Hunt List
18,352 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-28575 |
10.0 | 0.0013 | NET NO AUTH LOW CX NO UI | In PackageInstaller.Session#transfer of frameworks/base/services/core/java/com/a | |
|
80
|
CVE-2026-0068 |
10.0 | 0.0012 | NET NO AUTH LOW CX NO UI | In createSessionInternal of PackageInstallerService.java, there is a possible me | |
|
80
|
CVE-2026-28615 |
10.0 | 0.0012 | NET NO AUTH LOW CX NO UI | In Telecomm, there is a possible way to initiate an unauthorized phone call due | |
|
80
|
CVE-2026-0064 |
10.0 | 0.0012 | NET NO AUTH LOW CX NO UI | In multiple places, there is a possible persistent denial of service due to reso | |
|
80
|
CVE-2026-0083 |
10.0 | 0.0012 | NET NO AUTH LOW CX NO UI | In Nfc::eventCallback() of Nfc.h, there is a possible use after free due to a ra | |
|
80
|
CVE-2026-28587 |
10.0 | 0.0011 | NET NO AUTH LOW CX NO UI | In MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve se | |
|
78
|
CVE-2026-108014 |
9.1 | 0.0013 | NET NO AUTH LOW CX NO UI | Private keys for eight eMudhra intermediate CA certificates have been compromis | |
|
78
|
CVE-2026-108015 |
9.1 | 0.0013 | NET NO AUTH LOW CX NO UI | Private keys for eight eMudhra intermediate CA certificates have been compromis | |
|
78
|
CVE-2026-42193 |
9.1 | 0.0013 | NET NO AUTH LOW CX NO UI | Plunk is an open-source email platform built on top of AWS SES. Prior to version | |
|
78
|
CVE-2026-121688 |
9.1 | 0.0012 | NET NO AUTH LOW CX NO UI | FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains an in | |
|
78
|
CVE-2026-8470 |
9.1 | 0.0011 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10. | |
|
77
|
CVE-2026-33779 |
8.3 | 0.0012 | NET NO AUTH LOW CX NO UI | An Improper Following of a Certificate's Chain of Trust vulnerability in J-Web o | |
|
76
|
CVE-2026-14540 |
8.0 | 0.0013 | NET NO AUTH LOW CX NO UI | A Server-Side Request Forgery (SSRF) vulnerability exists in the generic HTTP so | |
|
75
|
CVE-2026-121841 |
7.3 | 0.0013 | NET NO AUTH LOW CX NO UI | Other issue in Firefox for iOS. This vulnerability was fixed in Firefox for iOS | |
|
75
|
CVE-2026-34851 |
7.5 | 0.0013 | NET NO AUTH LOW CX NO UI | Race condition vulnerability in the event notification module. Impact: Successfu | |
|
75
|
CVE-2026-29140 |
7.7 | 0.0012 | NET NO AUTH LOW CX NO UI | SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to cause | |
|
75
|
CVE-2026-118782 |
7.5 | 0.0012 | NET NO AUTH LOW CX NO UI | Forge (also called node-forge) is a native implementation of Transport Layer Sec | |
|
75
|
CVE-2026-118558 |
7.3 | 0.0012 | NET NO AUTH LOW CX NO UI | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Stripe allows | |
|
75
|
CVE-2026-9758 |
7.3 | 0.0012 | NET NO AUTH LOW CX NO UI | Improper comparison with the certificates trusted list in S2OPC allows an attack | |
|
75
|
CVE-2026-121689 |
7.5 | 0.0011 | NET NO AUTH LOW CX NO UI | FrodoBots EarthRover Mini+ firmware (v6.2.4_6.2.5_0.614.0) exposes sensitive cre | |
|
68
|
CVE-2026-111841 |
8.8 | 0.0013 | NET NO AUTH LOW CX | Cross-Site Request Forgery (CSRF) vulnerability in Aman FunnelKit Automations wp | |
|
68
|
CVE-2026-122001 |
8.8 | 0.0013 | NET NO AUTH LOW CX | The Komfortkasse for WooCommerce WordPress plugin before 1.4.9 does not properly | |
|
68
|
CVE-2026-66669 |
8.8 | 0.0013 | NET NO AUTH LOW CX | Cross-Site Request Forgery (CSRF) vulnerability in Suplugins Superb Addons: Bloc | |
|
68
|
CVE-2026-122003 |
8.8 | 0.0010 | NET NO AUTH LOW CX | The Abilities Bridge WordPress plugin before 1.4.2 does not require a valid nonc | |
|
67
|
CVE-2026-28761 |
8.5 | 0.0013 | NET NO AUTH LOW CX | Cross-site request forgery vulnerability exists in Musetheque V4 Information Dis | |
|
66
|
CVE-2026-123591 |
8.2 | 0.0013 | NET NO AUTH NO UI | Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0. | |
|
66
|
CVE-2026-120317 |
8.2 | 0.0012 | NET NO AUTH NO UI | http4k from 4.9.10.0 before 6.60.0.0 contains a missing integrity check vulnerab | |
|
66
|
CVE-2026-121109 |
8.1 | 0.0012 | NET NO AUTH LOW CX | Inadequate encryption strength in SSL in Google Chrome prior to 157.0.8103.38 al | |
|
65
|
CVE-2026-119755 |
7.5 | 0.0013 | NET NO AUTH LOW CX | Tasmota through 16.0.0, fixed in commit 1cb7ebc, contains a cross-site request f | |
|
65
|
CVE-2026-120014 |
7.6 | 0.0012 | NET NO AUTH LOW CX | SAP HANA XSA Web Dispatcher does not perform sufficient request validation in ce | |
|
64
|
CVE-2025-62005 |
7.1 | 0.0014 | NET NO AUTH LOW CX | Cross-Site Request Forgery (CSRF) vulnerability in FantasticPlugins SUMO Members | |
|
64
|
CVE-2026-41057 |
7.1 | 0.0013 | NET NO AUTH LOW CX | WWBN AVideo is an open source video platform. In versions 29.0 and below, the CO | |
|
64
|
CVE-2026-57758 |
7.1 | 0.0013 | NET NO AUTH LOW CX | Unauthenticated Cross Site Request Forgery (CSRF) in Permalink Manager for WooCo | |
|
64
|
CVE-2026-57761 |
7.1 | 0.0013 | NET NO AUTH LOW CX | Unauthenticated Cross Site Request Forgery (CSRF) in SEOWP <= 3.12.2 versions. | |
|
64
|
CVE-2026-65539 |
7.1 | 0.0013 | NET NO AUTH LOW CX | Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 v | |
|
64
|
CVE-2026-65540 |
7.1 | 0.0013 | NET NO AUTH LOW CX | Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Al | |
|
64
|
CVE-2026-28172 |
7.1 | 0.0013 | NET NO AUTH LOW CX | Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2. | |
|
64
|
CVE-2026-123545 |
7.1 | 0.0012 | NET NO AUTH LOW CX | OpenAM from 14.5.1 before 16.1.4 contains a cross-site request forgery vulnerabi | |
|
64
|
CVE-2026-116880 |
7.1 | 0.0011 | NET NO AUTH LOW CX | Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery | |
|
64
|
CVE-2026-116839 |
7.1 | 0.0010 | NET NO AUTH LOW CX | A malicious actor who lures an authenticated user to a malicious page could expl | |
|
64
|
CVE-2026-109150 |
7.1 | 0.0009 | NET NO AUTH LOW CX | The WP PageNavi Style WordPress plugin through 1.4 does not sanitise and escape | |
|
55
|
CVE-2026-7948 |
7.5 | 0.0013 | NET NO AUTH | Race in Chromoting in Google Chrome on Windows prior to 148.0.7778.96 allowed a | |
|
55
|
CVE-2026-50044 |
7.6 | 0.0013 | NET NO UI | Pronetiqs IntraVUE versions 3.2.1a14 and prior have an inadequate encryption str | |
|
55
|
CVE-2026-34896 |
7.5 | 0.0012 | NET NO AUTH | Cross-Site Request Forgery (CSRF) vulnerability in Analytify Under Construction, | |
|
55
|
CVE-2026-34904 |
7.5 | 0.0012 | NET NO AUTH | Cross-Site Request Forgery (CSRF) vulnerability in Analytify Simple Social Media | |
|
55
|
CVE-2026-116194 |
7.6 | 0.0012 | NET NO AUTH | Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerabi | |
|
54
|
CVE-2026-101176 |
7.1 | 0.0013 | NET NO AUTH | Permission control vulnerability in the event notification management module. Im | |
|
54
|
CVE-2026-116247 |
7.1 | 0.0013 | NET NO UI | When a server in pgAdmin 4 had no password file, client certificate or client ke | |
|
50
|
CVE-2026-123538 |
7.5 | 0.0013 | NET NO UI | OpenAM before 16.1.4 does not verify that a signed SAML 1.x assertion or respons | |
|
46
|
CVE-2026-35266 |
7.9 | 0.0011 | NET | Vulnerability in Oracle REST Data Services (component: Core). Supported version |