Hunt List
12,830 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
79
|
CVE-2026-100752 |
9.3 | 0.0032 | NET NO AUTH LOW CX NO UI | Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate M | |
|
79
|
CVE-2026-101108 |
9.3 | 0.0032 | NET NO AUTH LOW CX NO UI | Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manag | |
|
78
|
CVE-2026-29204 |
9.1 | 0.0032 | NET NO AUTH LOW CX NO UI | Insufficient ownership check in `clientarea.php` allows an authenticated client | |
|
78
|
CVE-2026-86413 |
9.1 | 0.0032 | NET NO AUTH LOW CX NO UI | When using an *ambient user* in a first transfer doing Negotiate authentication | |
|
78
|
CVE-2025-71434 |
8.8 | 0.0032 | NET NO AUTH LOW CX NO UI | Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQ | |
|
78
|
CVE-2026-116176 |
8.8 | 0.0032 | NET NO AUTH LOW CX NO UI | vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerabili | |
|
77
|
CVE-2026-59251 |
8.7 | 0.0032 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits in Erlang/OTP public_key certificate path | |
|
77
|
CVE-2026-103604 |
8.7 | 0.0032 | NET NO AUTH LOW CX NO UI | Inefficient algorithmic complexity in X.509 distinguished name string conversion | |
|
77
|
CVE-2026-54848 |
8.3 | 0.0032 | NET NO AUTH LOW CX NO UI | Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal AP | |
|
77
|
CVE-2026-109956 |
8.3 | 0.0032 | NET NO AUTH LOW CX NO UI | NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier th | |
|
75
|
CVE-2026-22616 |
7.5 | 0.0032 | NET NO AUTH LOW CX NO UI | Eaton Intelligent Power Protector (IPP) software allows repeated authentication | |
|
75
|
CVE-2026-40562 |
7.5 | 0.0032 | NET NO AUTH LOW CX NO UI | Gazelle versions through 0.49 for Perl allows HTTP Request Smuggling via Imprope | |
|
75
|
CVE-2026-18568 |
7.5 | 0.0032 | NET NO AUTH LOW CX NO UI | XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification by | |
|
70
|
CVE-2026-44015 |
9.9 | 0.0032 | NET LOW CX NO UI | Nginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, | |
|
69
|
CVE-2026-13797 |
9.6 | 0.0032 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Chromecast in Google Chrome prior | |
|
69
|
CVE-2026-14056 |
9.6 | 0.0032 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Media in Google Chrome prior to 15 | |
|
69
|
CVE-2026-14093 |
9.6 | 0.0032 | NET NO AUTH LOW CX | Use after free in Cast in Google Chrome prior to 150.0.7871.47 allowed a remote | |
|
69
|
CVE-2026-14095 |
9.6 | 0.0032 | NET NO AUTH LOW CX | Insufficient policy enforcement in Browser in Google Chrome prior to 150.0.7871. | |
|
69
|
CVE-2026-14097 |
9.6 | 0.0032 | NET NO AUTH LOW CX | Inappropriate implementation in WebAppInstalls in Google Chrome on Mac prior to | |
|
69
|
CVE-2026-17803 |
9.6 | 0.0032 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Save to Drive in Google Chrome pri | |
|
69
|
CVE-2026-17848 |
9.6 | 0.0032 | NET NO AUTH LOW CX | Integer overflow in Codecs in Google Chrome prior to 151.0.7922.72 allowed a rem | |
|
69
|
CVE-2026-17987 |
9.6 | 0.0032 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Notifications in Google Chrome pri | |
|
69
|
CVE-2026-17990 |
9.6 | 0.0032 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in WebAuthn in Google Chrome prior to | |
|
69
|
CVE-2026-64877 |
9.4 | 0.0032 | NET LOW CX NO UI | An authenticated non-admin user can exploit a SQL injection flaw in the ticketin | |
|
69
|
CVE-2026-5288 |
9.6 | 0.0032 | NET NO AUTH LOW CX | Use after free in WebView in Google Chrome on Android prior to 146.0.7680.178 al | |
|
69
|
CVE-2026-5290 |
9.6 | 0.0032 | NET NO AUTH LOW CX | Use after free in Compositing in Google Chrome prior to 146.0.7680.178 allowed a | |
|
69
|
CVE-2026-55413 |
9.4 | 0.0032 | NET LOW CX NO UI | ToolJet is the open-source foundation am AI-native platform for building and dep | |
|
68
|
CVE-2026-34971 |
9.0 | 0.0032 | NET LOW CX NO UI | Wasmtime is a runtime for WebAssembly. From 32.0.0 to before 36.0.7, 42.0.2, and | |
|
68
|
CVE-2026-33618 |
8.8 | 0.0032 | NET LOW CX NO UI | Chamilo LMS is a learning management system. Prior to .0.0-RC.3, the PlatformCon | |
|
68
|
CVE-2026-40285 |
8.8 | 0.0032 | NET LOW CX NO UI | WeGIA is a web manager for charitable institutions. Versions prior to 3.6.10 con | |
|
68
|
CVE-2026-13026 |
8.8 | 0.0032 | NET NO AUTH LOW CX | Use after free in Digital Credentials in Google Chrome on Mac prior to 149.0.782 | |
|
68
|
CVE-2026-13027 |
8.8 | 0.0032 | NET NO AUTH LOW CX | Use after free in FileSystem in Google Chrome prior to 149.0.7827.197 allowed a | |
|
68
|
CVE-2026-13777 |
8.8 | 0.0032 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in iOSWeb in Google Chrome on iOS pri | |
|
68
|
CVE-2026-13783 |
8.8 | 0.0032 | NET NO AUTH LOW CX | Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote | |
|
68
|
CVE-2026-13784 |
8.8 | 0.0032 | NET NO AUTH LOW CX | Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote | |
|
68
|
CVE-2026-14084 |
8.8 | 0.0032 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Chromoting in Google Chrome prior | |
|
68
|
CVE-2026-14099 |
8.8 | 0.0032 | NET NO AUTH LOW CX | Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 | |
|
68
|
CVE-2026-15114 |
8.8 | 0.0032 | NET NO AUTH LOW CX | Out of bounds read and write in Codecs in Google Chrome prior to 150.0.7871.115 | |
|
68
|
CVE-2026-73222 |
8.8 | 0.0032 | NET NO AUTH LOW CX | Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. | |
|
68
|
CVE-2026-5292 |
8.8 | 0.0032 | NET NO AUTH LOW CX | Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed | |
|
66
|
CVE-2026-75048 |
8.2 | 0.0032 | NET NO AUTH LOW CX | In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block l | |
|
66
|
CVE-2026-110830 |
8.2 | 0.0032 | NET NO AUTH NO UI | FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_ | |
|
66
|
CVE-2026-110833 |
8.2 | 0.0032 | NET NO AUTH NO UI | FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute s | |
|
65
|
CVE-2026-60827 |
7.4 | 0.0032 | NET NO AUTH LOW CX | Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (compone | |
|
65
|
CVE-2026-70790 |
7.4 | 0.0032 | NET NO AUTH LOW CX | Vulnerability in the Oracle Telecommunications Billing Integrator product of Ora | |
|
64
|
CVE-2026-44647 |
7.1 | 0.0032 | NET LOW CX NO UI | OneDev is a Git server with CI/CD, kanban, and packages. Prior to 15.0.2, there | |
|
64
|
CVE-2026-8811 |
7.1 | 0.0032 | NET LOW CX NO UI | SEPPmail versions before 15.0.5 allow improper handling of attachment filenames | |
|
64
|
CVE-2026-119209 |
7.1 | 0.0032 | NET NO AUTH LOW CX | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf | |
|
57
|
CVE-2026-17735 |
8.7 | 0.0032 | NET LOW CX | Insufficient validation of untrusted input in BFCache in Google Chrome prior to | |
|
57
|
CVE-2026-46915 |
8.5 | 0.0032 | NET NO UI | Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of |