Hunt List
13,805 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-57813 |
9.8 | 0.0048 | NET NO AUTH LOW CX NO UI | Incorrect Privilege Assignment vulnerability in properfraction MailOptin mailopt | |
|
80
|
CVE-2026-64873 |
9.8 | 0.0048 | NET NO AUTH LOW CX NO UI | Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custo | |
|
80
|
CVE-2026-59540 |
9.8 | 0.0048 | NET NO AUTH LOW CX NO UI | Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.6 v | |
|
80
|
CVE-2026-61951 |
9.8 | 0.0048 | NET NO AUTH LOW CX NO UI | Unauthenticated Privilege Escalation in TrueBooker <= 1.2.3 versions. | |
|
80
|
CVE-2026-16504 |
9.8 | 0.0048 | NET NO AUTH LOW CX NO UI | Deployment of the VPS.org one-click Zulip template deploys a hardcoded applicati | |
|
80
|
CVE-2026-71214 |
9.8 | 0.0048 | NET NO AUTH LOW CX NO UI | The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-serve | |
|
80
|
CVE-2026-28005 |
9.8 | 0.0048 | NET NO AUTH LOW CX NO UI | Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1. | |
|
80
|
CVE-2026-65507 |
9.8 | 0.0048 | NET NO AUTH LOW CX NO UI | Unauthenticated Privilege Escalation in AIWU <= 1.5.6 versions. | |
|
80
|
CVE-2026-61967 |
9.8 | 0.0048 | NET NO AUTH LOW CX NO UI | Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 ver | |
|
80
|
CVE-2026-66424 |
9.8 | 0.0048 | NET NO AUTH LOW CX NO UI | Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.7 v | |
|
80
|
CVE-2026-66691 |
9.8 | 0.0048 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions. | |
|
80
|
CVE-2026-84999 |
9.8 | 0.0048 | NET NO AUTH LOW CX NO UI | The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File | |
|
80
|
CVE-2026-83232 |
9.8 | 0.0048 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware | |
|
80
|
CVE-2026-64815 |
9.8 | 0.0048 | NET NO AUTH LOW CX NO UI | In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible v | |
|
80
|
CVE-2026-46752 |
10.0 | 0.0048 | NET NO AUTH LOW CX NO UI | Redis Lua HEAP overflow in cjson library vulnerability in Apache Kvrocks. This | |
|
78
|
CVE-2026-61462 |
9.2 | 0.0048 | NET NO AUTH LOW CX NO UI | mcp-gitlab contains a path traversal vulnerability in the job_id parameter of bu | |
|
78
|
CVE-2026-33808 |
9.1 | 0.0048 | NET NO AUTH LOW CX NO UI | Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing | |
|
78
|
CVE-2026-13739 |
8.8 | 0.0048 | NET NO AUTH LOW CX NO UI | A legacy endpoint in Command Center contained an unauthenticated server-side req | |
|
78
|
CVE-2026-42513 |
8.8 | 0.0048 | NET NO AUTH LOW CX NO UI | This vulnerability exists in e-Sushrut due to improper authentication logic that | |
|
77
|
CVE-2022-4984 |
8.7 | 0.0048 | NET NO AUTH LOW CX NO UI | ZenTao Biz < 6.5, ZenTao Max < 3.0, ZenTao Open Source Edition < 16.5, and ZenTa | |
|
77
|
CVE-2026-35672 |
8.7 | 0.0048 | NET NO AUTH LOW CX NO UI | phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4. | |
|
77
|
CVE-2026-74238 |
8.7 | 0.0048 | NET NO AUTH LOW CX NO UI | TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the | |
|
77
|
CVE-2026-55418 |
8.6 | 0.0048 | NET NO AUTH LOW CX NO UI | FastGPT is an open source AI knowledge base platform. Prior to v4.15.0-beta5, tw | |
|
77
|
CVE-2026-33752 |
8.6 | 0.0048 | NET NO AUTH LOW CX NO UI | curl_cffi is the a Python binding for curl. Prior to 0.15.0, curl_cffi does not | |
|
76
|
CVE-2026-33748 |
8.2 | 0.0048 | NET NO AUTH LOW CX NO UI | BuildKit is a toolkit for converting source code to build artifacts in an effici | |
|
75
|
CVE-2026-28908 |
7.5 | 0.0048 | NET NO AUTH LOW CX NO UI | A denial of service issue was addressed by removing the vulnerable code. This is | |
|
75
|
CVE-2026-59834 |
7.5 | 0.0048 | NET NO AUTH LOW CX NO UI | SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, t | |
|
75
|
CVE-2026-6507 |
7.5 | 0.0048 | NET NO AUTH LOW CX NO UI | A flaw was found in dnsmasq. A remote attacker could exploit an out-of-bounds wr | |
|
75
|
CVE-2026-25712 |
7.5 | 0.0048 | NET NO AUTH LOW CX NO UI | Gitea versions before 1.25.5 have insufficient visibility checks in organization | |
|
70
|
CVE-2026-35280 |
9.9 | 0.0048 | NET LOW CX NO UI | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusio | |
|
70
|
CVE-2026-35281 |
9.9 | 0.0048 | NET LOW CX NO UI | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusio | |
|
70
|
CVE-2026-47724 |
9.9 | 0.0048 | NET LOW CX NO UI | nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private | |
|
69
|
CVE-2026-46853 |
9.6 | 0.0048 | NET NO AUTH LOW CX | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle E | |
|
69
|
CVE-2026-119085 |
9.4 | 0.0048 | NET LOW CX NO UI | Improper neutralization of special elements used in a template engine in the pub | |
|
68
|
CVE-2026-14383 |
8.8 | 0.0048 | NET NO AUTH LOW CX | Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allow | |
|
68
|
CVE-2026-113055 |
8.8 | 0.0048 | NET NO AUTH LOW CX | UI misrepresentation in FullScreen in Google Chrome on on Android prior to 156.0 | |
|
68
|
CVE-2026-5140 |
8.8 | 0.0048 | NET NO AUTH LOW CX | Improper neutralization of CRLF sequences ('CRLF injection') vulnerability in TU | |
|
68
|
CVE-2026-49258 |
8.8 | 0.0048 | NET LOW CX NO UI | Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In ver | |
|
68
|
CVE-2026-113204 |
8.8 | 0.0048 | NET NO AUTH LOW CX | UI misrepresentation in TrustedWebActivities in Google Chrome on on Android prio | |
|
67
|
CVE-2026-7674 |
8.7 | 0.0048 | NET LOW CX NO UI | A flaw has been found in Shenzhen Libituo Technology LBT-T300-HW1 up to 1.2.8. T | |
|
66
|
CVE-2026-55388 |
8.1 | 0.0048 | NET NO AUTH NO UI | piscina is a node.js worker pool implementation. Prior to 6.0.0-rc.2, 5.2.0, and | |
|
65
|
CVE-2026-66878 |
7.7 | 0.0048 | NET LOW CX NO UI | A flaw was found in multicloud-operators-subscription. A privileged user, specif | |
|
65
|
CVE-2026-73122 |
7.7 | 0.0048 | NET LOW CX NO UI | A flaw was found in the multicloud-operators-channel component of Red Hat Advanc | |
|
65
|
CVE-2026-65695 |
7.6 | 0.0048 | NET NO AUTH LOW CX | Office-Word-MCP-Server through 1.1.11 contains a path traversal vulnerability in | |
|
65
|
CVE-2026-105942 |
7.7 | 0.0048 | NET LOW CX NO UI | When a configured proxy role sends a request to the broker on behalf of another | |
|
65
|
CVE-2026-15554 |
7.4 | 0.0048 | NET NO AUTH NO UI | the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes with | |
|
64
|
CVE-2026-105934 |
7.2 | 0.0048 | NET LOW CX NO UI | The Apache Pulsar broker admin REST API provides a truncate operation for persis | |
|
59
|
CVE-2026-17351 |
9.4 | 0.0048 | NET LOW CX | The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query pas | |
|
56
|
CVE-2026-19550 |
8.2 | 0.0048 | NET NO UI | A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read- | |
|
55
|
CVE-2026-58292 |
7.5 | 0.0048 | NET NO AUTH | Improper input validation in Microsoft Edge (Chromium-based) allows an unauthori |