Hunt List
12,872 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2025-61163 |
9.8 | 0.0036 | NET NO AUTH LOW CX NO UI | Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-do | |
|
80
|
CVE-2026-110956 |
9.8 | 0.0036 | NET NO AUTH LOW CX NO UI | The asVereinbase WordPress plugin before 1.1.8 does not require a valid passwor | |
|
79
|
CVE-2025-48089 |
9.3 | 0.0036 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
78
|
CVE-2026-33896 |
9.1 | 0.0036 | NET NO AUTH LOW CX NO UI | Forge (also called `node-forge`) is a native implementation of Transport Layer S | |
|
76
|
CVE-2026-10564 |
8.2 | 0.0036 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side Request Forgery (SSR | |
|
75
|
CVE-2026-116372 |
7.7 | 0.0036 | NET NO AUTH LOW CX NO UI | MISP mispguard is a security filtering proxy that inspects and blocks MISP feed | |
|
75
|
CVE-2025-51735 |
7.5 | 0.0036 | NET NO AUTH LOW CX NO UI | CSV formula injection vulnerability in HCL Technologies Ltd. Unica 12.0.0. | |
|
75
|
CVE-2026-1718 |
7.5 | 0.0036 | NET NO AUTH LOW CX NO UI | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a deni | |
|
75
|
CVE-2026-44635 |
7.5 | 0.0036 | NET NO AUTH LOW CX NO UI | Kysely is a type-safe TypeScript SQL query builder. From 0.26.0 to 0.28.16, Defa | |
|
75
|
CVE-2026-49061 |
7.5 | 0.0036 | NET NO AUTH LOW CX NO UI | Unauthenticated Arbitrary File Download in WPC Product Options for WooCommerce < | |
|
75
|
CVE-2026-41205 |
7.7 | 0.0036 | NET NO AUTH LOW CX NO UI | Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.ge | |
|
75
|
CVE-2026-13189 |
7.5 | 0.0036 | NET NO AUTH LOW CX NO UI | In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation | |
|
75
|
CVE-2026-1345 |
7.3 | 0.0036 | NET NO AUTH LOW CX NO UI | IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify | |
|
74
|
CVE-2026-111812 |
7.0 | 0.0036 | NET NO AUTH LOW CX NO UI | Apache Traffic Server's origin_server_auth plugin lets a client force signing of | |
|
69
|
CVE-2026-40872 |
9.3 | 0.0036 | NET NO AUTH LOW CX | mailcow: dockerized is an open source groupware/email suite based on docker. In | |
|
68
|
CVE-2023-30901 |
8.8 | 0.0036 | NET NO AUTH LOW CX | A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All vers | |
|
68
|
CVE-2026-47399 |
8.8 | 0.0036 | NET LOW CX NO UI | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams sys | |
|
68
|
CVE-2026-63378 |
8.8 | 0.0036 | NET LOW CX NO UI | TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators | |
|
67
|
CVE-2026-8621 |
8.7 | 0.0036 | NET LOW CX NO UI | Crabbox prior to v0.12.0 contains an authentication bypass vulnerability that al | |
|
67
|
CVE-2026-45178 |
8.4 | 0.0036 | NET LOW CX NO UI | Idira Secrets Manager Self-Hosted versions 13.8.0 and lower exhibit improper acc | |
|
66
|
CVE-2026-61321 |
8.1 | 0.0036 | NET LOW CX NO UI | Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM | |
|
66
|
CVE-2026-62477 |
8.1 | 0.0036 | NET LOW CX NO UI | Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle | |
|
66
|
CVE-2026-62502 |
8.1 | 0.0036 | NET LOW CX NO UI | Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle | |
|
66
|
CVE-2026-62600 |
8.1 | 0.0036 | NET LOW CX NO UI | Vulnerability in the Oracle Sales product of Oracle E-Business Suite (component: | |
|
66
|
CVE-2026-70671 |
8.1 | 0.0036 | NET LOW CX NO UI | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middlewar | |
|
66
|
CVE-2026-70701 |
8.1 | 0.0036 | NET LOW CX NO UI | Vulnerability in the Oracle Payables product of Oracle E-Business Suite (compone | |
|
66
|
CVE-2026-70738 |
8.1 | 0.0036 | NET LOW CX NO UI | Vulnerability in the Oracle Hyperion Profitability and Cost Management product o | |
|
66
|
CVE-2026-70762 |
8.1 | 0.0036 | NET LOW CX NO UI | Vulnerability in the Oracle Risk Management product of Oracle E-Business Suite ( | |
|
66
|
CVE-2026-70782 |
8.1 | 0.0036 | NET LOW CX NO UI | Vulnerability in the Oracle Labor Distribution product of Oracle E-Business Suit | |
|
66
|
CVE-2026-70805 |
8.1 | 0.0036 | NET LOW CX NO UI | Vulnerability in the Oracle Project Planning and Control product of Oracle E-Bus | |
|
66
|
CVE-2026-70811 |
8.1 | 0.0036 | NET LOW CX NO UI | Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (compo | |
|
66
|
CVE-2026-70815 |
8.1 | 0.0036 | NET LOW CX NO UI | Vulnerability in the Oracle Internet Procurement Connector product of Oracle E-B | |
|
66
|
CVE-2026-70830 |
8.1 | 0.0036 | NET LOW CX NO UI | Vulnerability in the Oracle Process Manufacturing Systems product of Oracle E-Bu | |
|
66
|
CVE-2026-70835 |
8.1 | 0.0036 | NET LOW CX NO UI | Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (com | |
|
66
|
CVE-2026-70878 |
8.1 | 0.0036 | NET LOW CX NO UI | Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora | |
|
66
|
CVE-2026-70881 |
8.1 | 0.0036 | NET LOW CX NO UI | Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora | |
|
66
|
CVE-2026-70925 |
8.1 | 0.0036 | NET LOW CX NO UI | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype | |
|
66
|
CVE-2026-70929 |
8.1 | 0.0036 | NET LOW CX NO UI | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype | |
|
66
|
CVE-2026-70957 |
8.1 | 0.0036 | NET LOW CX NO UI | Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle | |
|
66
|
CVE-2026-70999 |
8.1 | 0.0036 | NET LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
66
|
CVE-2026-71110 |
8.1 | 0.0036 | NET LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
62
|
CVE-2026-91437 |
8.7 | 0.0036 | NET LOW CX NO UI | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone | |
|
61
|
CVE-2026-60854 |
8.2 | 0.0036 | NET LOW CX NO UI | Vulnerability in the Oracle Quality product of Oracle E-Business Suite (componen | |
|
55
|
CVE-2026-13802 |
7.5 | 0.0036 | NET NO AUTH | Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote | |
|
55
|
CVE-2026-14064 |
7.5 | 0.0036 | NET NO AUTH | Use after free in PageInfo in Google Chrome on Android prior to 150.0.7871.47 al | |
|
55
|
CVE-2026-14409 |
7.5 | 0.0036 | NET NO AUTH | Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allow | |
|
55
|
CVE-2026-14426 |
7.5 | 0.0036 | NET NO AUTH | Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote at | |
|
55
|
CVE-2026-56842 |
7.5 | 0.0036 | NET NO UI | A malicious actor with access to the network and under certain conditions could | |
|
55
|
CVE-2026-17896 |
7.5 | 0.0036 | NET NO AUTH | Use after free in DevTools in Google Chrome prior to 151.0.7922.72 allowed a rem | |
|
55
|
CVE-2026-91406 |
7.5 | 0.0036 | NET NO AUTH | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl |