Hunt List
8,650 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-52706 |
9.8 | 0.0047 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions. | |
|
78
|
CVE-2026-42216 |
8.8 | 0.0046 | NET NO AUTH LOW CX NO UI | OpenEXR provides the specification and reference implementation of the EXR file | |
|
77
|
CVE-2026-20268 |
8.6 | 0.0047 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
77
|
CVE-2026-20269 |
8.6 | 0.0047 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
77
|
CVE-2026-20270 |
8.6 | 0.0047 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
77
|
CVE-2026-20271 |
8.6 | 0.0047 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
77
|
CVE-2026-20273 |
8.6 | 0.0047 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
77
|
CVE-2026-115728 |
8.7 | 0.0047 | NET NO AUTH LOW CX NO UI | @hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of se | |
|
77
|
CVE-2026-56297 |
8.3 | 0.0047 | NET NO AUTH LOW CX NO UI | FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcman_channel_ | |
|
77
|
CVE-2026-75479 |
8.7 | 0.0046 | NET NO AUTH LOW CX NO UI | JimuReport contains an authentication bypass vulnerability in the report folder | |
|
75
|
CVE-2026-22334 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | Subscriber Arbitrary File Download in Woocommerce Book Price <= 1.3 versions. | |
|
75
|
CVE-2026-59887 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | linkify-it is a links recognition library with full Unicode support. Prior to 5. | |
|
75
|
CVE-2026-20153 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
75
|
CVE-2026-20158 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
75
|
CVE-2026-20187 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
75
|
CVE-2026-11810 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | The UpdateHub firmware-update agent's probe handler (z_impl_updatehub_probe() in | |
|
75
|
CVE-2026-118772 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | joi is a schema description language and data validator for JavaScript. From 17. | |
|
75
|
CVE-2026-110680 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds whe | |
|
75
|
CVE-2026-34232 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | Firebird is an open-source relational database management system. In versions pr | |
|
75
|
CVE-2026-35215 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | Firebird is an open-source relational database management system. In versions pr | |
|
75
|
CVE-2026-114605 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser | |
|
75
|
CVE-2026-104594 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity- | |
|
75
|
CVE-2026-10845 |
7.3 | 0.0047 | NET NO AUTH LOW CX NO UI | IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to by | |
|
69
|
CVE-2026-112992 |
9.6 | 0.0047 | NET NO AUTH LOW CX | Memory corruption in Canvas in Google Chrome prior to 156.0.8078.47 allowed a re | |
|
69
|
CVE-2026-113007 |
9.6 | 0.0047 | NET NO AUTH LOW CX | Memory corruption in Permissions in Google Chrome prior to 156.0.8078.47 allowed | |
|
69
|
CVE-2026-113056 |
9.6 | 0.0047 | NET NO AUTH LOW CX | Memory corruption in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 all | |
|
69
|
CVE-2026-113116 |
9.6 | 0.0047 | NET NO AUTH LOW CX | Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a rem | |
|
69
|
CVE-2026-113126 |
9.6 | 0.0047 | NET NO AUTH LOW CX | Memory corruption in PolicyContainer in Google Chrome prior to 156.0.8078.47 all | |
|
69
|
CVE-2026-113138 |
9.6 | 0.0047 | NET NO AUTH LOW CX | Memory corruption in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allo | |
|
69
|
CVE-2026-113169 |
9.6 | 0.0047 | NET NO AUTH LOW CX | Memory corruption in WebAppInstalls in Google Chrome on on Android prior to 156. | |
|
69
|
CVE-2026-113171 |
9.6 | 0.0047 | NET NO AUTH LOW CX | Memory corruption in Prompts in Google Chrome on on Android prior to 156.0.8078. | |
|
69
|
CVE-2026-113222 |
9.6 | 0.0047 | NET NO AUTH LOW CX | Use after free in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote at | |
|
69
|
CVE-2026-113263 |
9.6 | 0.0046 | NET NO AUTH LOW CX | Use after free in Core in Google Chrome on on Android prior to 156.0.8078.47 all | |
|
68
|
CVE-2026-74949 |
8.8 | 0.0047 | NET NO AUTH LOW CX | Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed | |
|
68
|
CVE-2026-13744 |
8.8 | 0.0046 | NET NO AUTH LOW CX | Improper neutralization of attacker-controlled content in Snowflake CLI versions | |
|
66
|
CVE-2026-54845 |
8.1 | 0.0047 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in MDTF <= 1.3.8 versions. | |
|
66
|
CVE-2026-27412 |
8.1 | 0.0047 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Pearl - Corporate Business <= 3.4.10 ver | |
|
66
|
CVE-2026-42382 |
8.1 | 0.0047 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Audrey <= 1.5 versions. | |
|
66
|
CVE-2026-66653 |
8.1 | 0.0047 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions. | |
|
66
|
CVE-2026-66656 |
8.1 | 0.0047 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Foton Core <= 1.1.1 versions. | |
|
66
|
CVE-2026-66657 |
8.1 | 0.0047 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions. | |
|
66
|
CVE-2026-28570 |
8.1 | 0.0047 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Vavo Core <= 2.3.0 versions. | |
|
66
|
CVE-2026-32464 |
8.1 | 0.0047 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Theme Test Drive <= 2.9.1 versions. | |
|
66
|
CVE-2026-73400 |
8.1 | 0.0047 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress <= 2.4.11 v | |
|
66
|
CVE-2026-28151 |
8.1 | 0.0047 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Tonda < 2.6 versions. | |
|
66
|
CVE-2026-28152 |
8.1 | 0.0047 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Tonda Core < 2.6 versions. | |
|
66
|
CVE-2026-44745 |
8.1 | 0.0047 | NET NO AUTH LOW CX | SAP Approuter does not properly validate incoming request headers during the OAu | |
|
64
|
CVE-2026-28141 |
7.1 | 0.0047 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions. | |
|
55
|
CVE-2026-58299 |
7.5 | 0.0047 | NET NO AUTH | Time-of-check time-of-use (toctou) race condition in Microsoft Edge for Android | |
|
55
|
CVE-2026-61352 |
7.5 | 0.0047 | NET NO AUTH | Concurrent execution using shared resource with improper synchronization ('race |