Hunt List
12,263 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-25208 |
9.8 | 0.0025 | NET NO AUTH LOW CX NO UI | Integer overflow vulnerability in Samsung Open Source Escargot allows Overflow B | |
|
79
|
CVE-2026-16822 |
9.3 | 0.0025 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to i | |
|
78
|
CVE-2026-114820 |
9.1 | 0.0025 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente | |
|
78
|
CVE-2026-25209 |
9.1 | 0.0025 | NET NO AUTH LOW CX NO UI | Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource | |
|
78
|
CVE-2026-12315 |
9.1 | 0.0025 | NET NO AUTH LOW CX NO UI | Mitigation bypass in the DOM: Security component. This vulnerability was fixed i | |
|
78
|
CVE-2026-14571 |
9.1 | 0.0025 | NET NO AUTH LOW CX NO UI | A Blind SQL Injection vulnerability in Futurum Software’s management software, c | |
|
78
|
CVE-2026-7300 |
8.8 | 0.0025 | NET NO AUTH LOW CX NO UI | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerabi | |
|
76
|
CVE-2026-54184 |
8.2 | 0.0025 | NET NO AUTH LOW CX NO UI | Unauthenticated Insecure Direct Object References (IDOR) in Clean Login <= 1.15 | |
|
76
|
CVE-2026-29143 |
7.8 | 0.0025 | NET NO AUTH LOW CX NO UI | SEPPmail Secure Email Gateway before version 15.0.3 does not properly authentica | |
|
76
|
CVE-2026-14541 |
8.0 | 0.0025 | NET NO AUTH LOW CX NO UI | An authentication bypass and audience confusion vulnerability exists in the Goog | |
|
76
|
CVE-2026-32992 |
8.2 | 0.0025 | NET NO AUTH LOW CX NO UI | SSL verification is disabled in the DNS Cluster system. This could allow for a m | |
|
76
|
CVE-2026-14537 |
8.1 | 0.0025 | NET NO AUTH LOW CX NO UI | Incorrect Authorization in the direct HTTP API tool invocation endpoint in Googl | |
|
76
|
CVE-2020-37287 |
8.2 | 0.0025 | NET NO AUTH LOW CX NO UI | Vyper before 0.2.6 contains a call stack corruption vulnerability that causes in | |
|
75
|
CVE-2026-6782 |
7.5 | 0.0025 | NET NO AUTH LOW CX NO UI | Information disclosure in the IP Protection component. This vulnerability was fi | |
|
75
|
CVE-2026-35245 |
7.5 | 0.0025 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp | |
|
75
|
CVE-2026-15637 |
7.5 | 0.0025 | NET NO AUTH LOW CX NO UI | Improper authorization in the PAM SSH key and certificate retrieval endpoints i | |
|
75
|
CVE-2026-72544 |
7.5 | 0.0025 | NET NO AUTH LOW CX NO UI | An integrity verification vulnerability in OpenSignLabs OpenSign through 2.37.0 | |
|
75
|
CVE-2026-12310 |
7.5 | 0.0025 | NET NO AUTH LOW CX NO UI | Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Fire | |
|
75
|
CVE-2026-12312 |
7.5 | 0.0025 | NET NO AUTH LOW CX NO UI | Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Fire | |
|
75
|
CVE-2026-12314 |
7.5 | 0.0025 | NET NO AUTH LOW CX NO UI | Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Fire | |
|
69
|
CVE-2026-5779 |
9.4 | 0.0025 | NET LOW CX NO UI | An insecure direct object reference (IDOR) vulnerability in MphRx's Minerva V3.6 | |
|
69
|
CVE-2026-12440 |
9.6 | 0.0025 | NET NO AUTH LOW CX | Use after free in DigitalCredentials in Google Chrome on Windows prior to 149.0. | |
|
68
|
CVE-2022-45846 |
8.8 | 0.0025 | NET NO AUTH LOW CX | Cross-Site Request Forgery (CSRF) vulnerability in Nickys Image Map Pro for Word | |
|
68
|
CVE-2026-39334 |
8.8 | 0.0025 | NET LOW CX NO UI | ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL inj | |
|
68
|
CVE-2026-6360 |
8.8 | 0.0025 | NET NO AUTH LOW CX | Use after free in FileSystem in Google Chrome prior to 147.0.7727.101 allowed a | |
|
68
|
CVE-2026-108303 |
8.8 | 0.0025 | NET LOW CX NO UI | Tanium addressed an unauthorized code execution vulnerability in Certificate Man | |
|
68
|
CVE-2026-8577 |
8.8 | 0.0025 | NET NO AUTH LOW CX | Integer overflow in Fonts in Google Chrome prior to 148.0.7778.168 allowed a rem | |
|
67
|
CVE-2026-57829 |
8.7 | 0.0025 | NET NO AUTH LOW CX | Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Helix Ultimate | |
|
67
|
CVE-2026-18084 |
8.6 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation vulnerability in Bla | |
|
67
|
CVE-2026-24637 |
8.5 | 0.0025 | NET LOW CX NO UI | Contributor SQL Injection in PowerPress Podcasting <= 11.15.10 versions. | |
|
67
|
CVE-2026-61430 |
8.4 | 0.0025 | NET LOW CX NO UI | PraisonAI before 1.6.78 contains a server-side request forgery vulnerability in | |
|
67
|
CVE-2026-52754 |
8.7 | 0.0025 | NET LOW CX NO UI | Ghidra before 12.1 contains an authentication bypass vulnerability in PKIAuthent | |
|
67
|
CVE-2026-47158 |
8.3 | 0.0025 | NET NO AUTH LOW CX | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, V | |
|
66
|
CVE-2026-12746 |
8.1 | 0.0025 | NET NO AUTH LOW CX | Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not supp | |
|
66
|
CVE-2026-11348 |
8.1 | 0.0025 | NET NO AUTH NO UI | Improper verification of cryptographic signature vulnerability in HAVELSAN Inc. | |
|
66
|
CVE-2026-18098 |
8.1 | 0.0025 | NET LOW CX NO UI | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obta | |
|
65
|
CVE-2026-65824 |
7.4 | 0.0025 | NET NO AUTH NO UI | OpenReception's appointment booking software provides an end-to-end encrypted ap | |
|
64
|
CVE-2026-116016 |
7.1 | 0.0025 | NET LOW CX NO UI | yudao-cloud through 2026.09 contains an authorization bypass vulnerability that | |
|
64
|
CVE-2026-114694 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-42749 |
7.1 | 0.0025 | NET LOW CX NO UI | Authentication Bypass Using an Alternate Path or Channel vulnerability in Themei | |
|
64
|
CVE-2026-118038 |
7.1 | 0.0025 | NET LOW CX NO UI | In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027 | |
|
59
|
CVE-2026-39325 |
7.2 | 0.0025 | NET LOW CX NO UI | ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL inj | |
|
58
|
CVE-2026-58424 |
8.9 | 0.0025 | NET LOW CX | Permanent Fork PR Workflow Approval Gate Bypass | |
|
57
|
CVE-2026-8512 |
8.3 | 0.0025 | NET NO AUTH | Use after free in FileSystem in Google Chrome prior to 148.0.7778.168 allowed a | |
|
57
|
CVE-2026-12019 |
8.3 | 0.0025 | NET NO AUTH | Heap buffer overflow in Codecs in Google Chrome on Linux and ChromeOS prior to 1 | |
|
57
|
CVE-2026-6304 |
8.3 | 0.0025 | NET NO AUTH | Use after free in Graphite in Google Chrome prior to 147.0.7727.101 allowed a re | |
|
57
|
CVE-2026-6309 |
8.3 | 0.0025 | NET NO AUTH | Use after free in Viz in Google Chrome prior to 147.0.7727.101 allowed a remote | |
|
57
|
CVE-2026-6310 |
8.3 | 0.0025 | NET NO AUTH | Use after free in Dawn in Google Chrome prior to 147.0.7727.101 allowed a remote | |
|
57
|
CVE-2026-14412 |
8.3 | 0.0025 | NET NO AUTH | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 15 | |
|
54
|
CVE-2026-6967 |
7.1 | 0.0025 | NET NO UI | Missing expiration, hash, and length enforcement in delegated metadata validatio |