Hunt List
8,552 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-14104 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome pr | |
|
80
|
CVE-2026-18894 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger p | |
|
80
|
CVE-2026-57700 |
10.0 | 0.0052 | NET NO AUTH LOW CX NO UI | Unrestricted Upload of File with Dangerous Type vulnerability in Daan.Dev OMGF P | |
|
80
|
CVE-2026-57719 |
10.0 | 0.0052 | NET NO AUTH LOW CX NO UI | Unrestricted Upload of File with Dangerous Type vulnerability in CodeRevolution | |
|
80
|
CVE-2026-64813 |
10.0 | 0.0052 | NET NO AUTH LOW CX NO UI | In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was | |
|
80
|
CVE-2026-66665 |
10.0 | 0.0052 | NET NO AUTH LOW CX NO UI | Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions. | |
|
80
|
CVE-2026-56141 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.14812 | |
|
80
|
CVE-2026-64874 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro ex | |
|
80
|
CVE-2026-14175 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | Unrestricted upload of file with dangerous type vulnerability in Bilin Software | |
|
80
|
CVE-2026-73996 |
9.8 | 0.0052 | NET NO AUTH LOW CX NO UI | Unauthenticated Arbitrary File Upload in Masteriyo - LMS <= 2.3.2 versions. | |
|
79
|
CVE-2026-58492 |
9.2 | 0.0053 | NET NO AUTH LOW CX NO UI | grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, the PD | |
|
79
|
CVE-2026-16839 |
9.4 | 0.0052 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to o | |
|
79
|
CVE-2026-32956 |
9.3 | 0.0052 | NET NO AUTH LOW CX NO UI | SD-330AC and AMC Manager provided by silex technology, Inc. contain a heap-based | |
|
79
|
CVE-2026-109422 |
9.2 | 0.0052 | NET NO AUTH LOW CX NO UI | NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1. | |
|
78
|
CVE-2026-70453 |
8.7 | 0.0053 | NET NO AUTH LOW CX NO UI | rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_ | |
|
78
|
CVE-2026-62334 |
8.7 | 0.0053 | NET NO AUTH LOW CX NO UI | OpenVM is a performant and modular zkVM framework built for customization and ex | |
|
78
|
CVE-2026-62357 |
8.8 | 0.0052 | NET NO AUTH LOW CX NO UI | Dragonfly is an in-memory data store built for modern application workloads. Pri | |
|
78
|
CVE-2026-53653 |
8.7 | 0.0052 | NET NO AUTH LOW CX NO UI | Grav is a file-based Web platform. Prior to 1.7.53 and 2.0.0-rc.8, Grav allows a | |
|
78
|
CVE-2026-62963 |
8.7 | 0.0052 | NET NO AUTH LOW CX NO UI | Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.4 | |
|
78
|
CVE-2026-73564 |
8.7 | 0.0052 | NET NO AUTH LOW CX NO UI | frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel | |
|
78
|
CVE-2026-63384 |
8.7 | 0.0052 | NET NO AUTH LOW CX NO UI | Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libe | |
|
78
|
CVE-2026-44542 |
9.1 | 0.0052 | NET NO AUTH LOW CX NO UI | FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3 | |
|
78
|
CVE-2026-14488 |
9.1 | 0.0052 | NET NO AUTH LOW CX NO UI | The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via | |
|
78
|
CVE-2026-9733 |
9.1 | 0.0052 | NET NO AUTH LOW CX NO UI | Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an in | |
|
78
|
CVE-2026-22547 |
9.1 | 0.0052 | NET NO AUTH LOW CX NO UI | Gitea versions before 1.25.5 lack validation constraints for repository creation | |
|
78
|
CVE-2026-63229 |
9.1 | 0.0052 | NET NO AUTH LOW CX NO UI | A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an | |
|
77
|
CVE-2026-55882 |
8.3 | 0.0052 | NET NO AUTH LOW CX NO UI | Tilt defines dev environments as code for microservice apps on Kubernetes. From | |
|
77
|
CVE-2026-59694 |
8.3 | 0.0052 | NET NO AUTH LOW CX NO UI | Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unau | |
|
77
|
CVE-2026-59695 |
8.3 | 0.0052 | NET NO AUTH LOW CX NO UI | Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unau | |
|
75
|
CVE-2026-118758 |
7.5 | 0.0053 | NET NO AUTH LOW CX NO UI | Kubeflow Pipelines enables users to build and deploy portable, scalable machine | |
|
75
|
CVE-2026-33260 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | An attacker can send a web request that causes unlimited memory allocation in th | |
|
75
|
CVE-2026-33592 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | An unauthenticated remote attacker can exhaust server memory via the FindServers | |
|
75
|
CVE-2026-11946 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | An unauthenticated remote attacker can exhaust server memory via the GetEndpoint | |
|
75
|
CVE-2026-47690 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | MeltanoHub is the source code for hub.meltano.com, the central place for Meltano | |
|
75
|
CVE-2026-12617 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | The issue is unexpected program termination based on ordering and/or specific co | |
|
75
|
CVE-2026-66901 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | Google::Auth versions before 0.09 for Perl allow server side request forgery and | |
|
75
|
CVE-2026-13204 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | If a provably insecure domain is covered by both an NSEC and NSEC3 record at the | |
|
75
|
CVE-2026-16972 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to o | |
|
75
|
CVE-2026-99152 |
7.5 | 0.0052 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: scsi: libis | |
|
68
|
CVE-2026-57623 |
9.0 | 0.0053 | NET NO AUTH NO UI | Unauthenticated Arbitrary Code Execution in W3 Total Cache <= 2.9.4 versions. | |
|
68
|
CVE-2026-88157 |
8.8 | 0.0052 | NET NO AUTH LOW CX | Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacke | |
|
68
|
CVE-2026-88197 |
8.8 | 0.0052 | NET NO AUTH LOW CX | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker t | |
|
68
|
CVE-2026-13870 |
8.8 | 0.0052 | NET NO AUTH LOW CX | Use after free in WebView in Google Chrome on Android prior to 150.0.7871.47 all | |
|
68
|
CVE-2026-15121 |
8.8 | 0.0052 | NET NO AUTH LOW CX | Use after free in WebRTC in Google Chrome prior to 150.0.7871.115 allowed a remo | |
|
68
|
CVE-2026-16421 |
8.8 | 0.0052 | NET NO AUTH LOW CX | Inappropriate implementation in WebAudio in Google Chrome prior to 150.0.7871.18 | |
|
68
|
CVE-2026-16806 |
8.8 | 0.0052 | NET NO AUTH LOW CX | Use after free in WebMCP in Google Chrome prior to 150.0.7871.186 allowed a remo | |
|
68
|
CVE-2026-17881 |
8.8 | 0.0052 | NET NO AUTH LOW CX | Integer overflow in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remo | |
|
68
|
CVE-2026-76045 |
8.8 | 0.0052 | NET NO AUTH LOW CX | Use after free in WebGL in Google Chrome prior to 151.0.7922.169 allowed a remot | |
|
55
|
CVE-2026-106763 |
7.5 | 0.0052 | NET NO AUTH | An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to e | |
|
55
|
CVE-2026-106764 |
7.5 | 0.0052 | NET NO AUTH | An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbit |