Hunt List
12,959 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
78
|
CVE-2026-65766 |
9.2 | 0.0040 | NET NO AUTH LOW CX NO UI | Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Bu | |
|
78
|
CVE-2026-108142 |
9.1 | 0.0040 | NET NO AUTH LOW CX NO UI | A vulnerability allowing an unauthenticated attacker to bypass authorization on | |
|
78
|
CVE-2026-61426 |
8.8 | 0.0040 | NET NO AUTH LOW CX NO UI | PraisonAI before 1.7.3 contains an insecure default configuration that binds to | |
|
77
|
CVE-2026-111731 |
8.7 | 0.0040 | NET NO AUTH LOW CX NO UI | P-Net before 1.0.3 enters an infinite loop when handling a read request for the | |
|
77
|
CVE-2026-57831 |
8.7 | 0.0040 | NET NO AUTH LOW CX NO UI | Joomla Extension - digital-peak.com - Unauthenticated blind SQL injection in DP | |
|
77
|
CVE-2026-57832 |
8.7 | 0.0040 | NET NO AUTH LOW CX NO UI | Joomla Extension - joomdonation.com - Unauthenticated blind SQL injection in EDo | |
|
76
|
CVE-2026-24031 |
8.2 | 0.0040 | NET NO AUTH LOW CX NO UI | Dovecot SQL based authentication can be bypassed when auth_username_chars is cle | |
|
75
|
CVE-2026-41882 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | In JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3. | |
|
69
|
CVE-2026-43899 |
9.6 | 0.0040 | NET NO AUTH LOW CX | DeepChat is an open-source artificial intelligence agent platform that unifies m | |
|
68
|
CVE-2026-46967 |
8.8 | 0.0040 | NET LOW CX NO UI | Vulnerability in the Oracle Public Sector Financials (International) product of | |
|
68
|
CVE-2026-16366 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Privilege escalation in the DOM: Navigation component. This vulnerability was fi | |
|
68
|
CVE-2026-16401 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Privilege escalation in the Data Loss Prevention component. This vulnerability w | |
|
68
|
CVE-2026-91239 |
8.8 | 0.0040 | NET LOW CX NO UI | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo | |
|
68
|
CVE-2026-113255 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Use after free in CustomTabs in Google Chrome on on Android prior to 156.0.8078. | |
|
68
|
CVE-2026-113266 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Memory corruption in ANGLE in Google Chrome on on Android prior to 156.0.8078.47 | |
|
68
|
CVE-2026-118328 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Improper input validation in WebRTC in Google Chrome prior to 156.0.8078.73 allo | |
|
68
|
CVE-2026-113264 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 | |
|
67
|
CVE-2026-42098 |
8.7 | 0.0040 | NET LOW CX NO UI | Sparx Enterprise Architect software has a security feature that limits user's ac | |
|
67
|
CVE-2026-56679 |
8.7 | 0.0040 | NET LOW CX NO UI | 9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings e | |
|
67
|
CVE-2026-58078 |
8.7 | 0.0040 | NET NO AUTH LOW CX | Joomla Extension - themexpert.com - Unauthenticated SQL injection in Quix Page B | |
|
67
|
CVE-2026-54200 |
8.4 | 0.0040 | NET LOW CX NO UI | Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a local file inclusio | |
|
66
|
CVE-2026-55377 |
8.1 | 0.0040 | NET LOW CX NO UI | Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior | |
|
66
|
CVE-2026-52521 |
8.1 | 0.0040 | NET LOW CX NO UI | A SQL injection vulnerability in Z-BlogPHP 1.7.5 allows authenticated attackers | |
|
66
|
CVE-2026-66375 |
8.1 | 0.0040 | NET LOW CX NO UI | A low-privilege authenticated user may permanently remove protected internal met | |
