Hunt List
8,459 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-43914 |
9.8 | 0.0029 | NET NO AUTH LOW CX NO UI | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, t | |
|
80
|
CVE-2026-6768 |
9.8 | 0.0029 | NET NO AUTH LOW CX NO UI | Mitigation bypass in the Networking: Cookies component. This vulnerability was f | |
|
80
|
CVE-2026-16387 |
9.8 | 0.0028 | NET NO AUTH LOW CX NO UI | Site isolation issue in the Networking component. This vulnerability was fixed i | |
|
78
|
CVE-2026-56388 |
9.1 | 0.0029 | NET NO AUTH LOW CX NO UI | The Redis server command parser in Apache bRPC accepts an empty RESP array as a | |
|
77
|
CVE-2026-33782 |
8.7 | 0.0029 | NET NO AUTH LOW CX NO UI | A Missing Release of Memory after Effective Lifetime vulnerability in the DHCP d | |
|
77
|
CVE-2026-33893 |
8.7 | 0.0029 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in Teamcenter V2312 (All versions < V2312.00 | |
|
77
|
CVE-2026-47209 |
8.6 | 0.0029 | NET NO AUTH LOW CX NO UI | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the BaseH | |
|
77
|
CVE-2026-91267 |
8.6 | 0.0029 | NET NO AUTH LOW CX NO UI | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards | |
|
77
|
CVE-2026-113387 |
8.6 | 0.0029 | NET NO AUTH LOW CX NO UI | The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration | |
|
76
|
CVE-2026-53801 |
8.2 | 0.0029 | NET NO AUTH LOW CX NO UI | rsync before 3.5.0 contains a symlink race condition vulnerability in the sender | |
|
75
|
CVE-2026-43977 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | wger is a free, open-source workout and fitness manager. In versions prior to 2. | |
|
75
|
CVE-2026-33710 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, RE | |
|
75
|
CVE-2026-6022 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | In Progress® Telerik® UI for AJAX prior to 2026.1.421, RadAsyncUpload contains a | |
|
75
|
CVE-2026-12317 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Fire | |
|
75
|
CVE-2026-40768 |
7.3 | 0.0029 | NET NO AUTH LOW CX NO UI | Unauthenticated Insecure Direct Object References (IDOR) in Salon booking system | |
|
75
|
CVE-2026-91502 |
7.3 | 0.0029 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware | |
|
75
|
CVE-2025-63663 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | Incorrect access control in the /api/v1/conversations/*/files API of GT Edge AI | |
|
75
|
CVE-2024-24844 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | Missing Authorization vulnerability in IdeaBox Creations PowerPack Pro for Eleme | |
|
75
|
CVE-2026-40767 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in wpForo Forum < 3.0.2 versions. | |
|
75
|
CVE-2026-82987 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | There exists a screen capture endpoint in vCast media streaming service in ViewS | |
|
75
|
CVE-2026-91664 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | Vulnerability in Oracle Essbase (component: Security). The supported version t | |
|
75
|
CVE-2026-40461 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | Anviz CX2 Lite and CX7 are vulnerable to unauthenticated POST requests that modi | |
|
75
|
CVE-2026-32665 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-ove | |
|
74
|
CVE-2026-44246 |
7.2 | 0.0029 | NET NO AUTH LOW CX NO UI | nnU-Net is a semantic segmentation framework that automatically adapts its pipel | |
|
69
|
CVE-2026-6919 |
