Hunt List
12,881 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-50083 |
9.8 | 0.0036 | NET NO AUTH LOW CX NO UI | The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client c | |
|
80
|
CVE-2024-34323 |
10.0 | 0.0036 | NET NO AUTH LOW CX NO UI | ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct | |
|
80
|
CVE-2026-109780 |
9.8 | 0.0036 | NET NO AUTH LOW CX NO UI | Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixe | |
|
80
|
CVE-2026-82120 |
9.8 | 0.0036 | NET NO AUTH LOW CX NO UI | Heap-based Buffer Overflow Vulnerability in HiRDB. This issue affects HiRDB Se | |
|
80
|
CVE-2026-46919 |
9.8 | 0.0036 | NET NO AUTH LOW CX NO UI | Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM | |
|
79
|
CVE-2026-39492 |
9.3 | 0.0036 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in WP Maps <= 4.9.1 versions. | |
|
79
|
CVE-2026-39493 |
9.3 | 0.0036 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.9.27 versio | |
|
78
|
CVE-2026-45363 |
9.1 | 0.0036 | NET NO AUTH LOW CX NO UI | ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. | |
|
77
|
CVE-2026-22734 |
8.6 | 0.0036 | NET NO AUTH LOW CX NO UI | Cloud Foundry UUA is vulnerable to a bypass that allows an attacker to obtain a | |
|
77
|
CVE-2026-63568 |
8.7 | 0.0036 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in the CMP/CRMF password-ba | |
|
77
|
CVE-2026-44339 |
8.6 | 0.0036 | NET NO AUTH LOW CX NO UI | PraisonAI is a multi-agent teams system. Prior to praisonai version 4.6.37 and p | |
|
77
|
CVE-2026-67431 |
8.3 | 0.0036 | NET NO AUTH LOW CX NO UI | MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and cli | |
|
76
|
CVE-2026-41458 |
8.2 | 0.0036 | NET NO AUTH LOW CX NO UI | OwnTone Server versions 28.4 through 29.0 contain a race condition vulnerability | |
|
75
|
CVE-2026-13149 |
7.7 | 0.0036 | NET NO AUTH LOW CX NO UI | brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() f | |
|
75
|
CVE-2026-31937 |
7.5 | 0.0036 | NET NO AUTH LOW CX NO UI | Suricata is a network IDS, IPS and NSM engine. Prior to version 7.0.15, ineffici | |
|
75
|
CVE-2026-41254 |
7.5 | 0.0036 | NET NO AUTH LOW CX NO UI | Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c | |
|
75
|
CVE-2026-6759 |
7.5 | 0.0036 | NET NO AUTH LOW CX NO UI | Use-after-free in the Widget: Cocoa component. This vulnerability was fixed in F | |
|
70
|
CVE-2026-39440 |
9.9 | 0.0036 | NET LOW CX NO UI | Improper Control of Generation of Code ('Code Injection') vulnerability in Funne | |
|
70
|
CVE-2026-42368 |
9.9 | 0.0036 | NET LOW CX NO UI | A privilege escalation vulnerability exists in the Web Interface functionality o | |
|
70
|
CVE-2026-35263 |
9.9 | 0.0036 | NET LOW CX NO UI | Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (compon | |
|
69
|
CVE-2026-70855 |
9.3 | 0.0036 | NET NO AUTH LOW CX | Vulnerability in the Siebel Apps - Self Service product of Oracle Siebel CRM (co | |
|
69
|
CVE-2026-46861 |
9.6 | 0.0036 | NET LOW CX NO UI | Vulnerability in the MySQL NDB Cluster product of Oracle MySQL (component: Clust | |
|
69
|
CVE-2026-60239 |
9.6 | 0.0036 | NET LOW CX NO UI | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (compo | |
|
69
|
CVE-2026-60540 |
9.6 | 0.0036 | NET LOW CX NO UI | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo | |
|
68
|
CVE-2026-20043 |
9.0 | 0.0036 | NET NO AUTH NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
68
|
CVE-2026-101842 |
8.8 | 0.0036 | NET NO AUTH LOW CX | Vulnerability in the Strategic Network Optimization product of Oracle E-Business | |
|
67
|
CVE-2026-70463 |
8.6 | 0.0036 | NET LOW CX NO UI | rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directiv | |
|
66
|
CVE-2026-22325 |
8.1 | 0.0036 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Promo <= 1.3.0 versions. | |
|
66
|
CVE-2026-22330 |
8.1 | 0.0036 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Right Way <= 4.0 versions. | |
|
66
|
CVE-2026-22331 |
8.1 | 0.0036 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in AutoParts <= 1.5.8 versions. | |
|
66
|
CVE-2026-47417 |
8.1 | 0.0036 | NET LOW CX NO UI | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams sys | |
|
65
|
CVE-2026-50279 |
7.6 | 0.0036 | NET LOW CX NO UI | Craft CMS is a content management system (CMS). IN versions 5.0.0-RC1 and above | |
|
64
|
CVE-2026-90464 |
7.2 | 0.0036 | NET LOW CX NO UI | An external control of file path vulnerability in a WatchGuard Fireware OS firew | |
|
64
|
CVE-2026-48089 |
7.1 | 0.0036 | NET LOW CX NO UI | DevGuard provides vulnerability management for the full software supply chain. P | |
|
64
|
CVE-2026-54602 |
7.1 | 0.0036 | NET LOW CX NO UI | FastGPT is a knowledge-based AI application platform. Prior to 4.15.0, GET /api/ | |
|
64
|
CVE-2026-62191 |
7.1 | 0.0036 | NET LOW CX NO UI | OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulne | |
|
64
|
CVE-2026-12945 |
7.1 | 0.0036 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.1 allows authenticated users to access and m | |
|
64
|
CVE-2026-113606 |
7.1 | 0.0036 | NET LOW CX NO UI | Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability | |
|
64
|
CVE-2026-91238 |
7.1 | 0.0036 | NET LOW CX NO UI | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo | |
|
64
|
CVE-2026-118249 |
7.2 | 0.0036 | NET LOW CX NO UI | Highcharts JS is a JavaScript charting library based on SVG. From 13.0.0 until 1 | |
|
64
|
CVE-2026-118250 |
7.2 | 0.0036 | NET LOW CX NO UI | Highcharts JS is a JavaScript charting library based on SVG. From 6.1.0 until 11 | |
|
64
|
CVE-2026-41325 |
7.1 | 0.0036 | NET LOW CX NO UI | Kirby is an open-source content management system. Kirby's user permissions cont | |
|
64
|
CVE-2026-18705 |
7.1 | 0.0036 | NET LOW CX NO UI | An issue in MongoDB Server's Atlas Vector Search feature could allow an authenti | |
|
64
|
CVE-2026-119649 |
7.1 | 0.0036 | NET LOW CX NO UI | Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability | |
|
63
|
CVE-2026-34177 |
9.1 | 0.0036 | NET LOW CX NO UI | Canonical LXD versions 4.12 through 6.7 contain an incomplete denylist in isVMLo | |
|
59
|
CVE-2026-41566 |
9.4 | 0.0036 | NET LOW CX | Improper Handling of Insufficient Permissions or Privileges vulnerability in Apa | |
|
59
|
CVE-2026-4113 |
7.2 | 0.0036 | NET LOW CX NO UI | An observable response discrepancy vulnerability in the SonicWall SMA1000 series | |
|
57
|
CVE-2026-62246 |
8.5 | 0.0036 | NET NO UI | Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, | |
|
55
|
CVE-2026-68578 |
7.7 | 0.0036 | NET NO UI | ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the | |
|
45
|
CVE-2026-55659 |
7.7 | 0.0036 | NET | Grist is spreadsheet software using Python as its formula language. Prior to 1.7 |