Google Chrome prior to 151.0.7922.72 allowed a r | |
|
57
|
CVE-2026-17722 |
8.3 | 0.0030 | NET NO AUTH | Object lifecycle issue in WebView in Google Chrome on Android prior to 151.0.792 | |
|
57
|
CVE-2026-17723 |
8.3 | 0.0030 | NET NO AUTH | Use after free in Media in Google Chrome on Windows prior to 151.0.7922.72 allow | |
|
57
|
CVE-2026-19137 |
8.3 | 0.0030 | NET NO AUTH | Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allo | |
|
57
|
CVE-2026-19140 |
8.3 | 0.0030 | NET NO AUTH | Use after free in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote | |
|
57
|
CVE-2026-19141 |
8.3 | 0.0030 | NET NO AUTH | Use after free in Resources in Google Chrome on Android prior to 151.0.7922.109 | |
|
57
|
CVE-2026-19147 |
8.3 | 0.0030 | NET NO AUTH | Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed | |
|
57
|
CVE-2026-19148 |
8.3 | 0.0030 | NET NO AUTH | Out of bounds write in GPU in Google Chrome on Linux prior to 151.0.7922.109 all | |
|
57
|
CVE-2026-19152 |
8.3 | 0.0030 | NET NO AUTH | Insufficient policy enforcement in Navigation in Google Chrome prior to 151.0.79 | |
|
57
|
CVE-2026-19155 |
8.3 | 0.0030 | NET NO AUTH | Use after free in Payments in Google Chrome prior to 151.0.7922.109 allowed a re | |
|
57
|
CVE-2026-19163 |
8.3 | 0.0030 | NET NO AUTH | Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109 allo | |
|
57
|
CVE-2026-19172 |
8.3 | 0.0030 | NET NO AUTH | Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remot | |
|
57
|
CVE-2026-19557 |
8.3 | 0.0030 | NET NO AUTH | Use after free in TabStrip in Google Chrome on Mac prior to 151.0.7922.137 allow | |
|
56
|
CVE-2026-54271 |
8.2 | 0.0030 | NET NO AUTH | protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.3.2 and 2. | |
|
55
|
CVE-2026-13814 |
7.5 | 0.0030 | NET NO AUTH | Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote | |
|
55
|
CVE-2026-15111 |
7.5 | 0.0030 | NET NO AUTH | Use after free in Views in Google Chrome prior to 150.0.7871.115 allowed a remot | |
|
55
|
CVE-2026-15117 |
7.5 | 0.0030 | NET NO AUTH | Use after free in Payments in Google Chrome prior to 150.0.7871.115 allowed a re | |
|
55
|
CVE-2026-15764 |
7.5 | 0.0030 | NET NO AUTH | Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.125 allowe | |
|
55
|
CVE-2026-15765 |
7.5 | 0.0030 | NET NO AUTH | Use after free in Ozone in Google Chrome prior to 150.0.7871.125 allowed a remot | |
|
55
|
CVE-2026-15777 |
7.5 | 0.0030 | NET NO AUTH | Use after free in UI in Google Chrome on Linux prior to 150.0.7871.125 allowed a | |
|
55
|
CVE-2026-17887 |
7.5 | 0.0030 | NET NO AUTH | Use after free in TabStrip in Google Chrome prior to 151.0.7922.72 allowed a rem | |
|
55
|
CVE-2026-19142 |
7.5 | 0.0030 | NET NO AUTH | Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remot | |
|
55
|
CVE-2026-19158 |
7.5 | 0.0030 | NET NO AUTH | Use after free in Views in Google Chrome on Windows prior to 151.0.7922.109 allo | |
|
55
|
CVE-2026-19159 |
7.5 | 0.0030 | NET NO AUTH | Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remot | |
|
55
|
CVE-2026-113499 |
7.5 | 0.0030 | NET NO AUTH | The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its H | |
|
55
|
CVE-2026-113500 |
7.5 | 0.0030 | NET NO AUTH | The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML |