Hunt List
13,762 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-51380 |
9.8 | 0.0050 | NET NO AUTH LOW CX NO UI | Buffer Overflow vulnerability in Tenda AC10 v3 (firmware V03.03.16.09) allows at | |
|
80
|
CVE-2026-91299 |
10.0 | 0.0049 | NET NO AUTH LOW CX NO UI | Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD | |
|
79
|
CVE-2026-111693 |
9.3 | 0.0050 | NET NO AUTH LOW CX NO UI | DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vul | |
|
79
|
CVE-2026-75837 |
9.3 | 0.0049 | NET NO AUTH LOW CX NO UI | Grav before 2.0.14 fails to guard the access field in the core group blueprint w | |
|
78
|
CVE-2026-75856 |
9.2 | 0.0050 | NET NO AUTH LOW CX NO UI | CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerabil | |
|
78
|
CVE-2026-26232 |
9.1 | 0.0050 | NET NO AUTH LOW CX NO UI | Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization co | |
|
78
|
CVE-2026-26247 |
9.1 | 0.0050 | NET NO AUTH LOW CX NO UI | Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge metho | |
|
78
|
CVE-2026-13221 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 befo | |
|
78
|
CVE-2026-47040 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Net Services component of Oracle Database Server. S | |
|
78
|
CVE-2026-61130 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (compon | |
|
78
|
CVE-2026-61155 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search Platform Services product of | |
|
78
|
CVE-2026-60728 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware | |
|
78
|
CVE-2026-60754 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (compo | |
|
78
|
CVE-2026-70994 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
78
|
CVE-2026-70997 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
77
|
CVE-2026-39313 |
8.7 | 0.0050 | NET NO AUTH LOW CX NO UI | mcp-framework is a framework for building Model Context Protocol (MCP) servers. | |
|
77
|
CVE-2024-58306 |
8.7 | 0.0049 | NET NO AUTH LOW CX NO UI | minaliC 2.0.0 contains a denial of service vulnerability that allows remote atta | |
|
75
|
CVE-2026-54341 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | Dragonfly is an in-memory data store built for modern application workloads. Pri | |
|
75
|
CVE-2026-62918 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | Improper verification of cryptographic signature in Microsoft Teams allows an un | |
|
75
|
CVE-2026-114629 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Conten | |
|
75
|
CVE-2026-118761 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | Kubeflow Pipelines enables users to build and deploy portable, scalable machine | |
|
75
|
CVE-2026-10699 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | Missing release of memory after effective lifetime vulnerability in Progress MOV | |
|
69
|
CVE-2026-113014 |
9.6 | 0.0050 | NET NO AUTH LOW CX | Missing authorization in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 | |
|
69
|
CVE-2026-113023 |
9.6 | 0.0050 | NET NO AUTH LOW CX | Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 al | |
|
69
|
CVE-2026-113089 |
9.6 | 0.0050 | NET NO AUTH LOW CX | Incorrect authorization in PrintPreview in Google Chrome prior to 156.0.8078.47 | |
|
69
|
CVE-2026-113235 |
9.6 | 0.0050 | NET NO AUTH LOW CX | Missing authorization in Passwords in Google Chrome prior to 156.0.8078.47 allow | |
|
69
|
CVE-2026-113252 |
9.6 | 0.0050 | NET NO AUTH LOW CX | Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.80 | |
|
69
|
CVE-2026-113300 |
9.6 | 0.0050 | NET NO AUTH LOW CX | Observable discrepancy in Forms in Google Chrome prior to 156.0.8078.47 allowed | |
|
69
|
CVE-2026-113328 |
9.6 | 0.0050 | NET NO AUTH LOW CX | Improper resource exposure in Privacy in Google Chrome prior to 156.0.8078.47 al | |
|
69
|
CVE-2026-113336 |
9.6 | 0.0050 | NET NO AUTH LOW CX | Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a | |
|
69
|
CVE-2026-113020 |
9.6 | 0.0050 | NET NO AUTH LOW CX | Use after free in Date in Google Chrome prior to 156.0.8078.47 allowed a remote | |
|
68
|
CVE-2026-32931 |
8.8 | 0.0050 | NET LOW CX NO UI | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an | |
|
68
|
CVE-2026-33760 |
8.8 | 0.0050 | NET LOW CX NO UI | Langflow is a tool for building and deploying AI-powered agents and workflows. P | |
|
68
|
CVE-2026-13967 |
8.8 | 0.0049 | NET NO AUTH LOW CX | Heap buffer overflow in V8 in Google Chrome prior to 150.0.7871.47 allowed a rem | |
|
67
|
CVE-2026-114083 |
8.6 | 0.0050 | NET LOW CX NO UI | Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api | |
|
67
|
CVE-2026-116811 |
8.7 | 0.0049 | NET LOW CX NO UI | OpenPanel before 3.0.0 contains a sandbox escape vulnerability in the js-runtime | |
|
66
|
CVE-2026-52707 |
8.1 | 0.0049 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Kastell <= 2.0 versions. | |
|
65
|
CVE-2026-117553 |
7.7 | 0.0050 | NET NO AUTH LOW CX | Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerabi | |
|
65
|
CVE-2026-105945 |
7.7 | 0.0049 | NET LOW CX NO UI | The Pulsar Packages Management Service can be configured to store packages on th | |
|
63
|
CVE-2026-28306 |
9.1 | 0.0050 | NET LOW CX NO UI | SolarWinds Serv-U is affected by a privilege escalation vulnerability that allow | |
|
63
|
CVE-2026-28307 |
9.1 | 0.0050 | NET LOW CX NO UI | SolarWinds Serv-U is affected by a privilege escalation vulnerability that allow | |
|
63
|
CVE-2026-28309 |
9.1 | 0.0050 | NET LOW CX NO UI | SolarWinds Serv-U is affected by a broken access control vulnerability that allo | |
|
63
|
CVE-2026-28310 |
9.1 | 0.0050 | NET LOW CX NO UI | SolarWinds Serv-U is affected by a privilege escalation vulnerability that allow | |
|
63
|
CVE-2026-28313 |
9.1 | 0.0050 | NET LOW CX NO UI | SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vuln | |
|
63
|
CVE-2026-28317 |
9.1 | 0.0050 | NET LOW CX NO UI | SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vuln | |
|
63
|
CVE-2026-112905 |
9.0 | 0.0050 | NET LOW CX NO UI | Vvveb is a powerful and easy to use CMS with page builder to build websites, blo | |
|
63
|
CVE-2026-50189 |
8.9 | 0.0049 | NET LOW CX NO UI | Appsmith is a platform to build admin panels, internal tools, and dashboards. Pr | |
|
62
|
CVE-2026-12004 |
8.7 | 0.0049 | NET LOW CX NO UI | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access | |
|
57
|
CVE-2026-53413 |
8.3 | 0.0049 | NET NO AUTH | Missing bounds check in the annotator function of Zoom Clients allows buffer ove | |
|
57
|
CVE-2026-53415 |
8.3 | 0.0049 | NET NO AUTH | Use after Free in the annotator function of Zoom Clients may allow a meeting par |