Hunt List
8,453 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-3325 |
10.0 | 0.0027 | NET NO AUTH LOW CX NO UI | SQL injection (SQLi) in MegaCMS v12.0.0, specifically in the “id_territorio” par | |
|
80
|
CVE-2026-81212 |
10.0 | 0.0027 | NET NO AUTH LOW CX NO UI | IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to pe | |
|
79
|
CVE-2026-39324 |
9.3 | 0.0027 | NET NO AUTH LOW CX NO UI | Rack::Session is a session management implementation for Rack. From 2.0.0 to bef | |
|
79
|
CVE-2026-46912 |
9.3 | 0.0027 | NET NO AUTH LOW CX NO UI | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards | |
|
79
|
CVE-2026-72785 |
9.3 | 0.0027 | NET NO AUTH LOW CX NO UI | Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerabi | |
|
78
|
CVE-2026-69082 |
8.8 | 0.0027 | NET NO AUTH LOW CX NO UI | CTI-Transmute contained a cross-site request forgery vulnerability in the admini | |
|
78
|
CVE-2024-58393 |
8.8 | 0.0027 | NET NO AUTH LOW CX NO UI | i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQ | |
|
78
|
CVE-2026-40910 |
9.1 | 0.0027 | NET NO AUTH LOW CX NO UI | frp is a fast reverse proxy. From 0.43.0 to 0.68.0, frp contains an authenticati | |
|
78
|
CVE-2026-94423 |
9.1 | 0.0027 | NET NO AUTH LOW CX NO UI | Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server | |
|
78
|
CVE-2026-12681 |
8.9 | 0.0027 | NET NO AUTH LOW CX NO UI | Improper Validation of Specified Index, Position, or Offset in Input vulnerabili | |
|
77
|
CVE-2026-112355 |
8.7 | 0.0027 | NET NO AUTH LOW CX NO UI | The MembershipWorks plugin for WordPress before 6.17 contains an information dis | |
|
76
|
CVE-2026-91625 |
8.2 | 0.0027 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Agile Product Lifecycle Management for Process produ | |
|
76
|
CVE-2026-43929 |
8.2 | 0.0027 | NET NO AUTH LOW CX NO UI | ssrfcheck is a library that checks if a string contains a potential SSRF attack. | |
|
76
|
CVE-2026-41879 |
8.2 | 0.0027 | NET NO AUTH LOW CX NO UI | R-SOFT DMS stores superadmin credentials using a non-salted nested MD5 hash. Thi | |
|
75
|
CVE-2026-6514 |
7.5 | 0.0027 | NET NO AUTH LOW CX NO UI | The InfusedWoo Pro plugin for WordPress is vulnerable to Arbitrary File Read in | |
|
75
|
CVE-2026-43660 |
7.5 | 0.0027 | NET NO AUTH LOW CX NO UI | A validation issue was addressed with improved logic. This issue is fixed in Saf | |
|
75
|
CVE-2026-17698 |
7.5 | 0.0027 | NET NO AUTH LOW CX NO UI | Insufficient validation of untrusted input in UI in Google Chrome on Android pri | |
|
75
|
CVE-2026-10696 |
7.5 | 0.0027 | NET NO AUTH LOW CX NO UI | Use of an incorrectly resolved name or reference in the pinget backend in Devol | |
|
75
|
CVE-2026-44413 |
7.5 | 0.0027 | NET NO AUTH LOW CX NO UI | In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose s | |
|
75
|
CVE-2026-4870 |
7.5 | 0.0027 | NET NO AUTH LOW CX NO UI | IBM Qiskit SDK 0.43.0 through 2.5.0 could allow an attacker to trigger a segment | |
|
75
|
CVE-2026-0136 |
7.5 | 0.0027 | NET NO AUTH LOW CX NO UI | In Modem, there is a possible out of bounds read due to a missing bounds check. | |
|
75
|
CVE-2026-0144 |
7.5 | 0.0027 | NET NO AUTH LOW CX NO UI | In writeAocCommand of AocAudioCodec.cpp, there is a possible memory safety issue | |
|
75
|
CVE-2026-118039 |
7.5 | 0.0027 | NET NO AUTH LOW CX NO UI | In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027 | |
|
75
|
CVE-2026-42585 |
7.5 | 0.0027 | NET NO AUTH LOW CX NO UI | Netty is an asynchronous, event-driven network application framework. Prior to 4 | |
|
75
|
CVE-2026-27089 |
7.5 | 0.0027 | NET NO AUTH LOW CX NO UI | Unauthenticated Bypass Vulnerability in WpTravelly <= 2.1.7 versions. | |
|
69
|
CVE-2026-33875 |
9.3 | 0.0027 | NET NO AUTH LOW CX | Gematik Authenticator securely authenticates users for login to digital health a | |
|
69
|
CVE-2026-12048 |
9.3 | 0.0027 | NET NO AUTH LOW CX | Stored cross-site scripting in pgAdmin 4's error-rendering and plan-node-renderi | |
|
69
|
CVE-2026-14411 |
9.6 | 0.0027 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 15 | |
|
68
|
CVE-2026-28813 |
8.8 | 0.0027 | NET NO AUTH LOW CX | Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to cs | |
|
68
|
CVE-2026-42559 |
8.8 | 0.0027 | NET NO AUTH LOW CX | RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1. | |
|
68
|
CVE-2026-115693 |
9.1 | 0.0027 | NET NO AUTH NO UI | Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney | |
|
68
|
CVE-2026-7901 |
8.8 | 0.0027 | NET NO AUTH LOW CX | Use after free in ANGLE in Google Chrome on Mac prior to 148.0.7778.96 allowed a | |
|
68
|
CVE-2026-7906 |
8.8 | 0.0027 | NET NO AUTH LOW CX | Use after free in SVG in Google Chrome prior to 148.0.7778.96 allowed a remote a | |
|
68
|
CVE-2026-7907 |
8.8 | 0.0027 | NET NO AUTH LOW CX | Use after free in DOM in Google Chrome prior to 148.0.7778.96 allowed a remote a | |
|
68
|
CVE-2026-7921 |
8.8 | 0.0027 | NET NO AUTH LOW CX | Use after free in Passwords in Google Chrome prior to 148.0.7778.96 allowed a re | |
|
68
|
CVE-2026-7926 |
8.8 | 0.0027 | NET NO AUTH LOW CX | Use after free in PresentationAPI in Google Chrome prior to 148.0.7778.96 allowe | |
|
68
|
CVE-2026-7938 |
8.8 | 0.0027 | NET NO AUTH LOW CX | Use after free in CSS in Google Chrome prior to 148.0.7778.96 allowed a remote a | |
|
68
|
CVE-2026-7974 |
8.8 | 0.0027 | NET NO AUTH LOW CX | Use after free in Blink in Google Chrome prior to 148.0.7778.96 allowed a remote | |
|
68
|
CVE-2026-7984 |
8.8 | 0.0027 | NET NO AUTH LOW CX | Use after free in ReadingMode in Google Chrome prior to 148.0.7778.96 allowed a | |
|
67
|
CVE-2026-66298 |
8.6 | 0.0027 | NET NO AUTH LOW CX | Origin Validation Error vulnerability in livebook-dev livebook allows untrusted | |
|
66
|
CVE-2026-91506 |
8.1 | 0.0027 | NET NO AUTH NO UI | Vulnerability in the Workflow product of Oracle E-Business Suite (component: Wor | |
|
65
|
CVE-2026-118682 |
7.7 | 0.0027 | NET NO AUTH LOW CX | KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by defau | |
|
64
|
CVE-2026-41576 |
7.1 | 0.0027 | NET NO AUTH LOW CX | Brave CMS is an open-source CMS. Prior to commit 6c56603, the contact form is pu | |
|
64
|
CVE-2026-58476 |
7.0 | 0.0027 | NET NO AUTH LOW CX | Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a cross-si | |
|
64
|
CVE-2026-60494 |
7.0 | 0.0027 | NET NO AUTH NO UI | Vulnerability in the JD Edwards EnterpriseOne General Ledger product of Oracle J | |
|
64
|
CVE-2026-54056 |
7.1 | 0.0027 | NET NO AUTH LOW CX | Kitty is a cross-platform GPU based terminal. In versions 0.47.0 and 0.47.1, `ki | |
|
57
|
CVE-2026-16413 |
8.3 | 0.0027 | NET NO AUTH | Out of bounds write in ANGLE in Google Chrome prior to 150.0.7871.182 allowed a | |
|
57
|
CVE-2026-6314 |
8.3 | 0.0027 | NET NO AUTH | Out of bounds write in GPU in Google Chrome prior to 147.0.7727.101 allowed a re | |
|
57
|
CVE-2026-8530 |
8.3 | 0.0027 | NET NO AUTH | Use after free in Network in Google Chrome on Windows prior to 148.0.7778.168 al | |
|
55
|
CVE-2026-12462 |
7.5 | 0.0027 | NET NO AUTH | Use after free in Media in Google Chrome prior to 149.0.7827.155 allowed a remot |