Hunt List
8,454 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
78
|
CVE-2026-86414 |
9.1 | 0.0027 | NET NO AUTH LOW CX NO UI | An HTTP proxy can trick libcurl into sending the origin's credentials (Basic pas | |
|
78
|
CVE-2026-87861 |
9.1 | 0.0027 | NET NO AUTH LOW CX NO UI | When using ambient user credentials, an HTTP request directed to one origin may | |
|
78
|
CVE-2026-33771 |
9.1 | 0.0026 | NET NO AUTH LOW CX NO UI | A Weak Password Requirements vulnerability in the password management function o | |
|
78
|
CVE-2026-6512 |
9.1 | 0.0026 | NET NO AUTH LOW CX NO UI | The InfusedWoo Pro plugin for WordPress is vulnerable to authorization bypass in | |
|
77
|
CVE-2026-55206 |
8.7 | 0.0027 | NET NO AUTH LOW CX NO UI | py7zr is a Python-based library and utility to support 7zip archive compression, | |
|
77
|
CVE-2026-53591 |
8.6 | 0.0027 | NET NO AUTH LOW CX NO UI | FreeScout is a free help desk and shared inbox built with PHP's Laravel framewor | |
|
75
|
CVE-2026-27089 |
7.5 | 0.0027 | NET NO AUTH LOW CX NO UI | Unauthenticated Bypass Vulnerability in WpTravelly <= 2.1.7 versions. | |
|
75
|
CVE-2026-40069 |
7.5 | 0.0027 | NET NO AUTH LOW CX NO UI | BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.1.0 to before 0.8.2, | |
|
75
|
CVE-2026-44446 |
7.5 | 0.0027 | NET NO AUTH LOW CX NO UI | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15 | |
|
75
|
CVE-2026-57923 |
7.5 | 0.0027 | NET NO AUTH LOW CX NO UI | In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app conf | |
|
75
|
CVE-2026-43656 |
7.3 | 0.0027 | NET NO AUTH LOW CX NO UI | An out-of-bounds write issue was addressed with improved input validation. This | |
|
74
|
CVE-2026-57348 |
7.2 | 0.0027 | NET NO AUTH LOW CX NO UI | Unauthenticated Server Side Request Forgery (SSRF) in Paid Member Subscriptions | |
|
74
|
CVE-2026-57372 |
7.2 | 0.0027 | NET NO AUTH LOW CX NO UI | Server-Side Request Forgery (SSRF) vulnerability in denishua WPJAM Basic wpjam-b | |
|
74
|
CVE-2026-57407 |
7.2 | 0.0027 | NET NO AUTH LOW CX NO UI | Server-Side Request Forgery (SSRF) vulnerability in WP Swings PDF Generator for | |
|
74
|
CVE-2026-65516 |
7.2 | 0.0027 | NET NO AUTH LOW CX NO UI | Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice | |
|
74
|
CVE-2026-59552 |
7.2 | 0.0027 | NET NO AUTH LOW CX NO UI | Unauthenticated Server Side Request Forgery (SSRF) in 3D Flipbook PDF Viewer &am | |
|
74
|
CVE-2026-61953 |
7.2 | 0.0027 | NET NO AUTH LOW CX NO UI | Unauthenticated Server Side Request Forgery (SSRF) in Simple Link Directory Pro | |
|
74
|
CVE-2026-66704 |
7.2 | 0.0027 | NET NO AUTH LOW CX NO UI | Unauthenticated Server Side Request Forgery (SSRF) in Gutenverse Companion <= 2. | |
|
74
|
CVE-2026-32473 |
7.2 | 0.0027 | NET NO AUTH LOW CX NO UI | Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Eleme | |
|
74
|
CVE-2026-32553 |
7.2 | 0.0027 | NET NO AUTH LOW CX NO UI | Unauthenticated Server Side Request Forgery (SSRF) in OttoKit <= 1.1.35 versions | |
|
68
|
CVE-2026-6359 |
8.8 | 0.0027 | NET NO AUTH LOW CX | Use after free in Video in Google Chrome on Windows prior to 147.0.7727.101 allo | |
|
68
|
CVE-2026-91303 |
8.8 | 0.0027 | NET NO AUTH LOW CX | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards | |
|
68
|
CVE-2026-118315 |
8.8 | 0.0026 | NET NO AUTH LOW CX | Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed | |
|
68
|
CVE-2026-118334 |
8.8 | 0.0026 | NET NO AUTH LOW CX | Use after free in ImageCapture in Google Chrome prior to 156.0.8078.73 allowed a | |
|
68
|
CVE-2026-118335 |
8.8 | 0.0026 | NET NO AUTH LOW CX | Improper input validation in Metrics in Google Chrome on on Mac prior to 156.0.8 | |
|
68
|
CVE-2026-118338 |
8.8 | 0.0026 | NET NO AUTH LOW CX | Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a re | |
|
68
|
CVE-2026-118341 |
8.8 | 0.0026 | NET NO AUTH LOW CX | Use after free in Modularization in Google Chrome prior to 156.0.8078.73 allowed | |
|
68
|
CVE-2026-118343 |
8.8 | 0.0026 | NET NO AUTH LOW CX | Improper input validation in ReadingList in Google Chrome prior to 156.0.8078.73 | |
|
68
|
CVE-2026-118345 |
8.8 | 0.0026 | NET NO AUTH LOW CX | Use after free in PDFium in Google Chrome prior to 156.0.8078.73 allowed a remot | |
|
68
|
CVE-2026-118346 |
8.8 | 0.0026 | NET NO AUTH LOW CX | Use after free in Compositing in Google Chrome prior to 156.0.8078.73 allowed a | |
|
68
|
CVE-2026-118347 |
8.8 | 0.0026 | NET NO AUTH LOW CX | Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a r | |
|
68
|
CVE-2026-118349 |
8.8 | 0.0026 | NET NO AUTH LOW CX | Memory corruption in Payments in Google Chrome prior to 156.0.8078.73 allowed a | |
|
68
|
CVE-2026-118350 |
8.8 | 0.0026 | NET NO AUTH LOW CX | Use after free in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a rem | |
|
68
|
CVE-2026-118351 |
8.8 | 0.0026 | NET NO AUTH LOW CX | Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remo | |
|
68
|
CVE-2026-118352 |
8.8 | 0.0026 | NET NO AUTH LOW CX | Memory corruption in Cache in Google Chrome prior to 156.0.8078.73 allowed a rem | |
|
68
|
CVE-2026-118353 |
8.8 | 0.0026 | NET NO AUTH LOW CX | Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote | |
|
68
|
CVE-2026-118354 |
8.8 | 0.0026 | NET NO AUTH LOW CX | Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowe | |
|
68
|
CVE-2026-118356 |
8.8 | 0.0026 | NET NO AUTH LOW CX | Use after free in WTF in Google Chrome prior to 156.0.8078.73 allowed a remote a | |
|
68
|
CVE-2026-86467 |
8.8 | 0.0026 | NET NO AUTH LOW CX | Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not | |
|
67
|
CVE-2026-47135 |
8.7 | 0.0027 | NET NO AUTH NO UI | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, Symbol.fo | |
|
67
|
CVE-2026-41505 |
8.7 | 0.0026 | NET NO AUTH NO UI | RELATE is a web-based courseware package. Prior to commit 2f68e16, RELATE is vul | |
|
66
|
CVE-2026-41895 |
8.2 | 0.0027 | NET NO AUTH NO UI | changedetection.io is a free open source web page change detection tool. In 0.54 | |
|
66
|
CVE-2026-87863 |
8.1 | 0.0027 | NET NO AUTH NO UI | An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser | |
|
66
|
CVE-2026-91342 |
8.2 | 0.0027 | NET NO AUTH LOW CX | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl | |
|
65
|
CVE-2026-40585 |
7.4 | 0.0026 | NET NO AUTH NO UI | blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, when a p | |
|
55
|
CVE-2026-17898 |
7.5 | 0.0027 | NET NO AUTH | Use after free in DevTools in Google Chrome prior to 151.0.7922.72 allowed an at | |
|
55
|
CVE-2026-17948 |
7.5 | 0.0027 | NET NO AUTH | Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker | |
|
55
|
CVE-2026-19165 |
7.5 | 0.0027 | NET NO AUTH | Use after free in Extensions in Google Chrome prior to 151.0.7922.109 allowed an | |
|
55
|
CVE-2026-19558 |
7.5 | 0.0027 | NET NO AUTH | Use after free in Extensions in Google Chrome prior to 151.0.7922.137 allowed an | |
|
55
|
CVE-2026-46359 |
7.7 | 0.0026 | NET NO AUTH | phpMyFAQ before 4.1.2 contains a sql injection vulnerability in CurrentUser::set |