Hunt List
8,216 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-18847 |
9.8 | 0.0025 | NET NO AUTH LOW CX NO UI | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to ha | |
|
79
|
CVE-2026-81694 |
9.3 | 0.0025 | NET NO AUTH LOW CX NO UI | openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames rea | |
|
79
|
CVE-2026-9037 |
9.3 | 0.0025 | NET NO AUTH LOW CX NO UI | A firmware update mechanism in the affected charging controller fails to validat | |
|
79
|
CVE-2026-42747 |
9.3 | 0.0024 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
78
|
CVE-2026-44351 |
9.1 | 0.0025 | NET NO AUTH LOW CX NO UI | fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.4, a cr | |
|
78
|
CVE-2026-15747 |
9.1 | 0.0025 | NET NO AUTH LOW CX NO UI | Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representati | |
|
78
|
CVE-2026-30802 |
8.8 | 0.0025 | NET NO AUTH LOW CX NO UI | Out-of-bounds Read vulnerability in RTI Connext Micro (Core Libraries) allows Ov | |
|
77
|
CVE-2026-106087 |
8.7 | 0.0025 | NET NO AUTH LOW CX NO UI | TRO600 contains an arbitrary file read vulnerability. An unauthenticated attacke | |
|
77
|
CVE-2026-16317 |
8.3 | 0.0025 | NET NO AUTH LOW CX NO UI | Missing validation of the outer content_type byte on TLS 1.3 encrypted records i | |
|
76
|
CVE-2026-49065 |
8.2 | 0.0025 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Hippoo Mobile App for WooCommerce <= 1. | |
|
75
|
CVE-2026-31923 |
7.5 | 0.0025 | NET NO AUTH LOW CX NO UI | Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. | |
|
75
|
CVE-2026-41282 |
7.5 | 0.0025 | NET NO AUTH LOW CX NO UI | ProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression injection. This aff | |
|
75
|
CVE-2026-24084 |
7.5 | 0.0025 | NET NO AUTH LOW CX NO UI | Weak configuration when UE does not verify the consistency of its additional sec | |
|
75
|
CVE-2026-118804 |
7.5 | 0.0025 | NET NO AUTH LOW CX NO UI | Bricks Builder 2.4.3 and before contains a broken access control vulnerability t | |
|
75
|
CVE-2026-22753 |
7.5 | 0.0025 | NET NO AUTH LOW CX NO UI | Vulnerability in Spring Spring Security. If an application is using securityMatc | |
|
75
|
CVE-2026-41114 |
7.5 | 0.0025 | NET NO AUTH LOW CX NO UI | Uncontrolled Resource Consumption vulnerability in Apache IoTDB JDBC driver. | |
|
75
|
CVE-2026-34898 |
7.5 | 0.0025 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Event Tickets Manager for WooCommerce < | |
|
75
|
CVE-2026-39503 |
7.5 | 0.0025 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Easy Digital Downloads <= 3.6.5 version | |
|
75
|
CVE-2026-39524 |
7.5 | 0.0025 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Masteriyo - LMS <= 2.1.5 versions. | |
|
75
|
CVE-2026-40741 |
7.5 | 0.0025 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Redsys for WooCommerce Light <= 7.0.0 v | |
|
74
|
CVE-2025-63417 |
7.2 | 0.0025 | NET NO AUTH LOW CX NO UI | A Stored Cross-Site Scripting (XSS) vulnerability in the chat functionality of t | |
|
69
|
CVE-2026-14390 |
9.6 | 0.0025 | NET NO AUTH LOW CX | Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote | |
|
69
|
CVE-2026-52842 |
9.3 | 0.0025 | NET NO AUTH LOW CX | Lightpanda is a headless browser designed for AI and automation. Prior to 0.3.1, | |
|
68
|
CVE-2026-42603 |
