Hunt List
12,902 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-46651 |
9.8 | 0.0038 | NET NO AUTH LOW CX NO UI | The Goobi viewer is a web application that allows digitised material to be displ | |
|
80
|
CVE-2026-61237 |
9.9 | 0.0038 | NET NO AUTH LOW CX NO UI | Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product | |
|
80
|
CVE-2026-62452 |
9.9 | 0.0038 | NET NO AUTH LOW CX NO UI | Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM | |
|
80
|
CVE-2026-34275 |
9.8 | 0.0038 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Advanced Inbound Telephony product of Oracle E-Busin | |
|
80
|
CVE-2026-10534 |
9.8 | 0.0038 | NET NO AUTH LOW CX NO UI | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to buffer | |
|
79
|
CVE-2026-48088 |
9.4 | 0.0038 | NET NO AUTH LOW CX NO UI | OpenReception's appointment booking software provides an end-to-end encrypted ap | |
|
78
|
CVE-2026-58080 |
8.8 | 0.0038 | NET NO AUTH LOW CX NO UI | In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails t | |
|
78
|
CVE-2025-40938 |
9.2 | 0.0038 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). | |
|
77
|
CVE-2026-56035 |
8.6 | 0.0038 | NET NO AUTH LOW CX NO UI | Unauthenticated Multiple Vulnerabilities in BitFire Security <= 5.0.3 versions. | |
|
77
|
CVE-2026-74906 |
8.7 | 0.0038 | NET NO AUTH LOW CX NO UI | SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight | |
|
77
|
CVE-2026-61033 |
8.6 | 0.0038 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware | |
|
77
|
CVE-2026-61045 |
8.6 | 0.0038 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware | |
|
77
|
CVE-2026-62625 |
8.6 | 0.0038 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middlewar | |
|
77
|
CVE-2026-62636 |
8.6 | 0.0038 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middlewar | |
|
77
|
CVE-2026-87304 |
8.6 | 0.0038 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl | |
|
77
|
CVE-2026-91273 |
8.6 | 0.0038 | NET NO AUTH LOW CX NO UI | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards | |
|
77
|
CVE-2026-70457 |
8.3 | 0.0038 | NET NO AUTH LOW CX NO UI | rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() whe | |
|
75
|
CVE-2026-58419 |
7.5 | 0.0038 | NET NO AUTH LOW CX NO UI | Notification API leaks private issue metadata after access revocation | |
|
75
|
CVE-2026-43870 |
7.3 | 0.0038 | NET NO AUTH LOW CX NO UI | Origin Validation Error, Improper Limitation of a Pathname to a Restricted Direc | |
|
75
|
CVE-2026-55501 |
7.3 | 0.0038 | NET NO AUTH LOW CX NO UI | 9Router is an AI router & token saver. Prior to 0.4.80, the dashboard login rate | |
|
75
|
CVE-2025-65805 |
7.5 | 0.0038 | NET NO AUTH LOW CX NO UI | OpenAirInterface CN5G AMF<=v2.1.9 has a buffer overflow vulnerability in process | |
|
75
|
CVE-2026-91765 |
7.5 | 0.0038 | NET NO AUTH LOW CX NO UI | cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level wi | |
|
75
|
CVE-2026-101835 |
7.5 | 0.0038 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suit | |
|
75
|
CVE-2026-87296 |
7.5 | 0.0038 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware ( | |
|
75
|
CVE-2026-91447 |
7.5 | 0.0038 | NET NO AUTH LOW CX NO UI | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone | |
|
75
|
CVE-2026-98952 |
7.3 | 0.0038 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: pfcp: make | |
|
74
|
CVE-2026-109198 |
7.2 | 0.0038 | NET NO AUTH LOW CX NO UI | The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPres | |
|
70
|
CVE-2026-52785 |
9.9 | 0.0038 | NET LOW CX NO UI | OpenProject is open-source, web-based project management software. Prior to 17.3 | |
|
69
|
CVE-2026-60905 |
9.6 | 0.0038 | NET NO AUTH LOW CX | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
69
|
CVE-2026-14423 |
9.6 | 0.0038 | NET NO AUTH LOW CX | Type Confusion in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote | |
|
68
|
CVE-2026-54805 |
8.8 | 0.0038 | NET LOW CX NO UI | Subscriber Privilege Escalation in Falang multilanguage <= 1.4.2 versions. | |
|
68
|
CVE-2026-113085 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote | |
|
67
|
CVE-2026-15736 |
8.3 | 0.0038 | NET LOW CX NO UI | Snowflake SQLAlchemy versions prior to 1.11.0 contain several security vulnerabi | |
|
67
|
CVE-2026-47866 |
8.3 | 0.0038 | NET LOW CX NO UI | VMware Avi Load Balancer contains an authorization bypass vulnerability. A malic | |
|
66
|
CVE-2026-35488 |
8.1 | 0.0038 | NET LOW CX NO UI | Tandoor Recipes is an application for managing recipes, planning meals, and buil | |
|
66
|
CVE-2026-7402 |
8.1 | 0.0038 | NET LOW CX NO UI | Improper Control of Interaction Frequency vulnerability in MeWare Software Devel | |
|
66
|
CVE-2026-48725 |
8.1 | 0.0038 | NET NO AUTH LOW CX | Warp is an agentic development environment. From 0.2021.04.25.23.05.stable_00 un | |
|
66
|
CVE-2026-72596 |
8.1 | 0.0038 | NET LOW CX NO UI | A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authe | |
|
66
|
CVE-2026-28186 |
8.1 | 0.0038 | NET LOW CX NO UI | Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions. | |
|
66
|
CVE-2026-58086 |
8.1 | 0.0038 | NET LOW CX NO UI | As an inadvertent side effect of an unrelated code change, PRIV_KTRACE was alway | |
|
66
|
CVE-2026-93282 |
8.1 | 0.0038 | NET LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix | |
|
65
|
CVE-2026-57920 |
7.7 | 0.0038 | NET LOW CX NO UI | Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon t | |
|
65
|
CVE-2026-54910 |
7.7 | 0.0038 | NET LOW CX NO UI | FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to ver | |
|
65
|
CVE-2026-115570 |
7.4 | 0.0038 | NET NO AUTH NO UI | Electron is a framework for writing cross-platform desktop applications using Ja | |
|
64
|
CVE-2026-97024 |
7.1 | 0.0038 | NET NO AUTH LOW CX | A path traversal vulnerability in Flatpak's handling of the files/etc directory | |
|
64
|
CVE-2026-116683 |
7.1 | 0.0038 | NET LOW CX NO UI | CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 un | |
|
64
|
CVE-2026-9587 |
7.1 | 0.0038 | NET LOW CX NO UI | An authenticated local file inclusion vulnerability exists in Sangoma Switchvox | |
|
62
|
CVE-2026-0207 |
8.5 | 0.0038 | NET LOW CX NO UI | A vulnerability exists in FlashBlade whereby sensitive information may be logged | |
|
60
|
CVE-2026-18381 |
7.6 | 0.0038 | NET LOW CX NO UI | A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operato | |
|
55
|
CVE-2026-61536 |
7.5 | 0.0038 | NET NO UI | Banks generates meaningful LLM prompts using a simple template language. In vers |