Hunt List
12,406 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
78
|
CVE-2026-86414 |
9.1 | 0.0027 | NET NO AUTH LOW CX NO UI | An HTTP proxy can trick libcurl into sending the origin's credentials (Basic pas | |
|
78
|
CVE-2026-87861 |
9.1 | 0.0027 | NET NO AUTH LOW CX NO UI | When using ambient user credentials, an HTTP request directed to one origin may | |
|
78
|
CVE-2026-33771 |
9.1 | 0.0026 | NET NO AUTH LOW CX NO UI | A Weak Password Requirements vulnerability in the password management function o | |
|
77
|
CVE-2026-55206 |
8.7 | 0.0027 | NET NO AUTH LOW CX NO UI | py7zr is a Python-based library and utility to support 7zip archive compression, | |
|
77
|
CVE-2026-53591 |
8.6 | 0.0027 | NET NO AUTH LOW CX NO UI | FreeScout is a free help desk and shared inbox built with PHP's Laravel framewor | |
|
75
|
CVE-2026-42585 |
7.5 | 0.0027 | NET NO AUTH LOW CX NO UI | Netty is an asynchronous, event-driven network application framework. Prior to 4 | |
|
75
|
CVE-2026-27089 |
7.5 | 0.0027 | NET NO AUTH LOW CX NO UI | Unauthenticated Bypass Vulnerability in WpTravelly <= 2.1.7 versions. | |
|
75
|
CVE-2026-40069 |
7.5 | 0.0027 | NET NO AUTH LOW CX NO UI | BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.1.0 to before 0.8.2, | |
|
75
|
CVE-2026-44446 |
7.5 | 0.0027 | NET NO AUTH LOW CX NO UI | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15 | |
|
75
|
CVE-2026-57923 |
7.5 | 0.0027 | NET NO AUTH LOW CX NO UI | In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app conf | |
|
75
|
CVE-2026-43656 |
7.3 | 0.0027 | NET NO AUTH LOW CX NO UI | An out-of-bounds write issue was addressed with improved input validation. This | |
|
74
|
CVE-2026-57348 |
7.2 | 0.0027 | NET NO AUTH LOW CX NO UI | Unauthenticated Server Side Request Forgery (SSRF) in Paid Member Subscriptions | |
|
74
|
CVE-2026-57372 |
7.2 | 0.0027 | NET NO AUTH LOW CX NO UI | Server-Side Request Forgery (SSRF) vulnerability in denishua WPJAM Basic wpjam-b | |
|
74
|
CVE-2026-57407 |
7.2 | 0.0027 | NET NO AUTH LOW CX NO UI | Server-Side Request Forgery (SSRF) vulnerability in WP Swings PDF Generator for | |
|
74
|
CVE-2026-65516 |
7.2 | 0.0027 | NET NO AUTH LOW CX NO UI | Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice | |
|
74
|
CVE-2026-59552 |
7.2 | 0.0027 | NET NO AUTH LOW CX NO UI | Unauthenticated Server Side Request Forgery (SSRF) in 3D Flipbook PDF Viewer &am | |
|
74
|
CVE-2026-61953 |
7.2 | 0.0027 | NET NO AUTH LOW CX NO UI | Unauthenticated Server Side Request Forgery (SSRF) in Simple Link Directory Pro | |
|
74
|
CVE-2026-66704 |
7.2 | 0.0027 | NET NO AUTH LOW CX NO UI | Unauthenticated Server Side Request Forgery (SSRF) in Gutenverse Companion <= 2. | |
|
74
|
CVE-2026-32473 |
7.2 | 0.0027 | NET NO AUTH LOW CX NO UI | Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Eleme | |
|
74
|
CVE-2026-32553 |
7.2 | 0.0027 | NET NO AUTH LOW CX NO UI | Unauthenticated Server Side Request Forgery (SSRF) in OttoKit <= 1.1.35 versions | |
|
69
|
CVE-2026-44547 |
9.6 | 0.0026 | NET LOW CX NO UI | ChurchCRM is an open-source church management system. From 7.2.0 to 7.2.2, The f | |
|
69
|
CVE-2026-47413 |
9.6 | 0.0026 | NET LOW CX NO UI | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams sys | |
|
69
|
CVE-2026-47416 |
9.6 | 0.0026 | NET LOW CX NO UI | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams sys | |
|
68
|
CVE-2026-6359 |
8.8 | 0.0027 | NET NO AUTH LOW CX | Use after free in Video in Google Chrome on Windows prior to 147.0.7727.101 allo | |
|
68
|
CVE-2026-91303 |
8.8 | 0.0027 | NET NO AUTH LOW CX | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards | |
|
68
|
CVE-2026-59387 |
8.8 | 0.0027 | NET LOW CX NO UI | The Nginx routing configuration for Cloud Controller blocks unauthenticated acce | |
|
67
|
CVE-2024-58390 |
8.7 | 0.0027 | NET LOW CX NO UI | Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege man | |
|
67
|
CVE-2026-66298 |
8.6 | 0.0027 | NET NO AUTH LOW CX | Origin Validation Error vulnerability in livebook-dev livebook allows untrusted | |
|
67
|
CVE-2026-47135 |
8.7 | 0.0027 | NET NO AUTH NO UI | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, Symbol.fo | |
|
67
|
CVE-2026-41490 |
8.3 | 0.0027 | NET LOW CX NO UI | Dagster is an orchestration platform for the development, production, and observ | |
|
66
|
CVE-2026-35045 |
8.1 | 0.0027 | NET LOW CX NO UI | Tandoor Recipes is an application for managing recipes, planning meals, and buil | |
|
66
|
CVE-2026-40588 |
8.1 | 0.0027 | NET LOW CX NO UI | blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, the pass | |
|
66
|
CVE-2026-43913 |
8.1 | 0.0027 | NET LOW CX NO UI | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, V | |
|
66
|
CVE-2026-35277 |
8.1 | 0.0027 | NET LOW CX NO UI | Vulnerability in Oracle REST Data Services (component: Core). Supported version | |
|
66
|
CVE-2026-41895 |
8.2 | 0.0027 | NET NO AUTH NO UI | changedetection.io is a free open source web page change detection tool. In 0.54 | |
|
66
|
CVE-2026-87863 |
8.1 | 0.0027 | NET NO AUTH NO UI | An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser | |
|
66
|
CVE-2026-91342 |
8.2 | 0.0027 | NET NO AUTH LOW CX | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl | |
|
66
|
CVE-2026-43978 |
8.1 | 0.0027 | NET LOW CX NO UI | wger is a free, open-source workout and fitness manager. In versions prior to 2. | |
|
65
|
CVE-2026-59208 |
7.6 | 0.0027 | NET LOW CX NO UI | n8n is an open source workflow automation platform. Prior to 2.27.4 and from 2.2 | |
|
64
|
CVE-2026-41935 |
7.1 | 0.0027 | NET LOW CX NO UI | Vvveb before 1.0.8.3 contains an uncontrolled recursion vulnerability in the adm | |
|
59
|
CVE-2026-45008 |
7.0 | 0.0027 | NET LOW CX NO UI | phpMyFAQ before 4.1.2 contains a path traversal vulnerability in Client::deleteC | |
|
57
|
CVE-2026-8530 |
8.3 | 0.0027 | NET NO AUTH | Use after free in Network in Google Chrome on Windows prior to 148.0.7778.168 al | |
|
55
|
CVE-2026-45011 |
7.3 | 0.0027 | NET LOW CX | ApostropheCMS is an open-source Node.js content management system. Version 4.29. | |
|
55
|
CVE-2026-17898 |
7.5 | 0.0027 | NET NO AUTH | Use after free in DevTools in Google Chrome prior to 151.0.7922.72 allowed an at | |
|
55
|
CVE-2026-17948 |
7.5 | 0.0027 | NET NO AUTH | Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker | |
|
55
|
CVE-2026-19165 |
7.5 | 0.0027 | NET NO AUTH | Use after free in Extensions in Google Chrome prior to 151.0.7922.109 allowed an | |
|
55
|
CVE-2026-19558 |
7.5 | 0.0027 | NET NO AUTH | Use after free in Extensions in Google Chrome prior to 151.0.7922.137 allowed an | |
|
55
|
CVE-2026-68757 |
7.5 | 0.0027 | NET NO UI | A user with access to a valid SAML response may impersonate another user under s | |
|
54
|
CVE-2026-116807 |
7.0 | 0.0027 | NET LOW CX | OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authe | |
|
46
|
CVE-2026-93851 |
8.0 | 0.0027 | NET | Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail t |