Hunt List
13,125 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-70921 |
10.0 | 0.0043 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype | |
|
80
|
CVE-2026-10579 |
9.8 | 0.0043 | NET NO AUTH LOW CX NO UI | A flaw was found in Picketlink Federation SAML; the unsolcited response handler | |
|
80
|
CVE-2026-62009 |
9.8 | 0.0043 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions. | |
|
80
|
CVE-2026-62014 |
9.8 | 0.0043 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions. | |
|
78
|
CVE-2026-46784 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middlew | |
|
78
|
CVE-2026-60267 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (compo | |
|
78
|
CVE-2026-60326 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware ( | |
|
78
|
CVE-2026-60438 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (com | |
|
78
|
CVE-2026-60567 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware | |
|
78
|
CVE-2026-60606 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product | |
|
78
|
CVE-2026-60649 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
78
|
CVE-2026-61059 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | Vulnerability in the PeopleSoft Enterprise SCM Order Management product of Oracl | |
|
78
|
CVE-2026-61153 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
78
|
CVE-2026-61156 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search Platform Services product of | |
|
78
|
CVE-2026-61171 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: | |
|
78
|
CVE-2026-61184 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Agile Product Lifecycle Management for Process produ | |
|
78
|
CVE-2026-61197 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware | |
|
78
|
CVE-2026-61238 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product | |
|
78
|
CVE-2026-61244 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | Vulnerability in the PeopleSoft Enterprise FIN Manufacturing Argentina product o | |
|
78
|
CVE-2026-60737 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middle | |
|
78
|
CVE-2026-61008 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware | |
|
78
|
CVE-2026-62610 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middlewar | |
|
78
|
CVE-2026-70668 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middlewar | |
|
78
|
CVE-2026-70741 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyper | |
|
78
|
CVE-2026-70862 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | Vulnerability in Oracle Application Testing Suite. The supported version that | |
|
78
|
CVE-2026-70872 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora | |
|
78
|
CVE-2026-70978 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
78
|
CVE-2026-71014 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
78
|
CVE-2026-71015 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
78
|
CVE-2026-71026 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
78
|
CVE-2026-71036 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
78
|
CVE-2026-73865 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
78
|
CVE-2026-73866 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
78
|
CVE-2026-73916 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
78
|
CVE-2026-73917 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
78
|
CVE-2026-73922 |
9.1 | 0.0043 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
75
|
CVE-2026-56069 |
7.5 | 0.0043 | NET NO AUTH LOW CX NO UI | Unauthenticated Insecure Direct Object References (IDOR) in Toolset Forms <= 2.6 | |
|
75
|
CVE-2026-59554 |
7.5 | 0.0043 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Authentication in Ziina <= 1.2.21 versions. | |
|
75
|
CVE-2026-65495 |
7.5 | 0.0043 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Dokan Pro <= 5.0.3 versions. | |
|
75
|
CVE-2025-61479 |
7.5 | 0.0043 | NET NO AUTH LOW CX NO UI | An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 | |
|
75
|
CVE-2026-84748 |
7.5 | 0.0043 | NET NO AUTH LOW CX NO UI | Improper authorization in Apache bRPC (versions < 1.18.0) on all platforms allow | |
|
75
|
CVE-2026-62966 |
7.5 | 0.0043 | NET NO AUTH LOW CX NO UI | ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32 | |
|
75
|
CVE-2026-13476 |
7.3 | 0.0043 | NET NO AUTH LOW CX NO UI | IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could allow an unauthenticate | |
|
69
|
CVE-2026-13780 |
9.6 | 0.0043 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 15 | |
|
69
|
CVE-2026-13781 |
9.6 | 0.0043 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Skia in Google Chrome prior to 150 | |
|
69
|
CVE-2026-42810 |
9.4 | 0.0043 | NET LOW CX NO UI | Apache Polaris accepts literal `*` characters in namespace and table names. When | |
|
65
|
CVE-2026-28189 |
7.4 | 0.0043 | NET NO AUTH LOW CX | Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 vers | |
|
64
|
CVE-2026-21577 |
7.1 | 0.0043 | NET LOW CX NO UI | This High severity DoS (Denial of Service) vulnerability was introduced in versi | |
|
64
|
CVE-2026-13060 |
7.1 | 0.0043 | NET LOW CX NO UI | An authenticated user with limited read privileges may be able to access documen | |
|
59
|
CVE-2026-33392 |
7.2 | 0.0043 | NET LOW CX NO UI | In JetBrains YouTrack before 2025.3.131383 high privileged user can achieve RCE |