Hunt List
13,108 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-33707 |
9.8 | 0.0043 | NET NO AUTH LOW CX NO UI | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, th | |
|
80
|
CVE-2026-2347 |
9.8 | 0.0043 | NET NO AUTH LOW CX NO UI | Authorization bypass through User-Controlled key vulnerability in Akilli Commerc | |
|
80
|
CVE-2026-70921 |
10.0 | 0.0043 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype | |
|
80
|
CVE-2026-10579 |
9.8 | 0.0043 | NET NO AUTH LOW CX NO UI | A flaw was found in Picketlink Federation SAML; the unsolcited response handler | |
|
80
|
CVE-2026-62009 |
9.8 | 0.0043 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions. | |
|
78
|
CVE-2026-62325 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | goshs is a feature-rich single-binary file server for red teamers and developers | |
|
78
|
CVE-2026-73501 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, Valida | |
|
78
|
CVE-2026-16002 |
8.8 | 0.0043 | NET NO AUTH LOW CX NO UI | The affected product is vulnerable to an Out-of-bounds read, which may allow an | |
|
77
|
CVE-2026-62968 |
8.7 | 0.0043 | NET NO AUTH LOW CX NO UI | Dream Displays provides in-game screens for streaming videos in Minecraft. From | |
|
77
|
CVE-2026-44023 |
8.6 | 0.0043 | NET NO AUTH LOW CX NO UI | Docling Core defines core data types and transformations for the document proces | |
|
77
|
CVE-2026-56248 |
8.7 | 0.0043 | NET NO AUTH LOW CX NO UI | Cap-go capgo (capgo-backend) before 12.128.12 contains an unauthenticated denial | |
|
77
|
CVE-2026-63574 |
8.7 | 0.0043 | NET NO AUTH LOW CX NO UI | Memory allocation with excessive size value in the OpenPGP signature and user at | |
|
77
|
CVE-2026-104384 |
8.7 | 0.0043 | NET NO AUTH LOW CX NO UI | Insufficiently Protected Credentials in tunnel gateway and provisioning interfac | |
|
76
|
CVE-2026-35147 |
8.2 | 0.0043 | NET NO AUTH LOW CX NO UI | HCL DFXServer is affected by a Broken Authentication vulnerability via direct AP | |
|
75
|
CVE-2026-39320 |
7.5 | 0.0043 | NET NO AUTH LOW CX NO UI | Signal K Server is a server application that runs on a central hub in a boat. Ve | |
|
75
|
CVE-2026-42668 |
7.5 | 0.0043 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Authentication in Email Marketing for WooCommerce by Omni | |
|
75
|
CVE-2026-5439 |
7.5 | 0.0043 | NET NO AUTH LOW CX NO UI | A memory exhaustion vulnerability exists in ZIP archive processing. Orthanc auto | |
|
75
|
CVE-2026-32228 |
7.5 | 0.0043 | NET NO AUTH LOW CX NO UI | UI / API User with asset materialize permission could trigger dags they had no a | |
|
75
|
CVE-2026-56029 |
7.5 | 0.0043 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Authentication in CorvusPay WooCommerce Payment Gateway < | |
|
75
|
CVE-2026-56069 |
7.5 | 0.0043 | NET NO AUTH LOW CX NO UI | Unauthenticated Insecure Direct Object References (IDOR) in Toolset Forms <= 2.6 | |
|
75
|
CVE-2026-59554 |
7.5 | 0.0043 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Authentication in Ziina <= 1.2.21 versions. | |
|
75
|
CVE-2026-65495 |
7.5 | 0.0043 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Dokan Pro <= 5.0.3 versions. | |
|
75
|
CVE-2025-61479 |
7.5 | 0.0043 | NET NO AUTH LOW CX NO UI | An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 | |
|
75
|
CVE-2026-84748 |
7.5 | 0.0043 | NET NO AUTH LOW CX NO UI | Improper authorization in Apache bRPC (versions < 1.18.0) on all platforms allow | |
|
75
|
CVE-2026-62966 |
7.5 | 0.0043 | NET NO AUTH LOW CX NO UI | ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32 | |
