Hunt List
12,863 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
79
|
CVE-2026-111811 |
9.4 | 0.0036 | NET NO AUTH LOW CX NO UI | Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated ne | |
|
79
|
CVE-2026-112866 |
9.3 | 0.0036 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
78
|
CVE-2026-34374 |
9.1 | 0.0036 | NET NO AUTH LOW CX NO UI | WWBN AVideo is an open source video platform. In versions up to and including 26 | |
|
77
|
CVE-2026-34455 |
8.7 | 0.0036 | NET NO AUTH LOW CX NO UI | Hi.Events is an open-source event management and ticket selling platform. From v | |
|
76
|
CVE-2026-45327 |
8.2 | 0.0036 | NET NO AUTH LOW CX NO UI | TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2. | |
|
76
|
CVE-2026-101758 |
8.2 | 0.0036 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Communications Billing and Revenue Management produc | |
|
76
|
CVE-2026-61586 |
8.2 | 0.0036 | NET NO AUTH LOW CX NO UI | Copernik XML Factory provides secure-by-default JAXP factory creation for Java. | |
|
75
|
CVE-2026-47261 |
7.5 | 0.0036 | NET NO AUTH LOW CX NO UI | Wasmtime is a runtime for WebAssembly. In versions prior to 24.0.9, 36.0.10, and | |
|
75
|
CVE-2026-90869 |
7.5 | 0.0036 | NET NO AUTH LOW CX NO UI | A remote attacker who knows a valid account's enrolled SSH public key can termin | |
|
69
|
CVE-2026-42809 |
9.4 | 0.0036 | NET LOW CX NO UI | Apache Polaris can issue broad temporary ("vended") storage credentials during s | |
|
67
|
CVE-2026-114519 |
8.6 | 0.0036 | NET LOW CX NO UI | Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from | |
|
67
|
CVE-2026-56012 |
8.5 | 0.0036 | NET LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
67
|
CVE-2026-54822 |
8.5 | 0.0036 | NET LOW CX NO UI | Subscriber SQL Injection in SALESmanago & Leadoo <= 3.11.2 versions. | |
|
67
|
CVE-2026-54838 |
8.5 | 0.0036 | NET LOW CX NO UI | Subscriber SQL Injection in WC Vendors Marketplace <= 2.6.8 versions. | |
|
67
|
CVE-2026-56064 |
8.5 | 0.0036 | NET LOW CX NO UI | Subscriber SQL Injection in Tourfic <= 2.22.5 versions. | |
|
67
|
CVE-2026-57636 |
8.5 | 0.0036 | NET LOW CX NO UI | Contributor SQL Injection in wpForo Forum <= 3.0.9 versions. | |
|
67
|
CVE-2026-57642 |
8.5 | 0.0036 | NET LOW CX NO UI | Contributor SQL Injection in Gallery <= 4.7.8 versions. | |
|
67
|
CVE-2026-57643 |
8.5 | 0.0036 | NET LOW CX NO UI | Contributor SQL Injection in WP Post Author <= 3.9.1 versions. | |
|
67
|
CVE-2026-57644 |
8.5 | 0.0036 | NET LOW CX NO UI | Contributor SQL Injection in Restaurant Menu by MotoPress <= 2.4.10 versions. | |
|
67
|
CVE-2026-57653 |
8.5 | 0.0036 | NET LOW CX NO UI | Contributor SQL Injection in WP Job Portal <= 2.5.2 versions. | |
|
67
|
CVE-2026-57662 |
8.5 | 0.0036 | NET LOW CX NO UI | Contributor SQL Injection in Contest Gallery <= 30.0.0 versions. | |
|
67
|
CVE-2026-57663 |
8.5 | 0.0036 | NET LOW CX NO UI | Contributor SQL Injection in Recipe Maker For Your Food Blog from Zip Recipes <= | |
|
67
|
CVE-2026-57667 |
8.5 | 0.0036 | NET LOW CX NO UI | Sales Representative SQL Injection in Groundhogg <= 4.5 versions. | |
|
67
|
CVE-2026-57687 |
