Hunt List
13,779 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-34072 |
9.8 | 0.0046 | NET NO AUTH LOW CX NO UI | Cr*nMaster (cronmaster) is a Cronjob management UI with human readable syntax, l | |
|
80
|
CVE-2026-34456 |
9.8 | 0.0046 | NET NO AUTH LOW CX NO UI | Reviactyl is an open-source game server management panel built using Laravel, Re | |
|
80
|
CVE-2026-15704 |
9.8 | 0.0046 | NET NO AUTH LOW CX NO UI | In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled | |
|
78
|
CVE-2026-42216 |
8.8 | 0.0046 | NET NO AUTH LOW CX NO UI | OpenEXR provides the specification and reference implementation of the EXR file | |
|
77
|
CVE-2026-75479 |
8.7 | 0.0046 | NET NO AUTH LOW CX NO UI | JimuReport contains an authentication bypass vulnerability in the report folder | |
|
77
|
CVE-2026-76598 |
8.7 | 0.0046 | NET NO AUTH LOW CX NO UI | Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing vi | |
|
76
|
CVE-2026-27890 |
8.2 | 0.0046 | NET NO AUTH LOW CX NO UI | Firebird is an open-source relational database management system. In versions pr | |
|
76
|
CVE-2026-28224 |
8.2 | 0.0046 | NET NO AUTH LOW CX NO UI | Firebird is an open-source relational database management system. In versions pr | |
|
76
|
CVE-2026-45325 |
8.2 | 0.0046 | NET NO AUTH LOW CX NO UI | Gestor de Oferta is a web application for managing mobility service offerings. P | |
|
76
|
CVE-2026-73337 |
8.2 | 0.0046 | NET NO AUTH LOW CX NO UI | Joomla! Core - [20260807] - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and | |
|
76
|
CVE-2026-117518 |
8.2 | 0.0046 | NET NO AUTH LOW CX NO UI | @fastify/reply-from is a Fastify plugin that forwards requests to an upstream HT | |
|
75
|
CVE-2026-10845 |
7.3 | 0.0047 | NET NO AUTH LOW CX NO UI | IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to by | |
|
75
|
CVE-2026-69192 |
7.7 | 0.0046 | NET NO AUTH LOW CX NO UI | ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in | |
|
75
|
CVE-2026-16354 |
7.5 | 0.0046 | NET NO AUTH LOW CX NO UI | Information disclosure in the Graphics: ImageLib component. This vulnerability w | |
|
75
|
CVE-2026-116795 |
7.5 | 0.0046 | NET NO AUTH LOW CX NO UI | RE2JS is the JavaScript port of RE2, a regular expression engine that provides l | |
|
70
|
CVE-2026-39591 |
9.9 | 0.0046 | NET LOW CX NO UI | Subscriber Arbitrary File Upload in WP-BusinessDirectory <= 4.0.0 versions. | |
|
70
|
CVE-2026-22327 |
9.9 | 0.0046 | NET LOW CX NO UI | Subscriber Arbitrary File Upload in Restaurt <= 1.0.4 versions. | |
|
70
|
CVE-2026-55089 |
9.9 | 0.0046 | NET LOW CX NO UI | Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's | |
|
70
|
CVE-2026-8709 |
9.9 | 0.0046 | NET LOW CX NO UI | An improper privilege management vulnerability in the REST API document patch op | |
|
69
|
CVE-2026-113263 |
9.6 | 0.0046 | NET NO AUTH LOW CX | Missing authorization in Core in Google Chrome on on Android prior to 156.0.8078 | |
|
69
|
CVE-2026-22874 |
9.6 | 0.0046 | NET LOW CX NO UI | Gitea versions up to and including 1.26.2 have incomplete SSRF protection in web | |
|
68
|
CVE-2026-13744 |
8.8 | 0.0046 | NET NO AUTH LOW CX | Improper neutralization of attacker-controlled content in Snowflake CLI versions | |
|
68
|
CVE-2026-16745 |
8.8 | 0.0046 | NET LOW CX NO UI | A flaw was found in odh-dashboard, the web console component of Red Hat OpenShif | |
|
68
|
CVE-2026-101557 |
8.8 | 0.0046 | NET LOW CX NO UI | Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (compo | |
