Hunt List
12,964 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-11546 |
9.8 | 0.0040 | NET NO AUTH LOW CX NO UI | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected | |
|
80
|
CVE-2026-68426 |
9.8 | 0.0040 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: xfrm: fix s | |
|
80
|
CVE-2026-63377 |
9.8 | 0.0040 | NET NO AUTH LOW CX NO UI | TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators | |
|
78
|
CVE-2026-113867 |
9.1 | 0.0040 | NET NO AUTH LOW CX NO UI | Thunderbird did not escape attribute values when serializing outgoing XMPP stanz | |
|
78
|
CVE-2016-20101 |
9.2 | 0.0040 | NET NO AUTH LOW CX NO UI | Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vuln | |
|
78
|
CVE-2026-64940 |
8.8 | 0.0040 | NET NO AUTH LOW CX NO UI | Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulne | |
|
78
|
CVE-2026-7182 |
9.2 | 0.0040 | NET NO AUTH LOW CX NO UI | Diagram's export module is vulnerable to Path Traversal in src attribute due to | |
|
78
|
CVE-2026-48989 |
8.9 | 0.0040 | NET NO AUTH LOW CX NO UI | Windows-MCP is an open-source project that integrates AI agents with Windows. In | |
|
77
|
CVE-2026-91353 |
8.6 | 0.0040 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl | |
|
76
|
CVE-2026-61011 |
8.2 | 0.0040 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware | |
|
76
|
CVE-2026-61016 |
8.2 | 0.0040 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware | |
|
76
|
CVE-2026-111064 |
8.2 | 0.0040 | NET NO AUTH LOW CX NO UI | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. | |
|
75
|
CVE-2026-35486 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | text-generation-webui is an open-source web interface for running Large Language | |
|
75
|
CVE-2026-42893 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | Improper neutralization of special elements used in a command ('command injectio | |
|
75
|
CVE-2026-59203 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS par | |
|
75
|
CVE-2026-91325 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards | |
|
75
|
CVE-2026-91448 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone | |
|
69
|
CVE-2026-33102 |
9.3 | 0.0040 | NET NO AUTH LOW CX | Url redirection to untrusted site ('open redirect') in M365 Copilot allows an un | |
|
68
|
CVE-2026-5285 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Use after free in WebGL in Google Chrome prior to 146.0.7680.178 allowed a remot | |
|
68
|
CVE-2026-56003 |
8.8 | 0.0040 | NET LOW CX NO UI | A heap buffer overflow due to missing size checking in the property buffer when | |
|
68
|
CVE-2026-83402 |
8.8 | 0.0040 | NET LOW CX NO UI | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware | |
|
68
|
CVE-2026-33991 |
8.8 | 0.0040 | NET LOW CX NO UI | WeGIA is a web manager for charitable institutions. Prior to version 3.6.7, the | |
|
68
|
CVE-2026-15125 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 a | |
|
68
|
CVE-2026-17751 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Inappropriate implementation in AdFilter in Google Chrome prior to 151.0.7922.72 | |
|
68
|
CVE-2026-17956 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Inappropriate implementation in Scheduling in Google Chrome prior to 151.0.7922. | |
|
68
|
CVE-2026-17969 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.7 | |
|
68
|
CVE-2026-98451 |
8.8 | 0.0040 | NET NO AUTH LOW CX | In the Linux kernel, the following vulnerability has been resolved: smb: client | |
|
68
|
CVE-2026-8509 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Heap buffer overflow in WebML in Google Chrome prior to 148.0.7778.168 allowed a | |
|
67
|
CVE-2026-10055 |
8.5 | 0.0040 | NET LOW CX NO UI | In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC | |
|
67
|
CVE-2026-51583 |
8.5 | 0.0040 | NET LOW CX NO UI | An issue in usememos through v0.30.0 allows a remote authenticated attacker to p | |
|
67
|
CVE-2026-55738 |
8.7 | 0.0040 | NET NO AUTH LOW CX | A stack-based buffer overflow exists in the raw_to_header function in src/microt | |
|
67
|
CVE-2026-119979 |
8.7 | 0.0040 | NET NO AUTH LOW CX | LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model d | |
|
66
|
CVE-2026-58500 |
8.2 | 0.0040 | NET NO AUTH LOW CX | MCP Appium is an MCP server that provides AI assistants with tools to automate m | |
|
66
|
CVE-2026-13819 |
8.1 | 0.0040 | NET NO AUTH LOW CX | Out of bounds read in ANGLE in Google Chrome on Mac prior to 150.0.7871.47 allow | |
|
66
|
CVE-2026-33437 |
8.1 | 0.0040 | NET NO AUTH LOW CX | Stirling-PDF is a locally hosted web application that facilitates various operat | |
|
64
|
CVE-2026-42212 |
7.1 | 0.0040 | NET NO AUTH LOW CX | SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postproce | |
|
64
|
CVE-2026-18737 |
7.1 | 0.0040 | NET LOW CX NO UI | Shlink contains a blind SQL injection vulnerability that allows any authenticate | |
|
64
|
CVE-2026-18688 |
7.1 | 0.0040 | NET LOW CX NO UI | An issue in MongoDB Server's aggregation framework could allow an authenticated | |
|
64
|
CVE-2026-18694 |
7.1 | 0.0040 | NET LOW CX NO UI | An issue in MongoDB Server's geospatial query processing could allow an authenti | |
|
64
|
CVE-2026-85170 |
7.1 | 0.0040 | NET LOW CX NO UI | n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gma | |
|
64
|
CVE-2026-40195 |
7.1 | 0.0040 | NET LOW CX NO UI | Incus is a system container and virtual machine manager. In versions before 7.0. | |
|
64
|
CVE-2026-54321 |
7.0 | 0.0040 | NET NO AUTH NO UI | Daytona is a secure and elastic infrastructure runtime for AI-generated code exe | |
|
62
|
CVE-2026-66397 |
8.6 | 0.0040 | NET LOW CX NO UI | phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existing | |
|
59
|
CVE-2026-18696 |
7.0 | 0.0040 | NET LOW CX NO UI | An issue in MongoDB Server's applyOps command could allow an authenticated user | |
|
59
|
CVE-2026-76307 |
7.2 | 0.0040 | NET LOW CX NO UI | In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and | |
|
58
|
CVE-2026-34571 |
9.0 | 0.0040 | NET LOW CX | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo | |
|
58
|
CVE-2026-50737 |
9.0 | 0.0040 | NET NO UI | When applying replicated changes for a row that is missing one or more columns, | |
|
55
|
CVE-2026-40721 |
7.5 | 0.0040 | NET NO UI | Contributor Local File Inclusion in Element Pack Pro <= 9.0.6 versions. | |
|
55
|
CVE-2026-65493 |
7.5 | 0.0040 | NET NO UI | Subscriber PHP Object Injection in Dokan Pro <= 5.0.2 versions. | |
|
52
|
CVE-2026-46788 |
8.4 | 0.0040 | NET LOW CX | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar |