Hunt List
8,458 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-6760 |
9.8 | 0.0028 | NET NO AUTH LOW CX NO UI | Mitigation bypass in the Networking: Cookies component. This vulnerability was f | |
|
80
|
CVE-2026-42799 |
9.8 | 0.0028 | NET NO AUTH LOW CX NO UI | Out-of-bounds read vulnerability in ASR Kestrel (nr_fw modules) allows Overflow | |
|
80
|
CVE-2026-0126 |
9.8 | 0.0028 | NET NO AUTH LOW CX NO UI | In WC-Radio, there is a possible out of bounds write due to a missing bounds che | |
|
80
|
CVE-2026-115214 |
9.8 | 0.0028 | NET NO AUTH LOW CX NO UI | The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify th | |
|
80
|
CVE-2026-58663 |
9.8 | 0.0028 | NET NO AUTH LOW CX NO UI | An authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC servi | |
|
79
|
CVE-2026-41583 |
9.3 | 0.0028 | NET NO AUTH LOW CX NO UI | ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 an | |
|
78
|
CVE-2026-65583 |
9.1 | 0.0028 | NET NO AUTH LOW CX NO UI | Apache CXF’s OIDC relying-party token validation could accept self-issued ID tok | |
|
78
|
CVE-2026-9561 |
8.8 | 0.0028 | NET NO AUTH LOW CX NO UI | Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For H | |
|
78
|
CVE-2026-48881 |
9.1 | 0.0028 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in TrueBooker <= 1.1.9 versions. | |
|
78
|
CVE-2026-9487 |
9.1 | 0.0028 | NET NO AUTH LOW CX NO UI | XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID | |
|
77
|
CVE-2026-102556 |
8.6 | 0.0028 | NET NO AUTH LOW CX NO UI | A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, Sou | |
|
77
|
CVE-2026-102557 |
8.6 | 0.0028 | NET NO AUTH LOW CX NO UI | A flaw was found in libsoup. When reassembling fragmented WebSocket messages int | |
|
77
|
CVE-2026-110803 |
8.7 | 0.0028 | NET NO AUTH LOW CX NO UI | VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then read | |
|
77
|
CVE-2026-58051 |
8.3 | 0.0028 | NET NO AUTH LOW CX NO UI | libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not z | |
|
76
|
CVE-2026-45137 |
8.2 | 0.0028 | NET NO AUTH LOW CX NO UI | Anchor is a framework providing several convenient developer tools for writing S | |
|
76
|
CVE-2026-41416 |
8.1 | 0.0028 | NET NO AUTH LOW CX NO UI | PJSIP is a free and open source multimedia communication library written in C. I | |
|
76
|
CVE-2026-29139 |
7.8 | 0.0028 | NET NO AUTH LOW CX NO UI | SEPPmail Secure Email Gateway before version 15.0.3 allows account takeover by a | |
|
75
|
CVE-2026-61571 |
7.3 | 0.0028 | NET NO AUTH LOW CX NO UI | AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global a | |
|
75
|
CVE-2026-102941 |
7.5 | 0.0028 | NET NO AUTH LOW CX NO UI | The package github.com/gomarkdown/markdown is a Go library for parsing Markdown | |
|
75
|
CVE-2025-57835 |
7.5 | 0.0028 | NET NO AUTH LOW CX NO UI | An issue was discovered in RRC in Samsung Mobile Processor, Wearable Processor, | |
|
75
|
CVE-2025-59440 |
7.5 | 0.0028 | NET NO AUTH LOW CX NO UI | An issue was discovered in USIM in Samsung Mobile Processor, Wearable Processor, | |
|
75
|
CVE-2026-45290 |
7.5 | 0.0028 | NET NO AUTH LOW CX NO UI | Cloudburst Network provides network components used within Cloudburst projects. | |
|
75
|
CVE-2026-41708 |
7.5 | 0.0028 | NET NO AUTH LOW CX NO UI | In Spring Cloud Sleuth, it is possible for a user to provide specially crafted c | |
|
75
|
CVE-2026-42666 |
7.5 | 0.0028 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Salon booking system <= 10.30.25 versio | |
|
75
|
CVE-2026-48868 |
7.5 | 0.0028 | NET NO AUTH LOW CX NO UI | Unauthenticated Insecure Direct Object References (IDOR) in Simple Shopping Cart | |
|
75
|
CVE-2026-41896 |
7.5 | 0.0028 | NET NO AUTH LOW CX NO UI | Coolify is an open-source and self-hostable tool for managing servers, applicati | |
|
75
|
CVE-2026-41216 |
7.5 | 0.0028 | NET NO AUTH LOW CX NO UI | An invalid pointer dereference vulnerability exists in the vtkPNGReader::Execute | |
|
75
|
CVE-2026-42057 |
7.5 | 0.0028 | NET NO AUTH LOW CX NO UI | An invalid pointer dereference vulnerability exists in the vtkPNGReader::vtkPNGR | |
|
75
|
CVE-2026-31932 |
7.5 | 0.0028 | NET NO AUTH LOW CX NO UI | Suricata is a network IDS, IPS and NSM engine. Prior to versions 7.0.15 and 8.0. | |
|
75
|
CVE-2026-31934 |
7.5 | 0.0028 | NET NO AUTH LOW CX NO UI | Suricata is a network IDS, IPS and NSM engine. From version 8.0.0 to before vers | |
|
75
|
CVE-2026-31935 |
7.5 | 0.0028 | NET NO AUTH LOW CX NO UI | Suricata is a network IDS, IPS and NSM engine. Prior to versions 7.0.15 and 8.0. | |
|
75
|
CVE-2026-116613 |
7.5 | 0.0028 | NET NO AUTH LOW CX NO UI | The Animated Text Block plugin for WordPress is vulnerable to Sensitive Informat | |
|
74
|
CVE-2026-35140 |
7.2 | 0.0028 | NET NO AUTH LOW CX NO UI | HCL DFXAnalytics is affected by a Missing Secure Attribute in Encrypted Session | |
|
74
|
CVE-2026-116066 |
7.0 | 0.0028 | NET NO AUTH LOW CX NO UI | Firecrawl before 2.11.586 contains a server-side request forgery vulnerability i | |
|
69
|
CVE-2026-9739 |
9.4 | 0.0028 | NET NO AUTH LOW CX | Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During | |
|
69
|
CVE-2026-14044 |
9.6 | 0.0028 | NET NO AUTH LOW CX | Use after free in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote | |
|
68
|
CVE-2026-8532 |
8.8 | 0.0028 | NET NO AUTH LOW CX | Integer overflow in XML in Google Chrome prior to 148.0.7778.168 allowed a remot | |
|
68
|
CVE-2026-8544 |
8.8 | 0.0028 | NET NO AUTH LOW CX | Use after free in Media in Google Chrome prior to 148.0.7778.168 allowed a remot | |
|
68
|
CVE-2026-8549 |
8.8 | 0.0028 | NET NO AUTH LOW CX | Use after free in Media in Google Chrome prior to 148.0.7778.168 allowed a remot | |
|
68
|
CVE-2026-8551 |
8.8 | 0.0028 | NET NO AUTH LOW CX | Use after free in Downloads in Google Chrome prior to 148.0.7778.168 allowed a r | |
|
68
|
CVE-2026-8555 |
8.8 | 0.0028 | NET NO AUTH LOW CX | Use after free in GTK in Google Chrome on Windows prior to 148.0.7778.168 allowe | |
|
68
|
CVE-2026-16365 |
8.8 | 0.0028 | NET NO AUTH LOW CX | Privilege escalation in the DOM: Workers component. This vulnerability was fixed | |
|
68
|
CVE-2026-86794 |
8.8 | 0.0028 | NET NO AUTH LOW CX | The Community Events WordPress plugin before 1.6.0 does not have authorisation o | |
|
67
|
CVE-2026-119127 |
8.6 | 0.0028 | NET NO AUTH LOW CX | ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in th | |
|
67
|
CVE-2026-109346 |
8.5 | 0.0028 | NET NO AUTH LOW CX | better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation | |
|
66
|
CVE-2026-86016 |
8.2 | 0.0028 | NET NO AUTH LOW CX | VNote is a note-taking platform. Prior to 4.3.0, VNote uses the assignment `preN | |
|
66
|
CVE-2026-93570 |
8.2 | 0.0028 | NET NO AUTH LOW CX | Szafir and Szafir Weryfikująca are vulnerable to XML External Entity (XXE) injec | |
|
66
|
CVE-2026-116174 |
8.2 | 0.0028 | NET NO AUTH NO UI | vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerabili | |
|
65
|
CVE-2026-45310 |
7.4 | 0.0028 | NET NO AUTH LOW CX | CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.22, the fe | |
|
64
|
CVE-2026-116814 |
7.1 | 0.0028 | NET NO AUTH LOW CX | OpenPanel before 3.0.0 contains an information exposure vulnerability that write |