9.6 | 0.0029 | NET NO AUTH LOW CX | Use after free in DevTools in Google Chrome prior to 147.0.7727.117 allowed a re | |
|
68
|
CVE-2026-111585 |
8.8 | 0.0029 | NET NO AUTH LOW CX | An integer overflow in the remote-control screen processing component of TeamVie | |
|
68
|
CVE-2026-12007 |
8.8 | 0.0029 | NET NO AUTH LOW CX | Use after free in Core in Google Chrome on Windows prior to 149.0.7827.115 allow | |
|
68
|
CVE-2026-119128 |
9.1 | 0.0029 | NET NO AUTH NO UI | ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in t | |
|
68
|
CVE-2026-52705 |
9.0 | 0.0029 | NET NO AUTH NO UI | Unauthenticated Arbitrary File Upload in SigmaForms Pro – AI Generated Forms <= | |
|
68
|
CVE-2026-6358 |
8.8 | 0.0029 | NET NO AUTH LOW CX | Use after free in XR in Google Chrome on Android prior to 147.0.7727.101 allowed | |
|
67
|
CVE-2026-41445 |
8.7 | 0.0029 | NET NO AUTH LOW CX | KissFFT before commit 8a8e66e contains an integer overflow vulnerability in the | |
|
67
|
CVE-2026-65056 |
8.3 | 0.0029 | NET NO AUTH LOW CX | mcp-webresearch 0.1.7 contains a server-side request forgery vulnerability that | |
|
66
|
CVE-2026-14122 |
8.1 | 0.0029 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on | |
|
66
|
CVE-2026-40905 |
8.1 | 0.0029 | NET NO AUTH LOW CX | LinkAce is a self-hosted archive to collect website links. Prior to 2.5.4, a pas | |
|
66
|
CVE-2026-13864 |
8.1 | 0.0029 | NET NO AUTH NO UI | Insufficient policy enforcement in WebHID in Google Chrome prior to 150.0.7871.4 | |
|
66
|
CVE-2025-11713 |
8.1 | 0.0029 | NET NO AUTH LOW CX | Insufficient escaping in the “Copy as cURL” feature could have been used to tric | |
|
66
|
CVE-2026-94262 |
8.1 | 0.0029 | NET NO AUTH NO UI | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced C | |
|
66
|
CVE-2026-58205 |
8.1 | 0.0029 | NET NO AUTH LOW CX | GRR is a resource management and reservation application. Prior to version 4.5.0 | |
|
66
|
CVE-2026-47304 |
8.1 | 0.0029 | NET NO AUTH NO UI | Improper verification of cryptographic signature in .NET allows an unauthorized | |
|
65
|
CVE-2026-50091 |
7.4 | 0.0029 | NET NO AUTH NO UI | Aqara Home Android (com.lumiunited.aqarahome) 6.0.0 (and white-label clients emb | |
|
65
|
CVE-2026-61791 |
7.4 | 0.0029 | NET NO AUTH LOW CX | OCO-Server is a self-hosted endpoint management application for computer invento | |
|
65
|
CVE-2026-55603 |
7.5 | 0.0029 | NET NO AUTH NO UI | http-proxy-middleware is node.js http-proxy middleware. From 3.0.4 until 3.0.7 a | |
|
65
|
CVE-2026-7830 |
7.4 | 0.0029 | NET NO AUTH NO UI | UltraVNC through 1.8.2.2 uses inadequate cryptography in the MS-Logon II authent | |
|
64
|
CVE-2026-39977 |
7.1 | 0.0029 | NET NO AUTH LOW CX | flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1. | |
|
64
|
CVE-2026-109943 |
7.1 | 0.0029 | NET NO AUTH LOW CX | FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update | |
|
64
|
CVE-2026-109944 |
7.1 | 0.0029 | NET NO AUTH LOW CX | FreeRDP 3.0.0 before 3.32.0 does not remove card handles when Emulate_SCardRelea | |
|
55
|
CVE-2026-17979 |
7.5 | 0.0029 | NET NO AUTH | Race in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to | |
|
55
|
CVE-2026-101797 |
7.5 | 0.0029 | NET NO AUTH | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon | |
|
55
|
CVE-2026-42850 |
7.4 | 0.0029 | NET NO AUTH | Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, it is | |
|
55
|
CVE-2026-101796 |
7.5 | 0.0029 | NET NO AUTH | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon |