Hunt List
12,276 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-5735 |
9.8 | 0.0026 | NET NO AUTH LOW CX NO UI | Memory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1. Some of t | |
|
80
|
CVE-2026-41153 |
9.8 | 0.0026 | NET NO AUTH LOW CX NO UI | In JetBrains Junie before 252.549.29 command execution was possible via maliciou | |
|
79
|
CVE-2026-42300 |
9.3 | 0.0026 | NET NO AUTH LOW CX NO UI | DevGuard provides vulnerability management for the full software supply chain. P | |
|
78
|
CVE-2026-92388 |
9.1 | 0.0026 | NET NO AUTH LOW CX NO UI | When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path | |
|
77
|
CVE-2026-9221 |
8.7 | 0.0026 | NET NO AUTH LOW CX NO UI | The Setracker2 Android Companion App (com.tgelec.setracker) versions 3.1.5 and e | |
|
77
|
CVE-2026-4931 |
8.6 | 0.0026 | NET NO AUTH LOW CX NO UI | Smart contract Marginal v1 performs unsafe downcast, allowing attackers to settl | |
|
77
|
CVE-2026-44700 |
8.7 | 0.0026 | NET NO AUTH LOW CX NO UI | Elixir WebRTC is an Elixir implementation of the W3C WebRTC API. Prior to 0.15.1 | |
|
77
|
CVE-2026-60085 |
8.7 | 0.0026 | NET NO AUTH LOW CX NO UI | PraisonAI before 4.6.78 contains an unenforced security policy vulnerability in | |
|
76
|
CVE-2026-9535 |
8.2 | 0.0026 | NET NO AUTH LOW CX NO UI | A out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 func | |
|
76
|
CVE-2026-57959 |
8.2 | 0.0026 | NET NO AUTH LOW CX NO UI | Hi.Events through 1.9.0 contains a promo code validation vulnerability where res | |
|
76
|
CVE-2026-42735 |
8.2 | 0.0026 | NET NO AUTH LOW CX NO UI | Authentication Bypass Using an Alternate Path or Channel vulnerability in Iqonic | |
|
75
|
CVE-2024-29371 |
7.5 | 0.0026 | NET NO AUTH LOW CX NO UI | In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) conditio | |
|
75
|
CVE-2026-6766 |
7.5 | 0.0026 | NET NO AUTH LOW CX NO UI | Incorrect boundary conditions in the Libraries component in NSS. This vulnerabil | |
|
75
|
CVE-2026-54425 |
7.5 | 0.0026 | NET NO AUTH LOW CX NO UI | Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 | |
|
75
|
CVE-2026-44826 |
7.5 | 0.0026 | NET NO AUTH LOW CX NO UI | Vvveb is a powerful and easy to use CMS with page builder to build websites, blo | |
|
75
|
CVE-2026-42736 |
7.5 | 0.0026 | NET NO AUTH LOW CX NO UI | Authorization Bypass Through User-Controlled Key vulnerability in wordplus BP Be | |
|
75
|
CVE-2026-22743 |
7.5 | 0.0026 | NET NO AUTH LOW CX NO UI | Spring AI's spring-ai-neo4j-store contains a Cypher injection vulnerability in N | |
|
75
|
CVE-2026-22744 |
7.5 | 0.0026 | NET NO AUTH LOW CX NO UI | In RedisFilterExpressionConverter of spring-ai-redis-store, when a user-controll | |
|
75
|
CVE-2026-86977 |
7.5 | 0.0026 | NET NO AUTH LOW CX NO UI | An authorization issue was addressed with improved network restrictions. This is | |
|
69
|
CVE-2026-55486 |
9.3 | 0.0026 | NET NO AUTH LOW CX | The Goobi viewer is a web application that allows digitised material to be displ | |
|
69
|
CVE-2026-16419 |
9.6 | 0.0026 | NET NO AUTH LOW CX | Out of bounds read and write in ANGLE in Google Chrome on Android prior to 150.0 | |
|
68
|
CVE-2026-65220 |
8.8 | 0.0026 | NET LOW CX NO UI | A logic flaw in the BMC IPMI implementation may allow an attacker to send specia | |
|
68
|
CVE-2026-12452 |
8.8 | 0.0026 | NET NO AUTH LOW CX | Use after free in Downloads in Google Chrome on Android prior to 149.0.7827.155 | |
|
68
|
CVE-2026-72578 |
8.8 | 0.0026 | NET NO AUTH LOW CX | A cross-site request forgery (CSRF) vulnerability in FreePBX Framework 17.0 allo | |
|
68
|
CVE-2026-12448 |
8.8 | 0.0026 | NET NO AUTH LOW CX | Inappropriate implementation in WebView in Google Chrome on Android prior to 149 | |
|
68
|
CVE-2026-59229 |
8.8 | 0.0026 | NET LOW CX NO UI | The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a hardcoded SU | |
|
67
|
CVE-2026-71272 |
8.5 | 0.0026 | NET LOW CX NO UI | Memos' webhook dispatch function safeDialContext (internal/webhook/webhook.go) r | |
|
67
|
CVE-2026-72741 |
8.6 | 0.0026 | NET LOW CX NO UI | Rainbond through 6.9.7 contains a broken access control vulnerability in the Che | |
|
67
|
CVE-2026-34428 |
8.3 | 0.0026 | NET LOW CX NO UI | Vvveb prior to 1.0.8.1 contains a server-side request forgery vulnerability in t | |
|
67
|
CVE-2026-58497 |
8.6 | 0.0026 | NET NO AUTH LOW CX | Uni-CLI gives people and agents one command interface for websites, browsers, de | |
|
67
|
CVE-2026-85299 |
8.3 | 0.0026 | NET LOW CX NO UI | A Missing Authorization vulnerability in the disks.createSnapshot and regionDisk | |
|
66
|
CVE-2026-39884 |
8.1 | 0.0026 | NET LOW CX NO UI | mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster | |
|
66
|
CVE-2026-92389 |
8.1 | 0.0026 | NET NO AUTH NO UI | libcurl's TFTP state machine fails to validate state transitions against the req | |
|
66
|
CVE-2026-112852 |
8.1 | 0.0026 | NET NO AUTH NO UI | Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion | |
|
66
|
CVE-2026-8018 |
8.1 | 0.0026 | NET NO AUTH NO UI | Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778 | |
|
65
|
CVE-2026-96581 |
7.6 | 0.0026 | NET LOW CX NO UI | Authorization Bypass Through User-Controlled Key vulnerability in ash-project as | |
|
65
|
CVE-2023-29054 |
7.4 | 0.0026 | NET NO AUTH NO UI | A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5 | |
|
64
|
CVE-2026-8199 |
7.1 | 0.0026 | NET LOW CX NO UI | An authenticated user can cause excess memory usage via bitwise match expression | |
|
64
|
CVE-2026-54040 |
7.1 | 0.0026 | NET LOW CX NO UI | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prio | |
|
64
|
CVE-2026-109341 |
7.1 | 0.0026 | NET LOW CX NO UI | SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allow | |
|
62
|
CVE-2026-39459 |
8.6 | 0.0026 | NET LOW CX NO UI | A vulnerability exists in iControl REST and the TMOS Shell (tmsh) where a highly | |
|
57
|
CVE-2026-53608 |
8.7 | 0.0026 | NET LOW CX | ApostropheCMS is an open-source Node.js content management system. Versions up t | |
|
55
|
CVE-2026-109089 |
7.5 | 0.0026 | NET NO AUTH | A buffer overflow when handling DEVICE_RESOLUTION in libXi before 1.8.4 could ov | |
|
55
|
CVE-2026-109090 |
7.5 | 0.0026 | NET NO AUTH | A malicious X server could cause a heap overflow by injecting a large DEVICE_ENA | |
|
55
|
CVE-2026-8547 |
7.5 | 0.0026 | NET NO AUTH | Insufficient policy enforcement in Passwords in Google Chrome on Windows prior t | |
|
55
|
CVE-2026-17952 |
7.5 | 0.0026 | NET NO AUTH | Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.72 allow | |
|
55
|
CVE-2026-8336 |
7.7 | 0.0026 | NET NO UI | After invoking $_internalJsEmit, which is not intended to be directly accessible | |
|
54
|
CVE-2026-41272 |
7.1 | 0.0026 | NET NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
49
|
CVE-2026-101822 |
7.2 | 0.0026 | NET NO UI | Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite | |
|
42
|
CVE-2026-92744 |
8.7 | 0.0026 | NET | Under certain conditions, privilege manager agent allows a remote unauthenticate |