Hunt List
13,357 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-76606 |
10.0 | 0.0050 | NET NO AUTH LOW CX NO UI | Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4 | |
|
80
|
CVE-2026-91323 |
9.8 | 0.0050 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware | |
|
80
|
CVE-2026-6443 |
9.8 | 0.0050 | NET NO AUTH LOW CX NO UI | All plugins by Essentialplugin for WordPress are vulnerable to an injected backd | |
|
80
|
CVE-2026-51380 |
9.8 | 0.0050 | NET NO AUTH LOW CX NO UI | Buffer Overflow vulnerability in Tenda AC10 v3 (firmware V03.03.16.09) allows at | |
|
79
|
CVE-2026-6885 |
9.3 | 0.0050 | NET NO AUTH LOW CX NO UI | Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has | |
|
79
|
CVE-2026-63106 |
9.3 | 0.0050 | NET NO AUTH LOW CX NO UI | ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerabil | |
|
79
|
CVE-2026-111693 |
9.3 | 0.0050 | NET NO AUTH LOW CX NO UI | DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vul | |
|
78
|
CVE-2026-41552 |
9.2 | 0.0050 | NET NO AUTH LOW CX NO UI | PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to | |
|
78
|
CVE-2026-62849 |
9.1 | 0.0050 | NET NO AUTH LOW CX NO UI | ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL | |
|
78
|
CVE-2026-49759 |
8.8 | 0.0050 | NET NO AUTH LOW CX NO UI | Stack-based Buffer Overflow vulnerability in Erlang OTP erts (inet_drv) allows a | |
|
78
|
CVE-2026-55884 |
9.2 | 0.0050 | NET NO AUTH LOW CX NO UI | Tilt defines dev environments as code for microservice apps on Kubernetes. From | |
|
78
|
CVE-2026-57830 |
8.8 | 0.0050 | NET NO AUTH LOW CX NO UI | Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in H | |
|
78
|
CVE-2026-75856 |
9.2 | 0.0050 | NET NO AUTH LOW CX NO UI | CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerabil | |
|
78
|
CVE-2026-26232 |
9.1 | 0.0050 | NET NO AUTH LOW CX NO UI | Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization co | |
|
78
|
CVE-2026-26247 |
9.1 | 0.0050 | NET NO AUTH LOW CX NO UI | Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge metho | |
|
77
|
CVE-2026-6376 |
8.7 | 0.0050 | NET NO AUTH LOW CX NO UI | A weakness in SpiceJet’s public booking retrieval page permits full passenger bo | |
|
76
|
CVE-2026-49982 |
8.2 | 0.0050 | NET NO AUTH LOW CX NO UI | tmp is a temporary file and directory creator for node.js. In version 0.2.6, the | |
|
75
|
CVE-2026-76290 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthentica | |
|
74
|
CVE-2026-42404 |
7.2 | 0.0050 | NET NO AUTH LOW CX NO UI | Apache Neethi does not impose any restrictions on URIs when manually fetching re | |
|
69
|
CVE-2026-113014 |
9.6 | 0.0050 | NET NO AUTH LOW CX | Missing authorization in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 | |
|
69
|
CVE-2026-113023 |
9.6 | 0.0050 | NET NO AUTH LOW CX | Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 al | |
|
69
|
CVE-2026-113089 |
9.6 | 0.0050 | NET NO AUTH LOW CX | Incorrect authorization in PrintPreview in Google Chrome prior to 156.0.8078.47 | |
|
69
|
CVE-2026-113235 |
9.6 | 0.0050 | NET NO AUTH LOW CX | Missing authorization in Passwords in Google Chrome prior to 156.0.8078.47 allow | |
|
69
|
CVE-2026-113252 |
9.6 | 0.0050 | NET NO AUTH LOW CX | Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.80 | |
|
69
|
CVE-2026-113300 |
9.6 | 0.0050 | NET NO AUTH LOW CX | Observable discrepancy in Forms in Google Chrome prior to 156.0.8078.47 allowed | |
