Hunt List
12,881 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-15966 |
9.8 | 0.0037 | NET NO AUTH LOW CX NO UI | Permissive cross-domain security policy with untrusted domains vulnerability in | |
|
80
|
CVE-2026-15967 |
9.8 | 0.0037 | NET NO AUTH LOW CX NO UI | Insufficient session expiration vulnerability in Progress MOVEit Transfer. This | |
|
79
|
CVE-2026-67426 |
9.3 | 0.0037 | NET NO AUTH LOW CX NO UI | Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior | |
|
79
|
CVE-2026-3893 |
9.4 | 0.0037 | NET NO AUTH LOW CX NO UI | The Carlson VASCO-B GNSS Receiver lacks an authentication mechanism, allowing a | |
|
79
|
CVE-2026-40042 |
9.3 | 0.0037 | NET NO AUTH LOW CX NO UI | Pachno 1.0.6 contains an XML external entity injection vulnerability that allows | |
|
79
|
CVE-2026-58122 |
9.3 | 0.0037 | NET NO AUTH LOW CX NO UI | Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability tha | |
|
78
|
CVE-2026-111663 |
9.2 | 0.0037 | NET NO AUTH LOW CX NO UI | Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that | |
|
77
|
CVE-2026-75596 |
8.7 | 0.0037 | NET NO AUTH LOW CX NO UI | Netty is an asynchronous, event-driven network application framework. Prior to 4 | |
|
75
|
CVE-2026-40046 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ | |
|
75
|
CVE-2026-116656 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Tanium addressed an uncontrolled resource consumption vulnerability in Enforce. | |
|
75
|
CVE-2026-116662 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Tanium addressed a compression bomb vulnerability in Enforce. | |
|
75
|
CVE-2026-87086 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Tanium addressed a denial of service vulnerability in Provision. | |
|
75
|
CVE-2026-118036 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027 | |
|
75
|
CVE-2026-12305 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Fire | |
|
75
|
CVE-2026-59765 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files a | |
|
75
|
CVE-2026-61739 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | SOCFortress CoPilot focuses on providing a single pane of glass for all your sec | |
|
74
|
CVE-2026-96894 |
7.2 | 0.0037 | NET NO AUTH LOW CX NO UI | The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for Wo | |
|
70
|
CVE-2026-42858 |
9.9 | 0.0037 | NET LOW CX NO UI | Open edX Platform enables the authoring and delivery of online learning at any s | |
|
69
|
CVE-2026-13798 |
9.6 | 0.0037 | NET NO AUTH LOW CX | Heap buffer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allow | |
|
69
|
CVE-2026-17680 |
9.6 | 0.0037 | NET NO AUTH LOW CX | Heap buffer overflow in Color in Google Chrome on ChromeOS prior to 151.0.7922.7 | |
|
69
|
CVE-2026-17758 |
9.6 | 0.0037 | NET NO AUTH LOW CX | Heap buffer overflow in Dawn in Google Chrome prior to 151.0.7922.72 allowed a r | |
|
69
|
CVE-2026-43900 |
9.3 | 0.0037 | NET NO AUTH LOW CX | DeepChat is an open-source artificial intelligence agent platform that unifies m | |
|
68
|
CVE-2026-54305 |
8.9 | 0.0037 | NET LOW CX NO UI | n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, a | |
|
68
|
CVE-2026-116391 |
8.8 | 0.0037 | NET LOW CX NO UI | Deserialization of Untrusted Data vulnerability in GS Plugins GS Logo Slider gs- | |
|
68
|
CVE-2026-116867 |
8.8 | 0.0037 | NET LOW CX NO UI | Contributor PHP Object Injection in Dynamic QR Code – generator <= 1.0.1 v | |
|
68
|
CVE-2026-118075 |
8.8 | 0.0037 | NET LOW CX NO UI | Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions. | |
|
68
|
CVE-2026-118076 |
8.8 | 0.0037 | NET LOW CX NO UI | Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions. | |
|
68
|
CVE-2026-118080 |
8.8 | 0.0037 | NET LOW CX NO UI | Contributor PHP Object Injection in Social Snap <= 1.5.4 versions. | |
|
68
|
CVE-2026-118081 |
8.8 | 0.0037 | NET LOW CX NO UI | Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions. | |
|
68
|
CVE-2026-78527 |
8.8 | 0.0037 | NET LOW CX NO UI | Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions. | |
|
68
|
CVE-2026-35320 |
9.0 | 0.0037 | NET NO AUTH NO UI | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
68
|
CVE-2026-14087 |
8.8 | 0.0037 | NET NO AUTH LOW CX | Heap buffer overflow in WebNN in Google Chrome on Windows prior to 150.0.7871.47 | |
|
68
|
CVE-2026-17951 |
8.8 | 0.0037 | NET NO AUTH LOW CX | Heap buffer overflow in WebRTC in Google Chrome prior to 151.0.7922.72 allowed a | |
|
68
|
CVE-2026-113118 |
8.8 | 0.0037 | NET NO AUTH LOW CX | Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed | |
|
67
|
CVE-2026-57950 |
8.6 | 0.0037 | NET LOW CX NO UI | ruoyi-vue-pro through 2026.05, fixed in commit 5d1fd70 contains a broken access | |
|
67
|
CVE-2026-53783 |
8.6 | 0.0037 | NET LOW CX NO UI | rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race conditi | |
|
67
|
CVE-2026-114069 |
8.6 | 0.0037 | NET LOW CX NO UI | Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the | |
|
67
|
CVE-2026-55739 |
8.3 | 0.0037 | NET LOW CX NO UI | Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense po | |
|
67
|
CVE-2026-71206 |
8.3 | 0.0037 | NET LOW CX NO UI | Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's | |
|
67
|
CVE-2026-71242 |
8.3 | 0.0037 | NET LOW CX NO UI | Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / vi | |
|
67
|
CVE-2026-42203 |
8.6 | 0.0037 | NET LOW CX NO UI | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) fo | |
|
66
|
CVE-2026-35279 |
8.1 | 0.0037 | NET NO AUTH NO UI | Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle Peop | |
|
66
|
CVE-2026-46927 |
8.1 | 0.0037 | NET NO AUTH NO UI | Vulnerability in the Oracle Receivables product of Oracle E-Business Suite (comp | |
|
64
|
CVE-2026-47118 |
7.1 | 0.0037 | NET NO AUTH LOW CX | Agent Zero before version 1.15 contains a path traversal vulnerability that allo | |
|
64
|
CVE-2026-113354 |
7.1 | 0.0037 | NET LOW CX NO UI | Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows | |
|
64
|
CVE-2026-114051 |
7.1 | 0.0037 | NET LOW CX NO UI | vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/ge | |
|
64
|
CVE-2026-115572 |
7.1 | 0.0037 | NET NO AUTH LOW CX | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an att | |
|
64
|
CVE-2026-116181 |
7.1 | 0.0037 | NET LOW CX NO UI | vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerabili | |
|
59
|
CVE-2026-6888 |
7.2 | 0.0037 | NET LOW CX NO UI | Successful exploitation of the SQL injection vulnerability could allow a remote | |
|
57
|
CVE-2026-49471 |
8.3 | 0.0037 | NET NO AUTH | Serena is a powerful MCP toolkit for coding that provides semantic retrieval and |