Hunt List
8,477 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-29200 |
9.9 | 0.0030 | NET NO AUTH LOW CX NO UI | A critical IDOR vulnerability has been discovered in Comet Backup affecting all | |
|
80
|
CVE-2026-62643 |
10.0 | 0.0029 | NET NO AUTH LOW CX NO UI | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascadin | |
|
80
|
CVE-2026-15721 |
9.8 | 0.0029 | NET NO AUTH LOW CX NO UI | Cleartext storage of sensitive information vulnerability in Bilin Software and I | |
|
79
|
CVE-2026-75832 |
9.3 | 0.0030 | NET NO AUTH LOW CX NO UI | The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before vers | |
|
79
|
CVE-2026-39530 |
9.3 | 0.0030 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in SpeakOut! Email Petitions <= 4.6.5 versions. | |
|
79
|
CVE-2026-46395 |
9.3 | 0.0029 | NET NO AUTH LOW CX NO UI | HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to ve | |
|
79
|
CVE-2026-39511 |
9.3 | 0.0029 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions. | |
|
79
|
CVE-2026-42727 |
9.3 | 0.0029 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
78
|
CVE-2024-34324 |
9.1 | 0.0030 | NET NO AUTH LOW CX NO UI | An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a se | |
|
78
|
CVE-2026-18353 |
8.8 | 0.0030 | NET NO AUTH LOW CX NO UI | PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its **unve | |
|
78
|
CVE-2026-111804 |
8.8 | 0.0030 | NET NO AUTH LOW CX NO UI | Apache Traffic Server's experimental wasm plugin has a use-after-free in its tra | |
|
78
|
CVE-2026-48242 |
9.2 | 0.0030 | NET NO AUTH LOW CX NO UI | Open ISES Tickets before 3.44.2 contains hardcoded MySQL database connection cre | |
|
78
|
CVE-2026-30803 |
8.8 | 0.0030 | NET NO AUTH LOW CX NO UI | Integer Underflow (Wrap or Wraparound) vulnerability in RTI Connext Micro (Core | |
|
78
|
CVE-2026-34184 |
8.8 | 0.0029 | NET NO AUTH LOW CX NO UI | AlanWeb SCADA does not enforce authorization for some directories. This allows a | |
|
77
|
CVE-2026-114597 |
8.7 | 0.0030 | NET NO AUTH LOW CX NO UI | In EPICS Base release 7.0.10 and prior, an insufficient validation of element or | |
|
77
|
CVE-2026-114598 |
8.7 | 0.0030 | NET NO AUTH LOW CX NO UI | In EPICS Base release 7.0.10 and prior, an insufficient validation of element or | |
|
77
|
CVE-2026-64619 |
8.7 | 0.0029 | NET NO AUTH LOW CX NO UI | FileCodeBox before 2.4 contains a rate-limit bypass vulnerability in the IPRateL | |
|
77
|
CVE-2026-67198 |
8.7 | 0.0029 | NET NO AUTH LOW CX NO UI | Perspective 5.0.0 contains a denial-of-service vulnerability in the VirtualServe | |
|
76
|
CVE-2026-11848 |
7.9 | 0.0030 | NET NO AUTH LOW CX NO UI | The iRM-IEI Remote Management developed by IEI Integration Corp has a Missing Au | |
|
76
|
CVE-2026-63770 |
8.2 | 0.0029 | NET NO AUTH LOW CX NO UI | Glance through 0.8.5 contains an IP address spoofing vulnerability in the authen | |
|
76
|
CVE-2026-103601 |
8.2 | 0.0029 | NET NO AUTH LOW CX NO UI | Release of unverified plaintext in the CCM (CcmBlockCipher) and DSTU 7624 CCM (K | |
|
76
|
CVE-2026-114117 |
8.2 | 0.0029 | NET NO AUTH LOW CX NO UI | Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.v | |
|
75
|
CVE-2026-57921 |
7.5 | 0.0030 | NET NO AUTH LOW CX NO UI | In JetBrains YouTrack before 2026.2.16593 improper access control allowed readin | |
|
75
|
CVE-2026-92546 |
7.5 | 0.0030 | NET NO AUTH LOW CX NO UI | Authentication bypass by spoofing vulnerability in Keepnet Labs Cybersecurity In | |
|
75
|
CVE-2026-33266 |