|
75
|
CVE-2026-13476 |
7.3 | 0.0043 | NET NO AUTH LOW CX NO UI | IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could allow an unauthenticate | |
|
68
|
CVE-2026-41086 |
8.8 | 0.0043 | NET LOW CX NO UI | Improper access control in Windows Admin Center allows an authorized attacker to | |
|
68
|
CVE-2026-34158 |
8.8 | 0.0043 | NET LOW CX NO UI | Coolify is an open-source and self-hostable tool for managing servers, applicati | |
|
68
|
CVE-2026-113250 |
8.8 | 0.0043 | NET NO AUTH LOW CX | Use after free in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote | |
|
68
|
CVE-2026-12447 |
8.8 | 0.0043 | NET NO AUTH LOW CX | Heap buffer overflow in WebRTC in Google Chrome prior to 149.0.7827.155 allowed | |
|
68
|
CVE-2026-12466 |
8.8 | 0.0043 | NET NO AUTH LOW CX | Heap buffer overflow in WebRTC in Google Chrome on Windows prior to 149.0.7827.1 | |
|
68
|
CVE-2026-113152 |
8.8 | 0.0043 | NET NO AUTH LOW CX | Memory corruption in SignIn in Google Chrome prior to 156.0.8078.47 allowed a re | |
|
68
|
CVE-2026-113227 |
8.8 | 0.0043 | NET NO AUTH LOW CX | Use after free in Editing in Google Chrome prior to 156.0.8078.47 allowed a remo | |
|
68
|
CVE-2026-113241 |
8.8 | 0.0043 | NET NO AUTH LOW CX | Memory corruption in Toolbar in Google Chrome on on Android prior to 156.0.8078. | |
|
68
|
CVE-2026-113330 |
8.8 | 0.0043 | NET NO AUTH LOW CX | Memory corruption in CustomTabs in Google Chrome on on Android prior to 156.0.80 | |
|
68
|
CVE-2026-92372 |
8.8 | 0.0043 | NET NO AUTH LOW CX | An out-of-bounds write vulnerability in the screen-image decoder of TeamViewer F | |
|
67
|
CVE-2024-58305 |
8.6 | 0.0043 | NET NO AUTH LOW CX | WonderCMS 4.3.2 contains a cross-site scripting vulnerability that allows attack | |
|
67
|
CVE-2026-115419 |
8.6 | 0.0043 | NET LOW CX NO UI | The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 a | |
|
66
|
CVE-2026-101768 |
8.1 | 0.0043 | NET NO AUTH NO UI | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connec | |
|
65
|
CVE-2026-33516 |
7.7 | 0.0043 | NET NO AUTH LOW CX | xrdp is an open source RDP server. Versions through 0.10.5 contain an out-of-bou | |
|
65
|
CVE-2026-28189 |
7.4 | 0.0043 | NET NO AUTH LOW CX | Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 vers | |
|
64
|
CVE-2026-50141 |
7.1 | 0.0043 | NET LOW CX NO UI | Woodpecker is a CI/CD engine. Starting in version 3.0.0 and prior to version 3.1 | |
|
64
|
CVE-2026-54005 |
7.1 | 0.0043 | NET LOW CX NO UI | Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kir | |
|
64
|
CVE-2026-13229 |
7.1 | 0.0043 | NET LOW CX NO UI | Zammad 7.1.0 contains an authenticated improper authorization vulnerability in t | |
|
64
|
CVE-2026-55707 |
7.1 | 0.0043 | NET LOW CX NO UI | In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verif | |
|
64
|
CVE-2026-21577 |
7.1 | 0.0043 | NET LOW CX NO UI | This High severity DoS (Denial of Service) vulnerability was introduced in versi | |
|
64
|
CVE-2026-13060 |
7.1 | 0.0043 | NET LOW CX NO UI | An authenticated user with limited read privileges may be able to access documen | |
|
62
|
CVE-2026-60437 |
8.7 | 0.0043 | NET LOW CX NO UI | Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middlewar | |
|
59
|
CVE-2026-33392 |
7.2 | 0.0043 | NET LOW CX NO UI | In JetBrains YouTrack before 2025.3.131383 high privileged user can achieve RCE | |
|
55
|
CVE-2026-4296 |
7.5 | 0.0043 | NET LOW CX | An incorrect regular expression vulnerability was identified in GitHub Enterpris |