Hunt List
13,248 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
90
|
CVE-2026-103039 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | 1 PoC | The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in |
|
80
|
CVE-2026-70689 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in Oracle Essbase (component: Infrastructure). The supported ver | |
|
80
|
CVE-2026-70739 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyper | |
|
80
|
CVE-2026-70740 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyper | |
|
80
|
CVE-2026-70745 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyper | |
|
80
|
CVE-2026-70817 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype | |
|
80
|
CVE-2026-70871 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora | |
|
80
|
CVE-2026-70873 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora | |
|
80
|
CVE-2026-70905 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware ( | |
|
80
|
CVE-2026-70926 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (compone | |
|
80
|
CVE-2026-70953 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (compon | |
|
80
|
CVE-2026-70954 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (compon | |
|
80
|
CVE-2026-70970 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware | |
|
80
|
CVE-2026-70995 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
80
|
CVE-2026-71074 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
80
|
CVE-2026-71152 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
80
|
CVE-2026-71164 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
80
|
CVE-2026-73905 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
80
|
CVE-2026-73912 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
80
|
CVE-2026-73921 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
80
|
CVE-2026-9074 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains | |
|
80
|
CVE-2026-61737 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | ng-antd-admin is an Angular and NestJS administration system template. Prior to | |
|
79
|
CVE-2026-72742 |
9.2 | 0.0051 | NET NO AUTH LOW CX NO UI | DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio o | |
|
79
|
CVE-2026-52735 |
9.3 | 0.0051 | NET NO AUTH LOW CX NO UI | ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, Zebra can accept | |
|
79
|
CVE-2026-32311 |
9.3 | 0.0051 | NET NO AUTH LOW CX NO UI | Flowsint is an open-source OSINT graph exploration tool designed for cybersecuri | |
|
78
|
CVE-2026-110685 |
9.1 | 0.0051 | NET NO AUTH LOW CX NO UI | Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a t | |
|
78
|
CVE-2026-33654 |
8.9 | 0.0051 | NET NO AUTH LOW CX NO UI | nanobot is a personal AI assistant. Prior to version 0.1.6, an indirect prompt i | |
|
78
|
CVE-2026-73569 |
8.7 | 0.0051 | NET NO AUTH LOW CX NO UI | fast-xml-parser allows users to process XML from JS object without C/C++ based l | |
|
78
|
CVE-2026-119762 |
8.7 | 0.0051 | NET NO AUTH LOW CX NO UI | Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7 | |
|
77
|
CVE-2026-58295 |
8.3 | 0.0051 | NET NO AUTH LOW CX NO UI | Access of resource using incompatible type ('type confusion') in Microsoft Edge | |
|
77
|
CVE-2026-44981 |
8.2 | 0.0051 | NET NO AUTH LOW CX NO UI | CrowdSec offers crowdsourced protection against malicious IPs. From 1.7.0 until | |
|
75
|
CVE-2026-34652 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2 | |
|
75
|
CVE-2026-11625 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | Bytes::Random::Secure versions through 0.29 for Perl share internal state across | |
|
75
|
CVE-2026-11702 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state | |
|
75
|
CVE-2026-14570 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private | |
|
75
|
CVE-2026-34501 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redi | |
|
75
|
CVE-2026-34502 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memc | |
|
75
|
CVE-2026-75589 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINT | |
|
75
|
CVE-2026-50756 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtai | |
|
75
|
CVE-2026-10849 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body | |
|
75
|
CVE-2026-113728 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior | |
|
70
|
CVE-2026-52855 |
9.9 | 0.0051 | NET LOW CX NO UI | Wings is the server control plane for Pterodactyl, a free, open-source game serv | |
|
69
|
CVE-2026-76036 |
9.6 | 0.0051 | NET NO AUTH LOW CX | Buffer overflow in Dawn in Google Chrome on on Android prior to 151.0.7922.169 a | |
|
68
|
CVE-2026-62190 |
8.7 | 0.0051 | NET LOW CX NO UI | OpenClaw versions before 2026.6.9 contain an authorization bypass vulnerability | |
|
68
|
CVE-2026-67343 |
8.7 | 0.0051 | NET LOW CX NO UI | ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the | |
|
68
|
CVE-2026-34168 |
8.8 | 0.0051 | NET LOW CX NO UI | Coolify is an open-source and self-hostable tool for managing servers, applicati | |
|
68
|
CVE-2024-56835 |
8.7 | 0.0051 | NET LOW CX NO UI | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.1 | |
|
67
|
CVE-2026-18830 |
8.6 | 0.0051 | NET LOW CX NO UI | Insufficient input validation in Amazon Bedrock AgentCore harness might allow an | |
|
66
|
CVE-2026-50738 |
7.7 | 0.0051 | NET LOW CX NO UI | A use-after-free condition exists in pglogical's worker signaling code, where a | |
|
55
|
CVE-2026-53599 |
7.5 | 0.0051 | NET NO UI | REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_m |