8.5 | 0.0036 | NET LOW CX NO UI | Contributor SQL Injection in Custom Field Template <= 2.7.8 versions. | |
|
67
|
CVE-2026-57752 |
8.5 | 0.0036 | NET LOW CX NO UI | Contributor SQL Injection in iNET Webkit 1.2.4 versions. | |
|
67
|
CVE-2026-57756 |
8.5 | 0.0036 | NET LOW CX NO UI | Contributor SQL Injection in nicen-localize-image <= 1.4.9 versions. | |
|
67
|
CVE-2026-57765 |
8.5 | 0.0036 | NET LOW CX NO UI | Contributor SQL Injection in WP EasyCart <= 5.9.0 versions. | |
|
67
|
CVE-2026-57385 |
8.5 | 0.0036 | NET LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
67
|
CVE-2026-57771 |
8.5 | 0.0036 | NET LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
67
|
CVE-2026-57772 |
8.5 | 0.0036 | NET LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
67
|
CVE-2026-57787 |
8.5 | 0.0036 | NET LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
67
|
CVE-2026-57810 |
8.5 | 0.0036 | NET LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
67
|
CVE-2026-24552 |
8.5 | 0.0036 | NET LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
67
|
CVE-2026-25405 |
8.5 | 0.0036 | NET LOW CX NO UI | Contributor SQL Injection in eRoom <= 1.7.1 versions. | |
|
67
|
CVE-2026-65450 |
8.5 | 0.0036 | NET LOW CX NO UI | Contributor SQL Injection in MapSVG <= 8.14.0 versions. | |
|
67
|
CVE-2026-65451 |
8.5 | 0.0036 | NET LOW CX NO UI | Contributor SQL Injection in MapSVG <= 8.14.0 versions. | |
|
67
|
CVE-2026-65454 |
8.5 | 0.0036 | NET LOW CX NO UI | Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions. | |
|
67
|
CVE-2026-65526 |
8.5 | 0.0036 | NET LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
67
|
CVE-2026-59551 |
8.5 | 0.0036 | NET LOW CX NO UI | Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7 | |
|
67
|
CVE-2026-65569 |
8.5 | 0.0036 | NET LOW CX NO UI | Subscriber SQL Injection in WP Job Portal <= 2.5.6 versions. | |
|
67
|
CVE-2026-28002 |
8.5 | 0.0036 | NET LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
67
|
CVE-2026-28156 |
8.5 | 0.0036 | NET LOW CX NO UI | Subscriber SQL Injection in Do Lasso <= 358 versions. | |
|
67
|
CVE-2026-28168 |
8.5 | 0.0036 | NET LOW CX NO UI | Subscriber SQL Injection in CubeWP <= 1.1.30 versions. | |
|
67
|
CVE-2026-66430 |
8.5 | 0.0036 | NET LOW CX NO UI | Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.10 ve | |
|
67
|
CVE-2026-66658 |
8.5 | 0.0036 | NET LOW CX NO UI | Subscriber SQL Injection in Reviewer <= 3.14.2 versions. | |
|
67
|
CVE-2026-32466 |
8.5 | 0.0036 | NET LOW CX NO UI | Subscriber SQL Injection in Gravity Forms Bookings premium <= 2.1 versions. | |
|
67
|
CVE-2026-60860 |
8.7 | 0.0036 | NET NO AUTH NO UI | Vulnerability in the Service Delivery Platform product of Oracle Fusion Middlewa | |
|
65
|
CVE-2026-60667 |
7.4 | 0.0036 | NET NO AUTH NO UI | Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle | |
|
64
|
CVE-2026-53789 |
7.1 | 0.0036 | NET NO AUTH LOW CX | rsync before 3.5.0 contains an improper path handling vulnerability that allows | |
|
55
|
CVE-2026-13968 |
7.5 | 0.0036 | NET NO AUTH | Insufficient validation of untrusted input in DevTools in Google Chrome prior to |