Hunt List
12,902 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-47137 |
10.0 | 0.0038 | NET NO AUTH LOW CX NO UI | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the fix f | |
|
80
|
CVE-2026-0163 |
9.8 | 0.0038 | NET NO AUTH LOW CX NO UI | In multiple functions of vpu_ioctl.c, there is a possible use after free due to | |
|
80
|
CVE-2026-76886 |
9.8 | 0.0038 | NET NO AUTH LOW CX NO UI | C12.22 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows den | |
|
80
|
CVE-2026-76301 |
9.8 | 0.0038 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
80
|
CVE-2025-51511 |
9.8 | 0.0038 | NET NO AUTH LOW CX NO UI | Cadmium CMS v.0.4.9 has a background arbitrary file upload vulnerability in /adm | |
|
77
|
CVE-2026-42047 |
8.6 | 0.0038 | NET NO AUTH LOW CX NO UI | Inngest is a platform for running event-driven and scheduled background function | |
|
77
|
CVE-2026-114109 |
8.7 | 0.0038 | NET NO AUTH LOW CX NO UI | uv before 0.11.15 contains a path traversal vulnerability that allows malicious | |
|
77
|
CVE-2026-65635 |
8.3 | 0.0038 | NET NO AUTH LOW CX NO UI | Improper Isolation or Compartmentalization vulnerability in malach-it boruta (El | |
|
76
|
CVE-2026-8466 |
8.2 | 0.0038 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in ninenines | |
|
75
|
CVE-2025-61498 |
7.5 | 0.0038 | NET NO AUTH LOW CX NO UI | A buffer overflow in the UPnP service of Tenda AC8 Hardware v03.03.10.01 allows | |
|
75
|
CVE-2026-50870 |
7.5 | 0.0038 | NET NO AUTH LOW CX NO UI | An information disclosure vulnerability in the configuration endpoint of Ben Bus | |
|
75
|
CVE-2025-58629 |
7.5 | 0.0038 | NET NO AUTH LOW CX NO UI | Missing Authorization vulnerability in kamleshyadav Miraculous miraculous allows | |
|
75
|
CVE-2026-50151 |
7.5 | 0.0038 | NET NO AUTH LOW CX NO UI | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/rem | |
|
75
|
CVE-2026-44765 |
7.3 | 0.0038 | NET NO AUTH LOW CX NO UI | Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integrat | |
|
74
|
CVE-2026-109234 |
7.2 | 0.0038 | NET NO AUTH LOW CX NO UI | The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Script | |
|
74
|
CVE-2026-116520 |
7.2 | 0.0038 | NET NO AUTH LOW CX NO UI | The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored C | |
|
74
|
CVE-2026-42789 |
7.0 | 0.0038 | NET NO AUTH LOW CX NO UI | Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP | |
|
70
|
CVE-2026-54067 |
9.9 | 0.0038 | NET LOW CX NO UI | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, C | |
|
69
|
CVE-2026-54458 |
9.6 | 0.0038 | NET NO AUTH LOW CX | WWBN AVideo is an open source video platform. Versions prior to 29.0 contain a s | |
|
69
|
CVE-2026-63048 |
9.4 | 0.0038 | NET LOW CX NO UI | Joomla Extension - joomlack.fr - Improper access control in Page Builder CK 1.0. | |
|
68
|
CVE-2026-17778 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Use after free in Extensions in Google Chrome prior to 151.0.7922.72 allowed a r | |
|
68
|
CVE-2026-17875 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Use after free in PDFium in Google Chrome prior to 151.0.7922.72 allowed a remot | |
|
68
|
CVE-2026-18012 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Use after free in PDFium in Google Chrome prior to 151.0.7922.72 allowed a remot | |
|
67
|
CVE-2026-8169 |
8.7 | 0.0038 | NET LOW CX NO UI | ExtremeXOS (EXOS) uses a challenge-response mechanism to authorize access to the | |
|
66
|
CVE-2026-54036 |
8.1 | 0.0038 | NET LOW CX NO UI | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prio | |
|
66
|
CVE-2026-60700 |
8.1 | 0.0038 | NET NO AUTH LOW CX | Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Su | |
|
66
|
CVE-2026-61281 |
8.1 | 0.0038 | NET NO AUTH LOW CX | Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyper | |
|
66
|
CVE-2026-62591 |
8.1 | 0.0038 | NET NO AUTH LOW CX | Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (compon | |
|
66
|
CVE-2026-70746 |
8.1 | 0.0038 | NET NO AUTH LOW CX | Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyper | |
|
66
|
CVE-2026-70901 |
8.1 | 0.0038 | NET NO AUTH LOW CX | Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora | |
|
65
|
CVE-2026-60820 |
7.4 | 0.0038 | NET NO AUTH NO UI | Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (compon | |
|
65
|
CVE-2026-45223 |
7.7 | 0.0038 | NET LOW CX NO UI | Crabbox before 0.9.0 contains an authentication bypass vulnerability in the coor | |
|
64
|
CVE-2026-49344 |
7.1 | 0.0038 | NET LOW CX NO UI | Mercator is an open source web application that enables mapping of the informati | |
|
64
|
CVE-2026-54304 |
7.1 | 0.0038 | NET LOW CX NO UI | n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, a | |
|
64
|
CVE-2026-57215 |
7.0 | 0.0038 | NET LOW CX NO UI | RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, | |
|
62
|
CVE-2026-46593 |
8.6 | 0.0038 | NET LOW CX NO UI | A SQL injection vulnerability has been identified in the PHP Jabbers - PHP Poll | |
|
61
|
CVE-2026-65877 |
8.2 | 0.0038 | NET LOW CX NO UI | Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Buil | |
|
60
|
CVE-2026-56052 |
7.6 | 0.0038 | NET LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
60
|
CVE-2026-57631 |
7.6 | 0.0038 | NET LOW CX NO UI | Administrator SQL Injection in Popup box <= 6.0.1 versions. | |
|
60
|
CVE-2026-57773 |
7.6 | 0.0038 | NET LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
60
|
CVE-2026-61955 |
7.6 | 0.0038 | NET LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
60
|
CVE-2026-65462 |
7.6 | 0.0038 | NET LOW CX NO UI | Administrator SQL Injection in Uncanny Automator <= 7.3.2 versions. | |
|
60
|
CVE-2026-65532 |
7.6 | 0.0038 | NET LOW CX NO UI | Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions. | |
|
60
|
CVE-2026-59537 |
7.6 | 0.0038 | NET LOW CX NO UI | Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Auto | |
|
60
|
CVE-2026-66427 |
7.6 | 0.0038 | NET LOW CX NO UI | Administrator SQL Injection in WP Google Review Slider <= 18.4 versions. | |
|
60
|
CVE-2026-73346 |
7.6 | 0.0038 | NET LOW CX NO UI | Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions. | |
|
59
|
CVE-2026-39470 |
7.2 | 0.0038 | NET LOW CX NO UI | Shop manager Privilege Escalation in WooCommerce Cart Abandonment Recovery < 2.1 | |
|
56
|
CVE-2026-13410 |
8.2 | 0.0038 | NET NO AUTH | Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification | |
|
55
|
CVE-2026-10545 |
7.5 | 0.0038 | NET NO AUTH | IBM Planning Analytics Local 2.1.0 through 2.1.21 is vulnerable to an open redir | |
|
51
|
CVE-2026-71285 |
8.1 | 0.0038 | NET LOW CX | Uptime Kuma's Matomo analytics integration (server/analytics/matomo-analytics.js |