|
69
|
CVE-2026-113328 |
9.6 | 0.0050 | NET NO AUTH LOW CX | Improper resource exposure in Privacy in Google Chrome prior to 156.0.8078.47 al | |
|
69
|
CVE-2026-113336 |
9.6 | 0.0050 | NET NO AUTH LOW CX | Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a | |
|
68
|
CVE-2026-71281 |
8.8 | 0.0050 | NET NO AUTH LOW CX | Hugging Face peft's LoRA-GA and CorDA initialization modules (src/peft/tuners/lo | |
|
68
|
CVE-2026-65542 |
8.8 | 0.0050 | NET NO AUTH LOW CX | Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions. | |
|
68
|
CVE-2026-108329 |
8.8 | 0.0050 | NET LOW CX NO UI | Tanium addressed an unauthorized code execution vulnerability in Threat Response | |
|
67
|
CVE-2026-61461 |
8.7 | 0.0050 | NET LOW CX NO UI | Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vec | |
|
67
|
CVE-2026-94422 |
8.7 | 0.0050 | NET NO AUTH LOW CX | An incorrect implementation of message filtering in xdg-dbus-proxy versions befo | |
|
67
|
CVE-2026-64835 |
8.7 | 0.0050 | NET NO AUTH LOW CX | FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnera | |
|
67
|
CVE-2026-45576 |
8.3 | 0.0050 | NET NO AUTH LOW CX | zrok is software for sharing web services, files, and network resources. From 0. | |
|
66
|
CVE-2026-116688 |
8.1 | 0.0050 | NET LOW CX NO UI | CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Fro | |
|
66
|
CVE-2026-97783 |
8.1 | 0.0050 | NET NO AUTH LOW CX | Improper neutralization of input during web page generation ('cross-site scripti | |
|
66
|
CVE-2026-19594 |
8.1 | 0.0050 | NET LOW CX NO UI | Insufficient input sanitization in Snowflake Python API (`snowflake.core`) versi | |
|
64
|
CVE-2026-13065 |
7.1 | 0.0050 | NET LOW CX NO UI | A user with read-only privileges is able to craft an aggregation pipeline using | |
|
64
|
CVE-2026-72910 |
7.1 | 0.0050 | NET LOW CX NO UI | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15 | |
|
64
|
CVE-2026-61444 |
9.4 | 0.0050 | NET LOW CX NO UI | PraisonAI versions before 4.6.78 contain a code injection vulnerability in deplo | |
|
64
|
CVE-2025-71436 |
7.1 | 0.0050 | NET NO AUTH LOW CX | Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffe | |
|
63
|
CVE-2026-35270 |
9.1 | 0.0050 | NET LOW CX NO UI | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
63
|
CVE-2026-104354 |
9.1 | 0.0050 | NET LOW CX NO UI | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia | |
|
63
|
CVE-2026-28306 |
9.1 | 0.0050 | NET LOW CX NO UI | SolarWinds Serv-U is affected by a privilege escalation vulnerability that allow | |
|
63
|
CVE-2026-28307 |
9.1 | 0.0050 | NET LOW CX NO UI | SolarWinds Serv-U is affected by a privilege escalation vulnerability that allow | |
|
63
|
CVE-2026-28309 |
9.1 | 0.0050 | NET LOW CX NO UI | SolarWinds Serv-U is affected by a broken access control vulnerability that allo | |
|
63
|
CVE-2026-28310 |
9.1 | 0.0050 | NET LOW CX NO UI | SolarWinds Serv-U is affected by a privilege escalation vulnerability that allow | |
|
57
|
CVE-2026-11400 |
8.6 | 0.0050 | NET LOW CX | An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced J | |
|
56
|
CVE-2025-2241 |
8.2 | 0.0050 | NET NO UI | A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced | |
|
55
|
CVE-2026-69805 |
7.5 | 0.0050 | NET NO AUTH | External control of file name or path in .NET allows an unauthorized attacker to |