Hunt List
13,787 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-91665 |
9.8 | 0.0047 | NET NO AUTH LOW CX NO UI | Vulnerability in Oracle Essbase (component: Security). The supported version t | |
|
80
|
CVE-2026-108771 |
9.8 | 0.0047 | NET NO AUTH LOW CX NO UI | Missing authentication for in-house broadcast and polymorphic deserialization vu | |
|
78
|
CVE-2026-16359 |
9.1 | 0.0047 | NET NO AUTH LOW CX NO UI | Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerabil | |
|
77
|
CVE-2026-15803 |
8.7 | 0.0047 | NET NO AUTH LOW CX NO UI | In Eclipse RDF4J, several XML parser entry points do not fully restrict XML Exte | |
|
76
|
CVE-2026-111756 |
8.2 | 0.0047 | NET NO AUTH LOW CX NO UI | follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically f | |
|
75
|
CVE-2026-48812 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | FreeScout is a free help desk and shared inbox built with PHP's Laravel framewor | |
|
75
|
CVE-2026-76288 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unau | |
|
75
|
CVE-2026-63088 |
7.7 | 0.0047 | NET NO AUTH LOW CX NO UI | stoatchat before 0.14.0 contains a server-side request forgery (SSRF) vulnerabil | |
|
75
|
CVE-2026-24175 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | NVIDIA Triton Inference Server contains a vulnerability where an attacker could | |
|
75
|
CVE-2026-51604 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3. | |
|
75
|
CVE-2026-51605 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3. | |
|
75
|
CVE-2026-47018 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM | |
|
75
|
CVE-2026-47057 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | Vulnerability in Oracle Java SE (component: Scripting). Supported versions that | |
|
75
|
CVE-2026-60180 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connec | |
|
75
|
CVE-2026-60252 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (compo | |
|
75
|
CVE-2026-60301 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (compo | |
|
75
|
CVE-2026-60314 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: Ge | |
|
75
|
CVE-2026-60382 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | Vulnerability in the Service Delivery Platform product of Oracle Fusion Middlewa | |
|
75
|
CVE-2026-60425 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middlewar | |
|
75
|
CVE-2026-60436 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middlewar | |
|
75
|
CVE-2026-70908 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
75
|
CVE-2026-70927 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (compone | |
|
75
|
CVE-2026-73882 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
75
|
CVE-2026-53587 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | libgit2 is a portable C implementation of the Git core methods provided as a lin | |
|
70
|
CVE-2026-64637 |
9.9 | 0.0047 | NET LOW CX NO UI | Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows | |
|
70
|
CVE-2026-49252 |
9.9 | 0.0047 | NET LOW CX NO UI | deepstream is a server that allows clients and backend services to sync data, se | |
|
69
|
CVE-2025-52950 |
9.6 | 0.0047 | NET LOW CX NO UI | A Missing Authorization vulnerability in Juniper Networks Security Director allo | |
|
68
|
CVE-2026-113037 |
8.8 | 0.0047 | NET NO AUTH LOW CX | Use after free in WebSockets in Google Chrome prior to 156.0.8078.47 allowed a r | |
|
68
|
CVE-2026-113073 |
8.8 | 0.0047 | NET NO AUTH LOW CX | Incomplete cleanup in Browser in Google Chrome prior to 156.0.8078.47 allowed a | |
|
68
|
CVE-2026-103693 |
9.0 | 0.0047 | NET NO AUTH NO UI | The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plu | |
|
68
|
CVE-2026-6543 |
8.8 | 0.0047 | NET LOW CX NO UI | IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow allows an attacker to execute | |
|
68
|
CVE-2026-49473 |
8.8 | 0.0047 | NET LOW CX NO UI | @cedar-policy/authorization-for-expressjs is an open-source Express.js middlewar | |
|
67
|
CVE-2026-110215 |
8.7 | 0.0047 | NET LOW CX NO UI | youlai-boot through 2.21.1 contains a missing authorization vulnerability that a | |
|
66
|
CVE-2026-4773 |
8.1 | 0.0047 | NET NO AUTH LOW CX | Improper validation of specified type of input vulnerability in Magarsus Consult | |
|
65
|
CVE-2026-6157 |
7.4 | 0.0047 | NET LOW CX NO UI | A vulnerability was detected in Totolink A800R 4.1.2cu.5137_B20200730. This impa | |
|
65
|
CVE-2026-6194 |
7.4 | 0.0047 | NET LOW CX NO UI | A weakness has been identified in Totolink A3002MU B20211125.1046. Affected by t | |
|
65
|
CVE-2026-6199 |
7.4 | 0.0047 | NET LOW CX NO UI | A vulnerability was found in Tenda F456 1.0.0.5. Impacted is the function fromqo | |
|
65
|
CVE-2026-7512 |
7.4 | 0.0047 | NET LOW CX NO UI | A flaw has been found in UTT HiPER 1200GW up to 2.5.3-1703. The affected element | |
|
65
|
CVE-2026-7513 |
7.4 | 0.0047 | NET LOW CX NO UI | A vulnerability has been found in UTT HiPER 1200GW up to 2.5.3-170306. The impac | |
|
65
|
CVE-2026-7717 |
7.4 | 0.0047 | NET LOW CX NO UI | A vulnerability was determined in Totolink WA300 5.2cu.7112_B20190227. This issu | |
|
65
|
CVE-2026-50236 |
7.4 | 0.0047 | NET LOW CX NO UI | An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhoo | |
|
65
|
CVE-2026-56054 |
7.7 | 0.0047 | NET LOW CX NO UI | Subscriber Arbitrary File Deletion in JS Help Desk <= 3.1.1 versions. | |
|
65
|
CVE-2026-59542 |
7.7 | 0.0047 | NET LOW CX NO UI | Subscriber Arbitrary File Deletion in Kali Forms <= 2.4.18 versions. | |
|
65
|
CVE-2026-16863 |
7.7 | 0.0047 | NET LOW CX NO UI | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obta | |
|
64
|
CVE-2026-63175 |
7.1 | 0.0047 | NET LOW CX NO UI | PlaywrightCapture stored capture-specific configuration and runtime data as muta | |
|
64
|
CVE-2026-41878 |
7.1 | 0.0047 | NET LOW CX NO UI | R-SOFT DMS is vulnerable to Insecure Direct Object Reference (IDOR) attack in mu | |
|
64
|
CVE-2026-115354 |
7.1 | 0.0047 | NET NO AUTH LOW CX | Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Inclu | |
|
62
|
CVE-2026-111560 |
8.6 | 0.0047 | NET LOW CX NO UI | Improper neutralization of shell metacharacters in the timezone configuration fi | |
|
59
|
CVE-2026-76293 |
7.2 | 0.0047 | NET LOW CX NO UI | In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user | |
|
59
|
CVE-2026-111504 |
7.2 | 0.0047 | NET LOW CX NO UI | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutra |