Hunt List
12,891 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-48114 |
9.8 | 0.0037 | NET NO AUTH LOW CX NO UI | Metacat is data repository software that helps researchers preserve, share, and | |
|
77
|
CVE-2026-110474 |
8.7 | 0.0037 | NET NO AUTH LOW CX NO UI | This vulnerability exists in the CreditNirvana Agentic AI Call Centre applicatio | |
|
77
|
CVE-2026-46776 |
8.6 | 0.0037 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middlewar | |
|
77
|
CVE-2026-61286 |
8.6 | 0.0037 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle E | |
|
77
|
CVE-2026-96616 |
8.3 | 0.0037 | NET NO AUTH LOW CX NO UI | Authentication tokens issued by the E3's web management interface on login are g | |
|
76
|
CVE-2026-40168 |
8.2 | 0.0037 | NET NO AUTH LOW CX NO UI | Postiz is an AI social media scheduling tool. Prior to 2.21.5, the /api/public/s | |
|
76
|
CVE-2026-66708 |
8.2 | 0.0037 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Total Upkeep <= 1.17.2 versions. | |
|
76
|
CVE-2026-73356 |
8.2 | 0.0037 | NET NO AUTH LOW CX NO UI | Unauthenticated Arbitrary Content Deletion in Breeze <= 2.5.12 versions. | |
|
75
|
CVE-2026-62242 |
7.7 | 0.0037 | NET NO AUTH LOW CX NO UI | Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vul | |
|
75
|
CVE-2026-33254 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | An attacker can create a large number of concurrent DoQ or DoH3 connections, cau | |
|
75
|
CVE-2026-33594 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | A client can trigger excessive memory allocation by generating a lot of queries | |
|
75
|
CVE-2026-33595 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | A client can trigger excessive memory allocation by generating a lot of errors r | |
|
75
|
CVE-2026-19082 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap byte | |
|
75
|
CVE-2026-54802 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Authentication in SMS Alert Order Notifications <= 3.9.3 | |
|
75
|
CVE-2026-43253 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: iommu/amd: | |
|
68
|
CVE-2026-43909 |
8.8 | 0.0037 | NET NO AUTH LOW CX | OpenImageIO is a toolset for reading, writing, and manipulating image files of a | |
|
68
|
CVE-2026-14422 |
8.8 | 0.0037 | NET NO AUTH LOW CX | Out of bounds read and write in Tint in Google Chrome prior to 150.0.7871.46 all | |
|
68
|
CVE-2026-17729 |
8.8 | 0.0037 | NET NO AUTH LOW CX | Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote at | |
|
68
|
CVE-2026-17971 |
8.8 | 0.0037 | NET NO AUTH LOW CX | Inappropriate implementation in Frame in Google Chrome prior to 151.0.7922.72 al | |
|
68
|
CVE-2026-86385 |
8.8 | 0.0037 | NET LOW CX NO UI | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, con | |
|
68
|
CVE-2026-6303 |
8.8 | 0.0037 | NET NO AUTH LOW CX | Use after free in Codecs in Google Chrome prior to 147.0.7727.101 allowed a remo | |
|
68
|
CVE-2026-8800 |
8.8 | 0.0037 | NET LOW CX NO UI | Incorrect Authorization vulnerability in Progress MOVEit Transfer (Audit User mo | |
|
68
|
CVE-2026-113046 |
8.8 | 0.0037 | NET NO AUTH LOW CX | Improper input validation in Passwords in Google Chrome prior to 156.0.8078.47 a | |
|
68
|
CVE-2026-113048 |
8.8 | 0.0037 | NET NO AUTH LOW CX | Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a | |
|
68
|
CVE-2026-113086 |
8.8 | 0.0037 | NET NO AUTH LOW CX | Improper input validation in Input in Google Chrome prior to 156.0.8078.47 allow | |
|
68
|
CVE-2026-113112 |
8.8 | 0.0037 | NET NO AUTH LOW CX | Use after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a r | |
|
68
|
CVE-2026-113221 |
8.8 | 0.0037 | NET NO AUTH LOW CX | Use after free in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a | |
|
68
|
CVE-2026-113170 |
8.8 | 0.0037 | NET NO AUTH LOW CX | Use after free in Autofill in Google Chrome on on Android prior to 156.0.8078.47 | |
|
67
|
CVE-2026-52700 |
8.5 | 0.0037 | NET LOW CX NO UI | Subscriber SQL Injection in WCMultiShipping <= 3.0.2 versions. | |
|
67
|
CVE-2026-43907 |
8.3 | 0.0037 | NET NO AUTH LOW CX | OpenImageIO is a toolset for reading, writing, and manipulating image files of a | |
|
66
|
CVE-2026-72555 |
8.1 | 0.0037 | NET LOW CX NO UI | A broken access control vulnerability in Peppermint Lab Peppermint through commi | |
|
65
|
CVE-2026-72591 |
7.7 | 0.0037 | NET LOW CX NO UI | A server-side request forgery (SSRF) vulnerability in gabehf/Koito through v0.3. | |
|
65
|
CVE-2026-55113 |
7.5 | 0.0037 | NET NO AUTH NO UI | A malicious actor with access to the network could exploit a Server-Side Request | |
|
64
|
CVE-2026-49346 |
7.1 | 0.0037 | NET NO AUTH LOW CX | libde265 is an open source implementation of the h.265 video codec. Prior to ver | |
|
64
|
CVE-2026-70561 |
7.1 | 0.0037 | NET LOW CX NO UI | TestLink 1.9.20 and prior contains an insecure direct object reference vulnerabi | |
|
64
|
CVE-2026-72609 |
7.1 | 0.0037 | NET LOW CX NO UI | An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and | |
|
64
|
CVE-2026-97023 |
7.1 | 0.0037 | NET NO AUTH LOW CX | A path traversal vulnerability in Flatpak's handling of the export/bin directory | |
|
64
|
CVE-2026-109297 |
7.1 | 0.0037 | NET LOW CX NO UI | Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in th | |
|
59
|
CVE-2026-57858 |
9.3 | 0.0037 | NET LOW CX | Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripti | |
|
57
|
CVE-2026-49113 |
8.5 | 0.0037 | NET NO UI | Subscriber Arbitrary Code Execution in Cornerstone < 7.8.8 versions. | |
|
57
|
CVE-2026-13131 |
8.3 | 0.0037 | NET NO AUTH | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe | |
|
57
|
CVE-2026-13132 |
8.3 | 0.0037 | NET NO AUTH | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe | |
|
57
|
CVE-2026-57264 |
8.3 | 0.0037 | NET NO AUTH | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe | |
|
57
|
CVE-2026-57265 |
8.3 | 0.0037 | NET NO AUTH | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe | |
|
57
|
CVE-2026-57266 |
8.3 | 0.0037 | NET NO AUTH | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe | |
|
57
|
CVE-2026-57267 |
8.3 | 0.0037 | NET NO AUTH | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe | |
|
57
|
CVE-2026-57269 |
8.3 | 0.0037 | NET NO AUTH | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe | |
|
57
|
CVE-2026-57270 |
8.3 | 0.0037 | NET NO AUTH | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe | |
|
57
|
CVE-2026-57271 |
8.3 | 0.0037 | NET NO AUTH | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe | |
|
55
|
CVE-2026-45804 |
7.5 | 0.0037 | NET NO AUTH | Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, Dif |