|
65
|
CVE-2026-34044 |
7.7 | 0.0040 | NET LOW CX NO UI | Coolify is an open-source and self-hostable tool for managing servers, applicati | |
|
65
|
CVE-2026-46608 |
7.4 | 0.0040 | NET NO AUTH LOW CX | Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, | |
|
64
|
CVE-2026-40480 |
7.1 | 0.0040 | NET LOW CX NO UI | ChurchCRM is an open-source church management system. In versions prior to 7.2.0 | |
|
64
|
CVE-2026-56695 |
7.1 | 0.0040 | NET LOW CX NO UI | OpenHarness ohmo gateway /resume and /summary slash commands default remote_invo | |
|
64
|
CVE-2026-58448 |
7.1 | 0.0040 | NET LOW CX NO UI | yudao-cloud before 2026.06 contains a broken access control vulnerability in the | |
|
64
|
CVE-2026-59209 |
7.1 | 0.0040 | NET LOW CX NO UI | n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, a | |
|
64
|
CVE-2026-47732 |
7.1 | 0.0040 | NET LOW CX NO UI | Twig is a template language for PHP. Prior to 3.26.0, several Twig language cons | |
|
64
|
CVE-2026-63307 |
7.1 | 0.0040 | NET LOW CX NO UI | Chat2DB before 5.3.0 contains an insecure direct object reference vulnerability | |
|
64
|
CVE-2026-13055 |
7.1 | 0.0040 | NET LOW CX NO UI | The `$_internalIndexKey` aggregation expression can be used by any authenticated | |
|
64
|
CVE-2026-13056 |
7.1 | 0.0040 | NET LOW CX NO UI | Using expressions that generate large arrays it is possible to craft a query tha | |
|
64
|
CVE-2026-13058 |
7.1 | 0.0040 | NET LOW CX NO UI | An authenticated user with basic write privileges can cause the mongod process t | |
|
64
|
CVE-2026-9765 |
7.1 | 0.0040 | NET LOW CX NO UI | Note: The CVE and blog post don't exist because we determined this is actually a | |
|
64
|
CVE-2026-18695 |
7.1 | 0.0040 | NET LOW CX NO UI | An issue in MongoDB Server's handling of certain query predicates against time-s | |
|
64
|
CVE-2026-18701 |
7.1 | 0.0040 | NET LOW CX NO UI | An issue in MongoDB Server's query subsystem could allow an authenticated user w | |
|
64
|
CVE-2026-73396 |
7.1 | 0.0040 | NET LOW CX NO UI | Subscriber Broken Authentication in MWB HubSpot for WooCommerce <= 1.6.7 version | |
|
63
|
CVE-2026-40258 |
9.1 | 0.0040 | NET LOW CX NO UI | The Gramps Web API is a Python REST API for the genealogical research software G | |
|
59
|
CVE-2026-109927 |
7.2 | 0.0040 | NET LOW CX NO UI | The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability chec | |
|
57
|
CVE-2026-34686 |
8.7 | 0.0040 | NET LOW CX | Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2 | |
|
57
|
CVE-2026-115481 |
8.5 | 0.0040 | NET LOW CX | baserCMS is a website development framework. Starting in version 5.0.0-beta1 and | |
|
57
|
CVE-2026-57273 |
8.3 | 0.0040 | NET NO AUTH | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe | |
|
57
|
CVE-2026-57274 |
8.3 | 0.0040 | NET NO AUTH | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe | |
|
57
|
CVE-2026-57275 |
8.3 | 0.0040 | NET NO AUTH | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe | |
|
57
|
CVE-2026-57276 |
8.3 | 0.0040 | NET NO AUTH | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe | |
|
57
|
CVE-2026-57277 |
8.3 | 0.0040 | NET NO AUTH | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe | |
|
57
|
CVE-2026-57278 |
8.3 | 0.0040 | NET NO AUTH | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe | |
|
52
|
CVE-2026-63120 |
8.4 | 0.0040 | NET LOW CX | pghoard is a PostgreSQL backup daemon and restore tooling that stores backup dat |