Hunt List
8,463 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-16375 |
9.8 | 0.0029 | NET NO AUTH LOW CX NO UI | Site isolation issue in the Networking: HTTP component. This vulnerability was f | |
|
80
|
CVE-2026-50086 |
9.8 | 0.0029 | NET NO AUTH LOW CX NO UI | The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes bidirectional AES round | |
|
79
|
CVE-2026-39502 |
9.3 | 0.0029 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions. | |
|
79
|
CVE-2026-45439 |
9.3 | 0.0029 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in Realtyna Organic IDX plugin <= 5.1.0 versions. | |
|
79
|
CVE-2026-49067 |
9.3 | 0.0029 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in Advanced 301 and 302 Redirect <= 1.6.9 versions | |
|
79
|
CVE-2026-49776 |
9.3 | 0.0029 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for W | |
|
79
|
CVE-2026-52693 |
9.3 | 0.0029 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in eCommerce Product Catalog <= 3.5.5 versions. | |
|
79
|
CVE-2026-54186 |
9.3 | 0.0029 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in JobSearch <= 3.2.9 versions. | |
|
78
|
CVE-2026-49002 |
9.1 | 0.0029 | NET NO AUTH LOW CX NO UI | Access control failure means that an application does not effectively check user | |
|
78
|
CVE-2026-116211 |
8.8 | 0.0029 | NET NO AUTH LOW CX NO UI | YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManage | |
|
78
|
CVE-2026-13872 |
9.1 | 0.0029 | NET NO AUTH LOW CX NO UI | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on | |
|
78
|
CVE-2025-66844 |
9.1 | 0.0029 | NET NO AUTH LOW CX NO UI | In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered | |
|
78
|
CVE-2024-25181 |
9.1 | 0.0029 | NET NO AUTH LOW CX NO UI | A critical vulnerability has been identified in givanz VvvebJs 1.7.2, which allo | |
|
78
|
CVE-2026-12205 |
9.1 | 0.0029 | NET NO AUTH LOW CX NO UI | Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, lea | |
|
77
|
CVE-2026-59248 |
8.7 | 0.0029 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits vulnerability in ninenines cowlib allows | |
|
77
|
CVE-2026-116177 |
8.7 | 0.0029 | NET NO AUTH LOW CX NO UI | vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vul | |
|
76
|
CVE-2026-6866 |
8.2 | 0.0029 | NET NO AUTH LOW CX NO UI | CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exi | |
|
76
|
CVE-2026-49081 |
8.2 | 0.0029 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 vers | |
|
75
|
CVE-2026-42384 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in Simply Schedule Appointments < 1.6.11 | |
|
75
|
CVE-2026-49066 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in Conekta Payment Gateway <= 6.0.0 vers | |
|
75
|
CVE-2026-33359 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | In Meari IoT Cloud alert image storage on Alibaba OSS (latest observed; storage | |
|
75
|
CVE-2026-40691 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received o | |
|
75
|
CVE-2026-118035 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027 | |
|
75
|
CVE-2026-42760 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | Authentication Bypass Using an Alternate Path or Channel vulnerability in revmak | |
|
75
|
CVE-2026-100517 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | Authorization Bypass Through User-Controlled Key vulnerability in VillaTheme Pho | |
|
74
|
CVE-2026-43874 |
7.2 | 0.0029 | NET NO AUTH LOW CX NO UI | WWBN AVideo is an open source video platform. In versions up to and including 29 | |
|
74
|
CVE-2026-109999 |
7.2 | 0.0029 | NET NO AUTH LOW CX NO UI | The AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer | |
|
69
|
CVE-2026-14387 |
9.6 | 0.0029 | NET NO AUTH LOW CX | Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remot | |
|
68
|
CVE-2026-98374 |
8.8 | 0.0029 | NET NO AUTH LOW CX | In the Linux kernel, the following vulnerability has been resolved: tcp: fix us | |
|
68
|
CVE-2026-7927 |
8.8 | 0.0029 | NET NO AUTH LOW CX | Type Confusion in Runtime in Google Chrome prior to 148.0.7778.96 allowed a remo | |
|
68
|
CVE-2026-7957 |
8.8 | 0.0029 | NET NO AUTH LOW CX | Out of bounds write in Media in Google Chrome on Mac, iOS prior to 148.0.7778.96 | |
|
68
|
CVE-2026-8527 |
8.8 | 0.0029 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Downloads in Google Chrome prior t | |
|
68
|
CVE-2026-6363 |
8.8 | 0.0029 | NET NO AUTH LOW CX | Type Confusion in V8 in Google Chrome prior to 147.0.7727.101 allowed a remote a | |
|
67
|
CVE-2026-6819 |
8.7 | 0.0029 | NET NO AUTH LOW CX | HKUDS OpenHarness prior to PR #156 remediation exposes plugin lifecycle commands | |
|
66
|
CVE-2026-107928 |
8.1 | 0.0029 | NET NO AUTH NO UI | When curl is built with GnuTLS, a malicious WebSocket server can make curl send | |
|
66
|
CVE-2026-46920 |
8.1 | 0.0029 | NET NO AUTH NO UI | Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM | |
|
66
|
CVE-2026-13974 |
8.1 | 0.0029 | NET NO AUTH LOW CX | Integer overflow in Safe Browsing in Google Chrome on Mac prior to 150.0.7871.47 | |
|
65
|
CVE-2026-50631 |
7.4 | 0.0029 | NET NO AUTH NO UI | A race condition in AbstractOAuthDataProvider allows concurrent requests using t | |
|
65
|
CVE-2023-36749 |
7.4 | 0.0029 | NET NO AUTH NO UI | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.1 | |
|
64
|
CVE-2026-17750 |
7.1 | 0.0029 | NET NO AUTH LOW CX | Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote | |
|
64
|
CVE-2026-46999 |
7.0 | 0.0029 | NET NO AUTH NO UI | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle E | |
|
64
|
CVE-2026-70676 |
7.0 | 0.0029 | NET NO AUTH NO UI | Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyper | |
|
64
|
CVE-2026-95713 |
7.0 | 0.0029 | NET NO AUTH NO UI | An unauthenticated buffer overflow vulnerability exists in the command line inte | |
|
64
|
CVE-2026-60705 |
7.0 | 0.0029 | NET NO AUTH NO UI | Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM | |
|
64
|
CVE-2025-10527 |
7.1 | 0.0029 | NET NO AUTH LOW CX | Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This v | |
|
57
|
CVE-2026-15774 |
8.3 | 0.0029 | NET NO AUTH | Use after free in Skia in Google Chrome prior to 150.0.7871.125 allowed a remote | |
|
55
|
CVE-2026-6308 |
7.5 | 0.0029 | NET NO AUTH | Out of bounds read in Media in Google Chrome prior to 147.0.7727.101 allowed a r | |
|
55
|
CVE-2026-6319 |
7.5 | 0.0029 | NET NO AUTH | Use after free in Payments in Google Chrome on Android prior to 147.0.7727.101 a | |
|
55
|
CVE-2026-17816 |
7.5 | 0.0029 | NET NO AUTH | Insufficient policy enforcement in Speech in Google Chrome on Android prior to 1 | |
|
55
|
CVE-2026-105972 |
7.5 | 0.0029 | NET NO AUTH | The Menu Cart for WooCommerce WordPress plugin before 3.2.1 does not sanitise an |