7.5 | 0.0030 | NET NO AUTH LOW CX NO UI | Use of Hard-coded Cryptographic Key vulnerability in Apache OpenMeetings. The r | |
|
75
|
CVE-2026-35597 |
7.5 | 0.0030 | NET NO AUTH LOW CX NO UI | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, | |
|
75
|
CVE-2026-49057 |
7.5 | 0.0030 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in JobSearch <= 3.2.7 versions. | |
|
75
|
CVE-2026-6780 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | Denial-of-service in the Audio/Video: Playback component. This vulnerability was | |
|
75
|
CVE-2026-6781 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | Denial-of-service in the Audio/Video: Playback component. This vulnerability was | |
|
75
|
CVE-2026-40789 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in Amelia <= 2.2 versions. | |
|
74
|
CVE-2026-96666 |
7.2 | 0.0030 | NET NO AUTH LOW CX NO UI | The Schema App Structured Data plugin for WordPress is vulnerable to Stored Cros | |
|
74
|
CVE-2026-114639 |
7.0 | 0.0029 | NET NO AUTH LOW CX NO UI | Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication | |
|
69
|
CVE-2026-53662 |
9.6 | 0.0030 | NET NO AUTH LOW CX | immich is a high performance self-hosted photo and video management solution. Fr | |
|
69
|
CVE-2026-118316 |
9.6 | 0.0029 | NET NO AUTH LOW CX | Improper input validation in V8 in Google Chrome prior to 156.0.8078.73 allowed | |
|
69
|
CVE-2026-118332 |
9.6 | 0.0029 | NET NO AUTH LOW CX | Improper input validation in Compositing in Google Chrome prior to 156.0.8078.73 | |
|
69
|
CVE-2026-118342 |
9.6 | 0.0029 | NET NO AUTH LOW CX | Out of bounds write in Editing in Google Chrome prior to 156.0.8078.73 allowed a | |
|
69
|
CVE-2026-118355 |
9.6 | 0.0029 | NET NO AUTH LOW CX | Improper input validation in Command in Google Chrome prior to 156.0.8078.73 all | |
|
68
|
CVE-2026-43215 |
8.8 | 0.0030 | NET NO AUTH LOW CX | In the Linux kernel, the following vulnerability has been resolved: cifs: Fix l | |
|
68
|
CVE-2026-13850 |
8.8 | 0.0029 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on | |
|
66
|
CVE-2026-49825 |
8.2 | 0.0030 | NET NO AUTH LOW CX | lxml is a library for processing XML and HTML in the Python language. Prior to 6 | |
|
66
|
CVE-2026-92709 |
8.1 | 0.0030 | NET NO AUTH NO UI | Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.26 | |
|
66
|
CVE-2026-65895 |
8.2 | 0.0029 | NET NO AUTH NO UI | Grav API Plugin versions before 1.0.10 fail to restrict write access to security | |
|
65
|
CVE-2026-114616 |
7.4 | 0.0030 | NET NO AUTH NO UI | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior | |
|
65
|
CVE-2026-48743 |
7.5 | 0.0030 | NET NO AUTH NO UI | Envoy is an open source edge and service proxy designed for cloud-native applica | |
|
65
|
CVE-2026-33667 |
7.4 | 0.0030 | NET NO AUTH NO UI | OpenProject is an open-source project management application. In versions prior | |
|
65
|
CVE-2026-48505 |
7.4 | 0.0030 | NET NO AUTH NO UI | Filament is a collection of full-stack components for accelerated Laravel develo | |
|
65
|
CVE-2026-73086 |
7.4 | 0.0030 | NET NO AUTH NO UI | nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Pri | |
|
64
|
CVE-2026-61449 |
7.1 | 0.0030 | NET NO AUTH LOW CX | Grav 2.0.1 contains a decompression-bomb size-cap bypass in ZipArchiver and GPM\ | |
|
64
|
CVE-2026-101450 |
7.1 | 0.0030 | NET NO AUTH LOW CX | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS | |
|
64
|
CVE-2026-67618 |
7.1 | 0.0029 | NET NO AUTH LOW CX | marimo before 0.23.15 contains a configuration injection vulnerability that allo |