Hunt List
13,282 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-83944 |
10.0 | 0.0044 | NET NO AUTH LOW CX NO UI | Improper access control in Azure Logic Apps allows an unauthorized attacker to e | |
|
78
|
CVE-2026-120446 |
8.8 | 0.0044 | NET NO AUTH LOW CX NO UI | madong-admin-saas through 5.1.4 contains a missing authentication vulnerability | |
|
78
|
CVE-2026-7381 |
9.1 | 0.0044 | NET NO AUTH LOW CX NO UI | Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-c | |
|
78
|
CVE-2026-16390 |
9.1 | 0.0044 | NET NO AUTH LOW CX NO UI | Mitigation bypass in the Enterprise Policies component. This vulnerability was f | |
|
76
|
CVE-2026-60544 |
8.2 | 0.0044 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo | |
|
76
|
CVE-2026-60796 |
8.2 | 0.0044 | NET NO AUTH LOW CX NO UI | Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (compon | |
|
76
|
CVE-2026-61302 |
8.2 | 0.0044 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of | |
|
76
|
CVE-2026-70743 |
8.2 | 0.0044 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyper | |
|
76
|
CVE-2026-70870 |
8.2 | 0.0044 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora | |
|
76
|
CVE-2026-70909 |
8.2 | 0.0044 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype | |
|
76
|
CVE-2026-70952 |
8.2 | 0.0044 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype | |
|
76
|
CVE-2026-71024 |
8.2 | 0.0044 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
70
|
CVE-2026-48086 |
9.9 | 0.0044 | NET LOW CX NO UI | OpenReception's appointment booking software provides an end-to-end encrypted ap | |
|
69
|
CVE-2026-58053 |
9.4 | 0.0044 | NET LOW CX NO UI | Gitea act_runner with the Docker backend (through act 0.262.0) passes a workflow | |
|
68
|
CVE-2026-113185 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed | |
|
68
|
CVE-2026-113192 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Memory corruption in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote | |
|
68
|
CVE-2026-113194 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Memory corruption in Core in Google Chrome prior to 156.0.8078.47 allowed a remo | |
|
68
|
CVE-2026-113195 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Improper input validation in Downloads in Google Chrome prior to 156.0.8078.47 a | |
|
68
|
CVE-2026-113197 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Use after free in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote | |
|
68
|
CVE-2026-113198 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a r | |
|
68
|
CVE-2026-113206 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Memory corruption in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a r | |
|
68
|
CVE-2026-113210 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Use after free in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 al | |
|
68
|
CVE-2026-113213 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a | |
|
68
|
CVE-2026-113214 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Improper input validation in FullScreen in Google Chrome prior to 156.0.8078.47 | |
|
68
|
CVE-2026-113215 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a r | |
|
68
|
CVE-2026-113236 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Use after free in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 a | |
|
68
|
CVE-2026-113240 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Use after free in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a r | |
|
68
|
CVE-2026-113242 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 | |
|
68
|
CVE-2026-113244 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Improper input validation in UI in Google Chrome prior to 156.0.8078.47 allowed | |
|
68
|
CVE-2026-113245 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a | |
|
68
|
CVE-2026-113247 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a | |
|
68
|
CVE-2026-113248 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.47 allowed | |
|
68
|
CVE-2026-113293 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Use after free in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 al | |
|
68
|
CVE-2026-113312 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Memory corruption in Autofill in Google Chrome on on Mac prior to 156.0.8078.47 | |
|
68
|
CVE-2026-113317 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Memory corruption in Accessibility in Google Chrome on on Mac prior to 156.0.807 | |
|
68
|
CVE-2026-113323 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Use after free in Chrome for iOS in Google Chrome on on iOS prior to 156.0.8078. | |
|
68
|
CVE-2026-113331 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Memory corruption in Controls in Google Chrome prior to 156.0.8078.47 allowed a | |
|
68
|
CVE-2026-113334 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0 | |
|
68
|
CVE-2026-48704 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Warp is an agentic development environment. From 0.2023.10.24.08.03.stable_00 un | |
|
68
|
CVE-2026-48720 |
8.8 | 0.0044 | NET NO AUTH LOW CX | Warp is an agentic development environment. From 0.2025.03.05.08.02.stable_00 un | |
|
68
|
CVE-2026-44938 |
8.8 | 0.0044 | NET LOW CX NO UI | A vulnerability has been identified in Fleet's agent-side deployer, which did no | |
|
68
|
CVE-2026-5523 |
8.8 | 0.0044 | NET LOW CX NO UI | The Divi Form Builder plugin for WordPress is vulnerable to Missing Authorizatio | |
|
68
|
CVE-2026-48169 |
8.8 | 0.0044 | NET LOW CX NO UI | PraisonAI is a multi-agent teams system. Versions prior to 0.1.4 of the PraisonA | |
|
66
|
CVE-2025-48090 |
8.1 | 0.0044 | NET NO AUTH NO UI | Path Traversal: '.../...//' vulnerability in CocoBasic Blanka - One Page WordPre | |
|
65
|
CVE-2026-42129 |
7.7 | 0.0044 | NET LOW CX NO UI | A user with Viewer permissions can use a path traversal in the Loki data source | |
|
65
|
CVE-2026-14468 |
7.7 | 0.0044 | NET LOW CX NO UI | HashiCorp Terraform Enterprise contained an issue in its version control system | |
|
65
|
CVE-2026-65582 |
7.7 | 0.0044 | NET LOW CX NO UI | Subscriber Arbitrary File Download in AI Hub <= 1.3.10 versions. | |
|
62
|
CVE-2026-18860 |
8.7 | 0.0044 | NET LOW CX NO UI | Velociraptor allows multi-tenant deployments named "Orgs". By default Velocirap | |
|
62
|
CVE-2026-74043 |
8.5 | 0.0044 | NET LOW CX NO UI | Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload | |
|
59
|
CVE-2025-71392 |
9.4 | 0.0044 | NET LOW CX | SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to prop |