Hunt List
12,786 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-62643 |
10.0 | 0.0029 | NET NO AUTH LOW CX NO UI | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascadin | |
|
80
|
CVE-2026-15721 |
9.8 | 0.0029 | NET NO AUTH LOW CX NO UI | Cleartext storage of sensitive information vulnerability in Bilin Software and I | |
|
79
|
CVE-2026-46395 |
9.3 | 0.0029 | NET NO AUTH LOW CX NO UI | HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to ve | |
|
79
|
CVE-2026-39511 |
9.3 | 0.0029 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions. | |
|
79
|
CVE-2026-42727 |
9.3 | 0.0029 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
78
|
CVE-2026-34184 |
8.8 | 0.0029 | NET NO AUTH LOW CX NO UI | AlanWeb SCADA does not enforce authorization for some directories. This allows a | |
|
77
|
CVE-2026-64619 |
8.7 | 0.0029 | NET NO AUTH LOW CX NO UI | FileCodeBox before 2.4 contains a rate-limit bypass vulnerability in the IPRateL | |
|
77
|
CVE-2026-67198 |
8.7 | 0.0029 | NET NO AUTH LOW CX NO UI | Perspective 5.0.0 contains a denial-of-service vulnerability in the VirtualServe | |
|
76
|
CVE-2026-63770 |
8.2 | 0.0029 | NET NO AUTH LOW CX NO UI | Glance through 0.8.5 contains an IP address spoofing vulnerability in the authen | |
|
76
|
CVE-2026-103601 |
8.2 | 0.0029 | NET NO AUTH LOW CX NO UI | Release of unverified plaintext in the CCM (CcmBlockCipher) and DSTU 7624 CCM (K | |
|
76
|
CVE-2026-114117 |
8.2 | 0.0029 | NET NO AUTH LOW CX NO UI | Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.v | |
|
75
|
CVE-2026-35597 |
7.5 | 0.0030 | NET NO AUTH LOW CX NO UI | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, | |
|
75
|
CVE-2026-49057 |
7.5 | 0.0030 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in JobSearch <= 3.2.7 versions. | |
|
75
|
CVE-2026-6780 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | Denial-of-service in the Audio/Video: Playback component. This vulnerability was | |
|
75
|
CVE-2026-6781 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | Denial-of-service in the Audio/Video: Playback component. This vulnerability was | |
|
75
|
CVE-2026-40789 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in Amelia <= 2.2 versions. | |
|
75
|
CVE-2026-42384 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in Simply Schedule Appointments < 1.6.11 | |
|
75
|
CVE-2026-49066 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in Conekta Payment Gateway <= 6.0.0 vers | |
|
74
|
CVE-2026-96666 |
7.2 | 0.0030 | NET NO AUTH LOW CX NO UI | The Schema App Structured Data plugin for WordPress is vulnerable to Stored Cros | |
|
74
|
CVE-2026-114639 |
7.0 | 0.0029 | NET NO AUTH LOW CX NO UI | Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication | |
|
69
|
CVE-2026-118316 |
9.6 | 0.0029 | NET NO AUTH LOW CX | Improper input validation in V8 in Google Chrome prior to 156.0.8078.73 allowed | |
|
69
|
CVE-2026-118332 |
9.6 | 0.0029 | NET NO AUTH LOW CX | Improper input validation in Compositing in Google Chrome prior to 156.0.8078.73 | |
|
69
|
CVE-2026-118342 |
9.6 | 0.0029 | NET NO AUTH LOW CX | Out of bounds write in Editing in Google Chrome prior to 156.0.8078.73 allowed a | |
|
69
|
CVE-2026-118355 |
9.6 | 0.0029 | NET NO AUTH LOW CX | Improper input validation in Command in Google Chrome prior to 156.0.8078.73 all | |
|
68
|
CVE-2026-105779 |
9.1 | 0.0029 | NET LOW CX NO UI | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia | |
