Hunt List
8,483 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-12293 |
9.8 | 0.0030 | NET NO AUTH LOW CX NO UI | Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed i | |
|
80
|
CVE-2026-9205 |
9.8 | 0.0030 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in t | |
|
80
|
CVE-2026-16358 |
9.8 | 0.0030 | NET NO AUTH LOW CX NO UI | Site isolation issue in the Graphics: WebRender component. This vulnerability wa | |
|
80
|
CVE-2026-16349 |
9.8 | 0.0030 | NET NO AUTH LOW CX NO UI | Same-origin policy bypass in the DOM: Navigation component. This vulnerability w | |
|
79
|
CVE-2026-39795 |
9.3 | 0.0030 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
79
|
CVE-2026-60002 |
9.4 | 0.0030 | NET NO AUTH LOW CX NO UI | ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its h | |
|
78
|
CVE-2026-35676 |
8.8 | 0.0030 | NET NO AUTH LOW CX NO UI | phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability i | |
|
78
|
CVE-2026-22924 |
8.8 | 0.0030 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V5.0). Th | |
|
78
|
CVE-2026-44196 |
9.1 | 0.0030 | NET NO AUTH LOW CX NO UI | Pingvin Share X is a secure and easy self-hosted file sharing platform. From 1.1 | |
|
78
|
CVE-2026-47702 |
9.1 | 0.0030 | NET NO AUTH LOW CX NO UI | TypeBot is a chatbot builder tool. In version 3.16.1, API tokens (bearer credent | |
|
77
|
CVE-2026-11317 |
8.7 | 0.0030 | NET NO AUTH LOW CX NO UI | A denial of service security issue exists in the affected product. The security | |
|
77
|
CVE-2026-32993 |
8.3 | 0.0030 | NET NO AUTH LOW CX NO UI | Improper sanitization of the `status` query parameter of the `/unprotected/nova_ | |
|
77
|
CVE-2026-56063 |
8.3 | 0.0030 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions. | |
|
77
|
CVE-2026-39455 |
8.7 | 0.0030 | NET NO AUTH LOW CX NO UI | When the BIG-IP Configuration utility is configured to use Lightweight Directory | |
|
76
|
CVE-2026-118262 |
8.2 | 0.0030 | NET NO AUTH LOW CX NO UI | Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy mid | |
|
76
|
CVE-2026-42273 |
7.8 | 0.0030 | NET NO AUTH LOW CX NO UI | Heimdall is a cloud native Identity Aware Proxy and Access Control Decision serv | |
|
76
|
CVE-2026-63573 |
8.2 | 0.0030 | NET NO AUTH LOW CX NO UI | Observable discrepancy in the CMS RSA PKCS#1 v1.5 key-transport unwrap (KeyTrans | |
|
75
|
CVE-2026-118083 |
7.5 | 0.0030 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions. | |
|
75
|
CVE-2026-25204 |
7.5 | 0.0030 | NET NO AUTH LOW CX NO UI | Deserialization of untrusted data vulnerability in Samsung Open Source Escargot | |
|
75
|
CVE-2026-28976 |
7.5 | 0.0030 | NET NO AUTH LOW CX NO UI | An information leakage was addressed with additional validation. This issue is f | |
|
75
|
CVE-2026-54840 |
7.3 | 0.0030 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Newsletters <= 4.13 versions. | |
|
75
|
CVE-2026-59535 |
7.3 | 0.0030 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Thrive Product Manager <= 10.9.2 versio | |
|
75
|
CVE-2026-65541 |
7.3 | 0.0030 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions. | |
|
75
|
CVE-2026-28188 |
7.3 | 0.0030 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions. | |
|
75
|
CVE-2025-65877 |
7.5 | 0.0030 | NET NO AUTH LOW CX NO UI | Lvzhou CMS before commit c4ea0eb9cab5f6739b2c87e77d9ef304017ed615 (2025-09-22) i | |
