Hunt List
13,776 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-52706 |
9.8 | 0.0047 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions. | |
|
77
|
CVE-2026-115728 |
8.7 | 0.0047 | NET NO AUTH LOW CX NO UI | @hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of se | |
|
77
|
CVE-2026-56297 |
8.3 | 0.0047 | NET NO AUTH LOW CX NO UI | FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcman_channel_ | |
|
75
|
CVE-2026-22334 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | Subscriber Arbitrary File Download in Woocommerce Book Price <= 1.3 versions. | |
|
75
|
CVE-2026-59887 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | linkify-it is a links recognition library with full Unicode support. Prior to 5. | |
|
75
|
CVE-2026-20153 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
75
|
CVE-2026-20158 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
75
|
CVE-2026-20187 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
75
|
CVE-2026-11810 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | The UpdateHub firmware-update agent's probe handler (z_impl_updatehub_probe() in | |
|
75
|
CVE-2026-118772 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | joi is a schema description language and data validator for JavaScript. From 17. | |
|
75
|
CVE-2026-110680 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds whe | |
|
75
|
CVE-2026-34232 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | Firebird is an open-source relational database management system. In versions pr | |
|
75
|
CVE-2026-35215 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | Firebird is an open-source relational database management system. In versions pr | |
|
75
|
CVE-2026-114605 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser | |
|
75
|
CVE-2026-104594 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity- | |
|
70
|
CVE-2026-60369 |
9.9 | 0.0047 | NET LOW CX NO UI | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion | |
|
70
|
CVE-2026-17276 |
9.9 | 0.0047 | NET LOW CX NO UI | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to esca | |
|
69
|
CVE-2026-34260 |
9.6 | 0.0047 | NET LOW CX NO UI | SAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerabil | |
|
69
|
CVE-2026-112992 |
9.6 | 0.0047 | NET NO AUTH LOW CX | Observable discrepancy in Canvas in Google Chrome prior to 156.0.8078.47 allowed | |
|
69
|
CVE-2026-113007 |
9.6 | 0.0047 | NET NO AUTH LOW CX | Incorrect calculation in Permissions in Google Chrome prior to 156.0.8078.47 all | |
|
69
|
CVE-2026-113056 |
9.6 | 0.0047 | NET NO AUTH LOW CX | Observable discrepancy in PerformanceAPIs in Google Chrome prior to 156.0.8078.4 | |
|
69
|
CVE-2026-113116 |
9.6 | 0.0047 | NET NO AUTH LOW CX | Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowe | |
|
69
|
CVE-2026-113126 |
9.6 | 0.0047 | NET NO AUTH LOW CX | Improper resource exposure in PolicyContainer in Google Chrome prior to 156.0.80 | |
|
69
|
CVE-2026-113138 |
9.6 | 0.0047 | NET NO AUTH LOW CX | UI misrepresentation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 a | |
|
69
|
CVE-2026-113169 |
9.6 | 0.0047 | NET NO AUTH LOW CX | UI misrepresentation in WebAppInstalls in Google Chrome on on Android prior to 1 | |
|
69
|
CVE-2026-113171 |
9.6 | 0.0047 | NET NO AUTH LOW CX | UI misrepresentation in Prompts in Google Chrome on on Android prior to 156.0.80 | |
|
69
|
CVE-2026-113222 |
9.6 | 0.0047 | NET NO AUTH LOW CX | Missing authorization in V8 in Google Chrome prior to 156.0.8078.47 allowed a re | |
|
68
|
CVE-2026-60373 |
8.8 | 0.0047 | NET LOW CX NO UI | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion | |
|
68
|
CVE-2026-60439 |
8.8 | 0.0047 | NET LOW CX NO UI | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion | |
|
68
|
CVE-2026-61246 |
8.8 | 0.0047 | NET LOW CX NO UI | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion | |
|
68
|
CVE-2026-74949 |
8.8 | 0.0047 | NET NO AUTH LOW CX | Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed | |
|
68
|
CVE-2026-116676 |
8.8 | 0.0047 | NET LOW CX NO UI | Atlantis is a self-hosted golang application that listens for Terraform pull req | |
|
66
|
CVE-2026-42382 |
8.1 | 0.0047 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Audrey <= 1.5 versions. | |
|
66
|
CVE-2026-66653 |
8.1 | 0.0047 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions. | |
|
66
|
CVE-2026-66656 |
8.1 | 0.0047 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Foton Core <= 1.1.1 versions. | |
|
66
|
CVE-2026-66657 |
8.1 | 0.0047 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions. | |
|
66
|
CVE-2026-28570 |
8.1 | 0.0047 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Vavo Core <= 2.3.0 versions. | |
|
66
|
CVE-2026-32464 |
8.1 | 0.0047 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Theme Test Drive <= 2.9.1 versions. | |
|
66
|
CVE-2026-73400 |
8.1 | 0.0047 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress <= 2.4.11 v | |
|
66
|
CVE-2026-28151 |
8.1 | 0.0047 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Tonda < 2.6 versions. | |
|
66
|
CVE-2026-28152 |
8.1 | 0.0047 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Tonda Core < 2.6 versions. | |
|
66
|
CVE-2026-44745 |
8.1 | 0.0047 | NET NO AUTH LOW CX | SAP Approuter does not properly validate incoming request headers during the OAu | |
|
64
|
CVE-2026-39903 |
7.1 | 0.0047 | NET LOW CX NO UI | Simple Machines Forum 2.1 prior to commit 7d048f8 and 3.0 prior to commit a7875e | |
|
64
|
CVE-2026-28141 |
7.1 | 0.0047 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in NextGEN Gallery <= 4.2.3 versions. | |
|
64
|
CVE-2026-110084 |
7.1 | 0.0047 | NET LOW CX NO UI | Adobe Experience Manager is affected by an XML Injection (aka Blind XPath Inject | |
|
62
|
CVE-2026-105982 |
8.6 | 0.0047 | NET LOW CX NO UI | Improper input validation in the IPsec VPN function may allow a remote attacker | |
|
55
|
CVE-2026-58299 |
7.5 | 0.0047 | NET NO AUTH | Time-of-check time-of-use (toctou) race condition in Microsoft Edge for Android | |
|
54
|
CVE-2026-18756 |
7.2 | 0.0047 | NET LOW CX | HumHub Community Edition 1.18.4 contains a reflected cross-site scripting vulner | |
|
51
|
CVE-2026-43001 |
8.0 | 0.0047 | NET NO UI | An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credential | |
|
50
|
CVE-2026-18706 |
7.5 | 0.0047 | NET NO UI | An issue in MongoDB Server's $graphLookup aggregation stage could allow an authe |