|
68
|
CVE-2026-101567 |
8.8 | 0.0046 | NET LOW CX NO UI | Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite ( | |
|
68
|
CVE-2026-101685 |
8.8 | 0.0046 | NET LOW CX NO UI | Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of O | |
|
68
|
CVE-2026-101686 |
8.8 | 0.0046 | NET LOW CX NO UI | Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of O | |
|
68
|
CVE-2026-101692 |
8.8 | 0.0046 | NET LOW CX NO UI | Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Su | |
|
68
|
CVE-2026-110196 |
8.8 | 0.0046 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker with a low-p | |
|
67
|
CVE-2026-68581 |
8.6 | 0.0046 | NET LOW CX NO UI | Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API | |
|
66
|
CVE-2026-40563 |
8.1 | 0.0046 | NET LOW CX NO UI | Description: Improper Control of Generation of Code ('Code Injection') vulnerabi | |
|
65
|
CVE-2026-34242 |
7.7 | 0.0046 | NET LOW CX NO UI | Weblate is a web based localization tool. In versions prior to 5.17, the ZIP dow | |
|
65
|
CVE-2026-59832 |
7.7 | 0.0046 | NET LOW CX NO UI | SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, t | |
|
65
|
CVE-2026-12579 |
7.4 | 0.0046 | NET NO AUTH NO UI | AS228T with Authentication Bypass Vulnerability | |
|
65
|
CVE-2026-113727 |
7.4 | 0.0046 | NET LOW CX NO UI | OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7 | |
|
65
|
CVE-2026-6902 |
7.7 | 0.0046 | NET NO AUTH LOW CX | A Remote Code Execution vulnerability in P4 (Helix Core) Server's Command-Line C | |
|
65
|
CVE-2026-65822 |
7.6 | 0.0046 | NET LOW CX NO UI | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15 | |
|
64
|
CVE-2026-71964 |
7.1 | 0.0046 | NET LOW CX NO UI | CyberPanel 2.4.3, fixed in commit eca0c3c, contains an arbitrary file read vulne | |
|
64
|
CVE-2026-48494 |
7.1 | 0.0046 | NET LOW CX NO UI | TypeBot is a chatbot builder tool. In version 3.16.1, an authenticated user who | |
|
64
|
CVE-2026-40160 |
7.1 | 0.0046 | NET NO AUTH LOW CX | PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, web_crawl's htt | |
|
64
|
CVE-2026-18186 |
7.1 | 0.0046 | NET LOW CX NO UI | A stored format string vulnerability was found in the FTP Backup on the ADM. The | |
|
64
|
CVE-2026-18187 |
7.1 | 0.0046 | NET LOW CX NO UI | A format string vulnerability was found in the Internal Backup on the ADM. The v | |
|
64
|
CVE-2026-18188 |
7.1 | 0.0046 | NET LOW CX NO UI | A format string vulnerability was found in the Rsync Backup on the ADM. The vuln | |
|
62
|
CVE-2026-7490 |
8.6 | 0.0046 | NET LOW CX NO UI | CTMS and CPAS developed by Sunnet has an Arbitrary File Upload vulnerability, al | |
|
62
|
CVE-2026-65707 |
8.5 | 0.0046 | NET LOW CX NO UI | Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability tha | |
|
60
|
CVE-2026-34239 |
7.5 | 0.0046 | NET LOW CX NO UI | Chamilo version 1.11.40 and earlier are vulnerable to authenticated remote code | |
|
59
|
CVE-2026-58257 |
7.2 | 0.0047 | NET LOW CX NO UI | GRR is a resource management and reservation application. Prior to the advisory- | |
|
59
|
CVE-2026-87357 |
7.2 | 0.0046 | NET LOW CX NO UI | Vulnerability in the Order Capture product of Oracle E-Business Suite (component | |
|
55
|
CVE-2026-61352 |
7.5 | 0.0047 | NET NO AUTH | Concurrent execution using shared resource with improper synchronization ('race | |
|
49
|
CVE-2026-18430 |
7.2 | 0.0047 | NET LOW CX | HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the commen |