8.8 | 0.0025 | NET NO AUTH LOW CX | OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses | |
|
68
|
CVE-2026-8000 |
8.8 | 0.0025 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in ChromeDriver in Google Chrome on W | |
|
66
|
CVE-2026-39580 |
8.1 | 0.0025 | NET NO AUTH NO UI | Unauthenticated PHP Object Injection in Micdrop <= 1.3.1 versions. | |
|
66
|
CVE-2026-40736 |
8.1 | 0.0025 | NET NO AUTH NO UI | Unauthenticated PHP Object Injection in Laurits <= 1.5.1 versions. | |
|
66
|
CVE-2026-40754 |
8.1 | 0.0025 | NET NO AUTH NO UI | Unauthenticated PHP Object Injection in Roisin <= 1.4 versions. | |
|
66
|
CVE-2026-40755 |
8.1 | 0.0025 | NET NO AUTH NO UI | Unauthenticated PHP Object Injection in TechLink <= 1.3 versions. | |
|
66
|
CVE-2026-40760 |
8.1 | 0.0025 | NET NO AUTH NO UI | Unauthenticated PHP Object Injection in Behold <= 1.5 versions. | |
|
66
|
CVE-2026-40761 |
8.1 | 0.0025 | NET NO AUTH NO UI | Unauthenticated PHP Object Injection in Valeska <= 1.2.2 versions. | |
|
66
|
CVE-2026-40756 |
8.1 | 0.0025 | NET NO AUTH NO UI | Unauthenticated PHP Object Injection in Zoya <= 1.4 versions. | |
|
66
|
CVE-2026-40757 |
8.1 | 0.0025 | NET NO AUTH NO UI | Unauthenticated PHP Object Injection in Château <= 1.2.1 versions. | |
|
66
|
CVE-2026-5282 |
8.1 | 0.0025 | NET NO AUTH LOW CX | Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed | |
|
65
|
CVE-2026-119190 |
7.4 | 0.0025 | NET NO AUTH NO UI | Forge (also called node-forge) is a native implementation of Transport Layer Sec | |
|
64
|
CVE-2026-73393 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Subscribe2 <= 10.46 versions. | |
|
64
|
CVE-2026-16570 |
7.1 | 0.0025 | NET NO AUTH LOW CX | The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does | |
|
64
|
CVE-2026-19055 |
7.1 | 0.0025 | NET NO AUTH LOW CX | The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and e | |
|
64
|
CVE-2026-19056 |
7.1 | 0.0025 | NET NO AUTH LOW CX | The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and e | |
|
64
|
CVE-2026-66581 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.1 versions. | |
|
64
|
CVE-2026-66590 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Tagembed <= 7.4 versions. | |
|
64
|
CVE-2025-59571 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
57
|
CVE-2026-8569 |
8.3 | 0.0025 | NET NO AUTH | Out of bounds write in Codecs in Google Chrome on Mac prior to 148.0.7778.168 al | |
|
57
|
CVE-2026-12008 |
8.3 | 0.0025 | NET NO AUTH | Use after free in DigitalCredentials in Google Chrome prior to 149.0.7827.115 al | |
|
57
|
CVE-2026-12009 |
8.3 | 0.0025 | NET NO AUTH | Insufficient validation of untrusted input in Accessibility in Google Chrome on | |
|
57
|
CVE-2026-12011 |
8.3 | 0.0025 | NET NO AUTH | Use after free in WebMIDI in Google Chrome on Windows prior to 149.0.7827.115 al | |
|
57
|
CVE-2026-14389 |
8.3 | 0.0025 | NET NO AUTH | Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remot | |
|
55
|
CVE-2026-19156 |
7.5 | 0.0025 | NET NO AUTH | Heap buffer overflow in Base in Google Chrome prior to 151.0.7922.109 allowed an | |
|
55
|
CVE-2026-7929 |
7.5 | 0.0025 | NET NO AUTH | Use after free in MediaRecording in Google Chrome prior to 148.0.7778.96 allowed | |
|
55
|
CVE-2026-13029 |
7.5 | 0.0025 | NET NO AUTH | Use after free in Web Authentication in Google Chrome prior to 149.0.7827.197 al |