Hunt List
13,415 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-47410 |
9.8 | 0.0045 | NET NO AUTH LOW CX NO UI | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams sys | |
|
80
|
CVE-2026-72889 |
9.8 | 0.0045 | NET NO AUTH LOW CX NO UI | Net::OAuth versions before 0.33 for Perl allow the sender to choose the signatur | |
|
80
|
CVE-2025-58627 |
9.8 | 0.0045 | NET NO AUTH LOW CX NO UI | Authorization Bypass Through User-Controlled Key vulnerability in kamleshyadav M | |
|
80
|
CVE-2026-8721 |
9.8 | 0.0045 | NET NO AUTH LOW CX NO UI | Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with e | |
|
80
|
CVE-2026-11362 |
9.8 | 0.0045 | NET NO AUTH LOW CX NO UI | DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from e | |
|
80
|
CVE-2025-61165 |
9.8 | 0.0045 | NET NO AUTH LOW CX NO UI | An arbitrary file upload vulnerability in the /v1/my_drive/batch_upload componen | |
|
79
|
CVE-2026-25660 |
9.3 | 0.0045 | NET NO AUTH LOW CX NO UI | CodeChecker is an analyzer tooling, defect database and viewer extension for the | |
|
78
|
CVE-2026-70460 |
9.2 | 0.0045 | NET NO AUTH LOW CX NO UI | rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a m | |
|
78
|
CVE-2026-46858 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Vulnerability in the APM - Application Performance Management product of Oracle | |
|
78
|
CVE-2026-60168 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beve | |
|
78
|
CVE-2026-60591 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beve | |
|
78
|
CVE-2026-62638 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middlewar | |
|
78
|
CVE-2026-70854 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype | |
|
78
|
CVE-2026-70976 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
78
|
CVE-2026-70977 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
78
|
CVE-2026-70979 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
78
|
CVE-2026-70981 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
78
|
CVE-2026-70984 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
78
|
CVE-2026-71102 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Vulnerability in the Portable Clusterware component of Oracle Database Server. | |
|
77
|
CVE-2026-32834 |
8.7 | 0.0045 | NET NO AUTH LOW CX NO UI | Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains a | |
|
77
|
CVE-2026-115506 |
8.7 | 0.0045 | NET NO AUTH LOW CX NO UI | libexpat through 2.9.0 contains a denial of service vulnerability because billio | |
|
77
|
CVE-2023-54402 |
8.7 | 0.0045 | NET NO AUTH LOW CX NO UI | iDocView contains a server-side request forgery vulnerability in its /doc/upload | |
|
77
|
CVE-2026-4436 |
8.6 | 0.0045 | NET NO AUTH LOW CX NO UI | A low-privileged remote attacker can send Modbus packets to manipulate register | |
|
77
|
CVE-2026-54603 |
8.6 | 0.0045 | NET NO AUTH LOW CX NO UI | OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, inc | |
|
77
|
CVE-2026-61576 |
8.3 | 0.0045 | NET NO AUTH LOW CX NO UI | Lightdash is an open source business intelligence platform. In affected versions | |
|
75
|
CVE-2026-47204 |
7.5 | 0.0045 | NET NO AUTH LOW CX NO UI | Envoy is an open source edge and service proxy designed for cloud-native applica | |
|
75
|
CVE-2026-19630 |
7.5 | 0.0045 | NET NO AUTH LOW CX NO UI | In a BIND resolver, inbound DNS protocol messages with a particular structure wi | |
|
75
|
CVE-2026-97313 |
7.5 | 0.0045 | NET NO AUTH LOW CX NO UI | A recursive BIND server that receives a query with recursion desired (RD=1) foll | |
|
75
|
CVE-2026-33521 |
7.5 | 0.0045 | NET NO AUTH LOW CX NO UI | There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 a | |
|
70
|
CVE-2025-62047 |
9.9 | 0.0045 | NET LOW CX NO UI | Unrestricted Upload of File with Dangerous Type vulnerability in Case-Themes Cas | |
|
70
|
CVE-2026-39589 |
9.9 | 0.0045 | NET LOW CX NO UI | Subscriber Arbitrary File Upload in Webenvo <= 0.0.6 versions. | |
|
70
|
CVE-2026-101446 |
9.9 | 0.0045 | NET LOW CX NO UI | Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM | |
|
68
|
CVE-2026-5275 |
8.8 | 0.0045 | NET NO AUTH LOW CX | Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 146.0.7680.178 al | |
|
68
|
CVE-2026-113101 |
8.8 | 0.0045 | NET NO AUTH LOW CX | Incorrect authorization in SiteIsolation in Google Chrome prior to 156.0.8078.47 | |
|
68
|
CVE-2026-72772 |
8.9 | 0.0045 | NET LOW CX NO UI | n8n before 2.32.1 (and before 2.31.5) is vulnerable to account takeover via the | |
|
68
|
CVE-2026-34058 |
8.8 | 0.0045 | NET LOW CX NO UI | Coolify is an open-source and self-hostable tool for managing servers, applicati | |
|
68
|
CVE-2026-17712 |
8.8 | 0.0045 | NET NO AUTH LOW CX | Race in Skia in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote att | |
|
68
|
CVE-2026-10572 |
8.8 | 0.0045 | NET LOW CX NO UI | IBM MQ could allow an authenticated attacker to cause a denial of service or pot | |
|
68
|
CVE-2026-47025 |
8.8 | 0.0045 | NET LOW CX NO UI | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utilit | |
|
68
|
CVE-2026-87359 |
8.8 | 0.0045 | NET LOW CX NO UI | Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (com | |
|
68
|
CVE-2026-64138 |
8.8 | 0.0045 | NET LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ksmbd: vali | |
|
67
|
CVE-2026-120311 |
8.7 | 0.0045 | NET LOW CX NO UI | Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in | |
|
67
|
CVE-2026-120312 |
8.7 | 0.0045 | NET LOW CX NO UI | Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in | |
|
67
|
CVE-2026-59712 |
8.6 | 0.0045 | NET LOW CX NO UI | Leantime's Users::getUser method in the JSON-RPC API lacks proper authorization | |
|
65
|
CVE-2026-47164 |
7.7 | 0.0045 | NET NO AUTH NO UI | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, V | |
|
65
|
CVE-2026-53994 |
7.7 | 0.0045 | NET LOW CX NO UI | ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authentic | |
|
65
|
CVE-2024-1249 |
7.4 | 0.0045 | NET NO AUTH LOW CX | A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which a | |
|
64
|
CVE-2026-59207 |
7.1 | 0.0045 | NET LOW CX NO UI | n8n is an open source workflow automation platform. Prior to 2.27.4 and 2.28.1, | |
|
64
|
CVE-2026-98169 |
7.1 | 0.0045 | NET NO AUTH LOW CX | In the Linux kernel, the following vulnerability has been resolved: smb: client | |
|
59
|
CVE-2026-25700 |
7.2 | 0.0045 | NET LOW CX NO UI | Improper Restriction of Security Token Assignment vulnerability in Apache Answer |