Hunt List
13,069 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-14739 |
9.8 | 0.0041 | NET NO AUTH LOW CX NO UI | DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL stat | |
|
79
|
CVE-2026-59506 |
9.3 | 0.0041 | NET NO AUTH LOW CX NO UI | : Missing Authentication for Critical Function vulnerability in Priority Portal | |
|
78
|
CVE-2026-34285 |
9.1 | 0.0041 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion | |
|
78
|
CVE-2026-34286 |
9.1 | 0.0041 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion | |
|
75
|
CVE-2025-68320 |
7.5 | 0.0041 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: lan966x: Fi | |
|
69
|
CVE-2026-13883 |
9.6 | 0.0041 | NET NO AUTH LOW CX | Type Confusion in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote | |
|
69
|
CVE-2026-73644 |
9.6 | 0.0041 | NET LOW CX NO UI | OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL PLAIN | |
|
68
|
CVE-2026-13786 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in Ozone in Google Chrome prior to 150.0.7871.47 allowed a remote | |
|
68
|
CVE-2026-13788 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in Fullscreen in Google Chrome on Android prior to 150.0.7871.47 | |
|
68
|
CVE-2026-13815 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in Blink in Google Chrome prior to 150.0.7871.47 allowed a remote | |
|
68
|
CVE-2026-13898 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in Cast Receiver in Google Chrome prior to 150.0.7871.47 allowed | |
|
68
|
CVE-2026-13899 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in HTML in Google Chrome prior to 150.0.7871.47 allowed a remote | |
|
68
|
CVE-2026-13965 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in Oilpan in Google Chrome prior to 150.0.7871.47 allowed a remot | |
|
68
|
CVE-2026-14006 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in Navigation in Google Chrome prior to 150.0.7871.47 allowed a r | |
|
68
|
CVE-2026-14067 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 | |
|
68
|
CVE-2026-14086 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Insufficient policy enforcement in HID in Google Chrome prior to 150.0.7871.47 a | |
|
68
|
CVE-2026-14149 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in Audio in Google Chrome on Linux prior to 150.0.7871.47 allowed | |
|
68
|
CVE-2026-14393 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote at | |
|
68
|
CVE-2026-14395 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Out of bounds write in V8 in Google Chrome prior to 150.0.7871.46 allowed a remo | |
|
68
|
CVE-2026-14403 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote at | |
|
68
|
CVE-2026-14430 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Integer overflow in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote | |
|
68
|
CVE-2026-14432 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote at | |
|
68
|
CVE-2026-15107 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in IndexedDB in Google Chrome prior to 150.0.7871.115 allowed a r | |
|
68
|
CVE-2026-15116 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in Actor in Google Chrome prior to 150.0.7871.115 allowed a remot | |
|
68
|
CVE-2026-15118 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in Input in Google Chrome prior to 150.0.7871.115 allowed a remot | |
|
68
|
CVE-2026-15126 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in Forms in Google Chrome prior to 150.0.7871.115 allowed a remot | |
|
68
|
CVE-2026-15133 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in InterestGroups in Google Chrome prior to 150.0.7871.115 allowe | |
|
68
|
CVE-2026-15902 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in Cast in Google Chrome prior to 150.0.7871.128 allowed a remote | |
|
68
|
CVE-2026-15903 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allo | |
|
68
|
CVE-2026-16805 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in Blink in Google Chrome prior to 150.0.7871.186 allowed a remot | |
|
68
|
CVE-2026-17658 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote at | |
|
68
|
CVE-2026-17661 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in Loader in Google Chrome prior to 151.0.7922.72 allowed a remot | |
|
68
|
CVE-2026-17665 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote at | |
|
68
|
CVE-2026-17685 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in Autofill in Google Chrome prior to 151.0.7922.72 allowed a rem | |
|
68
|
CVE-2026-17694 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in DOM in Google Chrome prior to 151.0.7922.72 allowed a remote a | |
|
68
|
CVE-2026-17705 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Integer overflow in libxml in Google Chrome prior to 151.0.7922.72 allowed a rem | |
|
68
|
CVE-2026-17719 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in Input in Google Chrome prior to 151.0.7922.72 allowed a remote | |
|
68
|
CVE-2026-17807 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote at | |
|
68
|
CVE-2026-17836 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote at | |
|
68
|
CVE-2026-17918 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in Sync in Google Chrome prior to 151.0.7922.72 allowed a remote | |
|
68
|
CVE-2026-18017 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote | |
|
68
|
CVE-2026-19145 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in Translate in Google Chrome prior to 151.0.7922.109 allowed a r | |
|
68
|
CVE-2026-19150 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allo | |
|
68
|
CVE-2026-19151 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote a | |
|
68
|
CVE-2026-19162 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Out of bounds write in V8 in Google Chrome prior to 151.0.7922.109 allowed a rem | |
|
68
|
CVE-2026-19168 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allo | |
|
68
|
CVE-2026-19174 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Integer overflow in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote | |
|
68
|
CVE-2026-19556 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in V8 in Google Chrome prior to 151.0.7922.137 allowed a remote a | |
|
68
|
CVE-2026-19559 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in HTML in Google Chrome prior to 151.0.7922.137 allowed a remote | |
|
64
|
CVE-2026-40503 |
7.1 | 0.0041 | NET LOW CX NO UI | OpenHarness prior to commit dd1d235 contains a path traversal vulnerability that |