|
74
|
CVE-2026-96669 |
7.2 | 0.0030 | NET NO AUTH LOW CX NO UI | The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerabl | |
|
74
|
CVE-2026-115821 |
7.2 | 0.0030 | NET NO AUTH LOW CX NO UI | The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting | |
|
68
|
CVE-2026-7899 |
8.8 | 0.0030 | NET NO AUTH LOW CX | Out of bounds read and write in V8 in Google Chrome prior to 148.0.7778.96 allow | |
|
68
|
CVE-2026-8529 |
8.8 | 0.0030 | NET NO AUTH LOW CX | Heap buffer overflow in Codecs in Google Chrome prior to 148.0.7778.168 allowed | |
|
67
|
CVE-2026-83379 |
8.7 | 0.0030 | NET NO AUTH NO UI | Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusi | |
|
67
|
CVE-2026-87300 |
8.7 | 0.0030 | NET NO AUTH NO UI | Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusi | |
|
66
|
CVE-2026-34375 |
8.2 | 0.0030 | NET NO AUTH LOW CX | WWBN AVideo is an open source video platform. In versions up to and including 26 | |
|
65
|
CVE-2026-45373 |
7.4 | 0.0030 | NET NO AUTH LOW CX | CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, althou | |
|
65
|
CVE-2026-91450 |
7.4 | 0.0030 | NET NO AUTH NO UI | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone | |
|
65
|
CVE-2026-111460 |
7.7 | 0.0030 | NET NO AUTH LOW CX | A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Ser | |
|
65
|
CVE-2026-101783 |
7.4 | 0.0030 | NET NO AUTH NO UI | Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: Ge | |
|
65
|
CVE-2026-101829 |
7.4 | 0.0030 | NET NO AUTH NO UI | Vulnerability in the Oracle Mobile Application Server product of Oracle E-Busine | |
|
65
|
CVE-2026-87314 |
7.4 | 0.0030 | NET NO AUTH NO UI | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards | |
|
65
|
CVE-2026-91272 |
7.4 | 0.0030 | NET NO AUTH NO UI | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards | |
|
65
|
CVE-2026-111079 |
7.4 | 0.0030 | NET NO AUTH LOW CX | A flaw was found in Goose. When the terminal integration feature is enabled, the | |
|
65
|
CVE-2026-118763 |
7.4 | 0.0030 | NET NO AUTH LOW CX | sigstore-js provides JavaScript libraries for interacting with Sigstore services | |
|
57
|
CVE-2026-13025 |
8.3 | 0.0030 | NET NO AUTH | Race in DevTools in Google Chrome prior to 149.0.7827.197 allowed a remote attac | |
|
57
|
CVE-2026-13813 |
8.3 | 0.0030 | NET NO AUTH | Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior | |
|
57
|
CVE-2026-12437 |
8.3 | 0.0030 | NET NO AUTH | Use after free in WebShare in Google Chrome on Windows prior to 149.0.7827.155 a | |
|
55
|
CVE-2026-13824 |
7.5 | 0.0030 | NET NO AUTH | Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.78 | |
|
55
|
CVE-2026-13856 |
7.5 | 0.0030 | NET NO AUTH | Insufficient validation of untrusted input in Speech in Google Chrome on Android | |
|
55
|
CVE-2026-13891 |
7.5 | 0.0030 | NET NO AUTH | Insufficient validation of untrusted input in Extensions in Google Chrome prior | |
|
55
|
CVE-2026-14115 |
7.5 | 0.0030 | NET NO AUTH | Insufficient validation of untrusted input in Cast in Google Chrome prior to 150 | |
|
54
|
CVE-2026-54070 |
7.1 | 0.0030 | NET NO AUTH | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, r | |
|
54
|
CVE-2026-57918 |
7.1 | 0.0030 | NET NO AUTH | libnfs through 6.0.2 before 935b8db has an xid integer underflow in READ_IOVEC i |