Hunt List
12,844 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-109774 |
9.8 | 0.0034 | NET NO AUTH LOW CX NO UI | Invalid pointer, undefined behavior in the DOM: Notifications component. This vu | |
|
80
|
CVE-2026-46389 |
9.8 | 0.0034 | NET NO AUTH LOW CX NO UI | UDS Identity Config builds the Keycloak configuration image (realm, plugins, the | |
|
80
|
CVE-2026-113616 |
9.8 | 0.0034 | NET NO AUTH LOW CX NO UI | The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-r | |
|
80
|
CVE-2026-5935 |
9.8 | 0.0034 | NET NO AUTH LOW CX NO UI | IBM Total Storage Service Console (TSSC) / TS4500 IMC 9.2, 9.3, 9.4, 9.5, 9.6 TS | |
|
79
|
CVE-2026-111411 |
9.3 | 0.0034 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
78
|
CVE-2026-44603 |
9.1 | 0.0034 | NET NO AUTH LOW CX NO UI | Tor before 0.4.9.7 has an out-of-bounds read by one byte via a malformed BEGIN c | |
|
78
|
CVE-2026-107017 |
9.1 | 0.0034 | NET NO AUTH LOW CX NO UI | Insecure permissions in the ShortcutDispatchActivity component of canvoki versio | |
|
78
|
CVE-2026-107028 |
9.1 | 0.0034 | NET NO AUTH LOW CX NO UI | Insecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows un | |
|
78
|
CVE-2025-30052 |
8.8 | 0.0034 | NET NO AUTH LOW CX NO UI | The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass vi | |
|
78
|
CVE-2026-58102 |
9.1 | 0.0034 | NET NO AUTH LOW CX NO UI | Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow a heap out-of-bounds r | |
|
78
|
CVE-2026-114219 |
9.1 | 0.0034 | NET NO AUTH LOW CX NO UI | NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerabil | |
|
78
|
CVE-2026-56245 |
8.8 | 0.0034 | NET NO AUTH LOW CX NO UI | Supabase Capgo before 12.128.2 contains an authorization bypass vulnerability in | |
|
77
|
CVE-2026-41680 |
8.7 | 0.0034 | NET NO AUTH LOW CX NO UI | Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Deni | |
|
77
|
CVE-2026-6823 |
8.3 | 0.0034 | NET NO AUTH LOW CX NO UI | HKUDS OpenHarness prior to PR #147 remediation contains an insecure default conf | |
|
75
|
CVE-2026-37454 |
7.5 | 0.0034 | NET NO AUTH LOW CX NO UI | Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 a | |
|
75
|
CVE-2026-116580 |
7.3 | 0.0034 | NET NO AUTH LOW CX NO UI | Seroval facilitates JavaScript value stringification, including complex structur | |
|
70
|
CVE-2026-91658 |
9.9 | 0.0034 | NET LOW CX NO UI | Vulnerability in Oracle Essbase (component: Security). The supported version t | |
|
70
|
CVE-2026-91663 |
9.9 | 0.0034 | NET LOW CX NO UI | Vulnerability in Oracle Essbase (component: Security). The supported version t | |
|
69
|
CVE-2026-45833 |
9.4 | 0.0034 | NET LOW CX NO UI | A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python | |
|
69
|
CVE-2026-103799 |
9.6 | 0.0034 | NET LOW CX NO UI | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1. | |
|
68
|
CVE-2026-6299 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Use after free in Prerender in Google Chrome prior to 147.0.7727.101 allowed a r | |
|
68
|
CVE-2026-6300 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Use after free in CSS in Google Chrome prior to 147.0.7727.101 allowed a remote | |
|
68
|
CVE-2026-6316 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Use after free in Forms in Google Chrome prior to 147.0.7727.101 allowed a remot | |
|
68
|
CVE-2026-6317 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Use after free in Cast in Google Chrome prior to 147.0.7727.101 allowed a remote | |
|
68
|
CVE-2026-92892 |
9.0 | 0.0034 | NET NO AUTH NO UI | Potential arbitrary code execution under specific configurations. Updated Octobe | |
|
68
|
CVE-2026-39318 |
8.8 | 0.0034 | NET LOW CX NO UI | ChurchCRM is an open-source church management system. Versions prior to 7.1.0 ha | |
|
68
|
CVE-2026-118331 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Improper input validation in FileAPI in Google Chrome prior to 156.0.8078.73 all | |
|
68
|
CVE-2026-118344 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Use after free in Layout in Google Chrome prior to 156.0.8078.73 allowed a remot | |
|
68
|
CVE-2026-118348 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowe | |
|
67
|
CVE-2026-45687 |
8.5 | 0.0034 | NET LOW CX NO UI | Rocket.Chat is an open-source, secure, fully customizable communications platfor | |
|
67
|
CVE-2026-58165 |
8.7 | 0.0034 | NET LOW CX NO UI | OpenZiti through 2.0.0, fixed in commit 3027fdf, contains a privilege escalation | |
|
66
|
CVE-2026-48064 |
8.1 | 0.0034 | NET NO AUTH NO UI | pam_usb provides hardware authentication for Linux using ordinary removable medi | |
|
66
|
CVE-2026-25439 |
8.1 | 0.0034 | NET NO AUTH NO UI | Authentication Bypass Using an Alternate Path or Channel vulnerability in Bookne | |
|
66
|
CVE-2026-42088 |
8.1 | 0.0034 | NET LOW CX NO UI | OpenC3 COSMOS provides the functionality needed to send commands to and receive | |
|
66
|
CVE-2026-13187 |
8.1 | 0.0034 | NET NO AUTH NO UI | In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider t | |
|
66
|
CVE-2026-93786 |
8.1 | 0.0034 | NET LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ksmbd: pres | |
|
65
|
CVE-2026-108334 |
7.4 | 0.0034 | NET LOW CX NO UI | A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant op | |
|
65
|
CVE-2026-14838 |
7.4 | 0.0034 | NET NO AUTH NO UI | Use of GET request method with sensitive query strings vulnerability in Bilin So | |
|
64
|
CVE-2026-60492 |
7.1 | 0.0034 | NET LOW CX NO UI | Vulnerability in the JD Edwards EnterpriseOne HCM Foundation product of Oracle J | |
|
64
|
CVE-2026-73617 |
7.1 | 0.0034 | NET LOW CX NO UI | Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB d | |
|
64
|
CVE-2026-53902 |
7.1 | 0.0034 | NET LOW CX NO UI | MCO does not properly enforce authorization checks in the /customer/servlet/mco/ | |
|
64
|
CVE-2026-39972 |
7.1 | 0.0034 | NET LOW CX NO UI | Mercure is a protocol for pushing data updates to web browsers and other HTTP cl | |
|
64
|
CVE-2026-74045 |
7.1 | 0.0034 | NET LOW CX NO UI | Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_ | |
|
59
|
CVE-2026-22615 |
7.2 | 0.0034 | NET LOW CX NO UI | Due to improper input validation in one of the Eaton Intelligent Power Protector | |
|
57
|
CVE-2026-12530 |
8.4 | 0.0034 | NET LOW CX | Improper neutralization of argument delimiters in the install_packages() method | |
|
57
|
CVE-2026-19173 |
8.3 | 0.0034 | NET NO AUTH | Out of bounds write in Skia in Google Chrome prior to 151.0.7922.109 allowed a r | |
|
57
|
CVE-2026-9203 |
8.5 | 0.0034 | NET NO UI | A server-side request forgery vulnerability in Progress MarkLogic Server before | |
|
55
|
CVE-2026-32824 |
7.3 | 0.0034 | NET LOW CX | dataCycle is a data management system for centrally storing, managing, searching | |
|
55
|
CVE-2026-32825 |
7.3 | 0.0034 | NET LOW CX | dataCycle is a data management system for centrally storing, managing, searching | |
|
50
|
CVE-2026-62594 |
7.7 | 0.0034 | NET NO UI | Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (compon |