|
68
|
CVE-2026-13850 |
8.8 | 0.0029 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on | |
|
67
|
CVE-2026-47196 |
8.4 | 0.0030 | NET LOW CX NO UI | Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the automod add | |
|
67
|
CVE-2026-69088 |
8.6 | 0.0029 | NET LOW CX NO UI | Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static m | |
|
67
|
CVE-2026-71576 |
8.5 | 0.0029 | NET LOW CX NO UI | A flaw was found in multicluster-global-hub. The manager component improperly va | |
|
67
|
CVE-2026-59979 |
8.3 | 0.0029 | NET LOW CX NO UI | YosemiteCrew provides organization-based service and task management. In the sou | |
|
67
|
CVE-2026-63153 |
8.6 | 0.0029 | NET LOW CX NO UI | Omnispace Agora Project before 26.10.0 contains a broken access control vulnerab | |
|
66
|
CVE-2026-92709 |
8.1 | 0.0030 | NET NO AUTH NO UI | Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.26 | |
|
66
|
CVE-2026-65895 |
8.2 | 0.0029 | NET NO AUTH NO UI | Grav API Plugin versions before 1.0.10 fail to restrict write access to security | |
|
65
|
CVE-2026-33667 |
7.4 | 0.0030 | NET NO AUTH NO UI | OpenProject is an open-source project management application. In versions prior | |
|
65
|
CVE-2026-48505 |
7.4 | 0.0030 | NET NO AUTH NO UI | Filament is a collection of full-stack components for accelerated Laravel develo | |
|
65
|
CVE-2026-73086 |
7.4 | 0.0030 | NET NO AUTH NO UI | nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Pri | |
|
64
|
CVE-2026-63095 |
7.1 | 0.0030 | NET LOW CX NO UI | Dendrite through 0.13.8 contains an improper authorization vulnerability in the | |
|
64
|
CVE-2026-101735 |
7.1 | 0.0030 | NET LOW CX NO UI | Vulnerability in the Primavera Unifier product of Oracle Construction and Engine | |
|
64
|
CVE-2026-13442 |
7.1 | 0.0029 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to reuse another use | |
|
64
|
CVE-2026-67618 |
7.1 | 0.0029 | NET NO AUTH LOW CX | marimo before 0.23.15 contains a configuration injection vulnerability that allo | |
|
64
|
CVE-2026-75109 |
7.1 | 0.0029 | NET LOW CX NO UI | Determined fails to authorize requests on the generic task kill, pause, and unpa | |
|
59
|
CVE-2026-35572 |
7.0 | 0.0030 | NET LOW CX NO UI | ChurchCRM is an open-source church management system. Prior to 6.5.3, it is poss | |
|
59
|
CVE-2026-33518 |
7.2 | 0.0029 | NET LOW CX NO UI | An incorrect privilege assignment vulnerability exists in Esri Portal for ArcGIS | |
|
59
|
CVE-2026-94347 |
7.2 | 0.0029 | NET LOW CX NO UI | PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 throu | |
|
59
|
CVE-2026-40827 |
7.0 | 0.0029 | NET LOW CX NO UI | A high privileged remote attacker can exploit an unauthenticated SQL Injection v | |
|
59
|
CVE-2026-40828 |
7.0 | 0.0029 | NET LOW CX NO UI | A high privileged remote attacker can exploit an unauthenticated SQL Injection v | |
|
59
|
CVE-2026-40829 |
7.0 | 0.0029 | NET LOW CX NO UI | A high privileged remote attacker can exploit an unauthenticated SQL Injection v | |
|
59
|
CVE-2026-40830 |
7.0 | 0.0029 | NET LOW CX NO UI | A high privileged remote attacker can exploit an unauthenticated SQL Injection v | |
|
58
|
CVE-2026-45750 |
9.0 | 0.0029 | NET LOW CX | Termix is a web-based server management platform with SSH terminal, tunneling, a | |
|
56
|
CVE-2026-65597 |
8.2 | 0.0030 | NET LOW CX | n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based c |