Hunt List
12,867 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-46846 |
10.0 | 0.0036 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware | |
|
80
|
CVE-2026-91491 |
9.8 | 0.0035 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion | |
|
80
|
CVE-2026-56453 |
9.8 | 0.0035 | NET NO AUTH LOW CX NO UI | HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vu | |
|
80
|
CVE-2026-17024 |
9.8 | 0.0035 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
79
|
CVE-2026-44258 |
9.3 | 0.0036 | NET NO AUTH LOW CX NO UI | efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the elfinder_check | |
|
79
|
CVE-2026-48046 |
9.3 | 0.0036 | NET NO AUTH LOW CX NO UI | Streambert is a cross-platform Electron Desktop App to stream and download video | |
|
79
|
CVE-2026-35306 |
9.3 | 0.0035 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (compo | |
|
79
|
CVE-2026-61207 |
9.3 | 0.0035 | NET NO AUTH LOW CX NO UI | Vulnerability in the PeopleSoft Enterprise SCM eProcurement product of Oracle Pe | |
|
79
|
CVE-2026-62618 |
9.3 | 0.0035 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middlewar | |
|
78
|
CVE-2026-46910 |
9.1 | 0.0035 | NET NO AUTH LOW CX NO UI | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards | |
|
77
|
CVE-2026-111107 |
8.7 | 0.0036 | NET NO AUTH LOW CX NO UI | A NULL pointer dereference vulnerability in WatchGuard Fireware OS’s management | |
|
77
|
CVE-2026-58656 |
8.7 | 0.0035 | NET NO AUTH LOW CX NO UI | Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query | |
|
77
|
CVE-2026-116872 |
8.7 | 0.0035 | NET NO AUTH LOW CX NO UI | Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vu | |
|
77
|
CVE-2026-117540 |
8.7 | 0.0035 | NET NO AUTH LOW CX NO UI | svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability | |
|
77
|
CVE-2026-73939 |
8.6 | 0.0035 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
76
|
CVE-2026-4256 |
8.2 | 0.0035 | NET NO AUTH LOW CX NO UI | Improper neutralization of special elements used in an LDAP query ('LDAP injecti | |
|
76
|
CVE-2026-48771 |
8.2 | 0.0035 | NET NO AUTH LOW CX NO UI | ishankportfolio is a portfolio website. Prior to version 1.0.1, contact form sub | |
|
75
|
CVE-2025-66020 |
7.5 | 0.0036 | NET NO AUTH LOW CX NO UI | Valibot helps validate data using a schema. In versions from 0.31.0 to 1.1.0, th | |
|
75
|
CVE-2026-107042 |
7.5 | 0.0036 | NET NO AUTH LOW CX NO UI | Insecure permissions in USP Ultimate Screenshot Painter versionCode 240213.009 a | |
|
75
|
CVE-2026-8700 |
7.3 | 0.0036 | NET NO AUTH LOW CX NO UI | Crypt::DSA versions before 1.20 for Perl generate seeds using rand. Seeds were | |
|
75
|
CVE-2026-43891 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | changedetection.io is a free open source web page change detection tool. Prior t | |
|
75
|
CVE-2026-35269 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Vulnerability in the Identity Manager product of Oracle Fusion Middleware (compo | |
|
75
|
CVE-2026-60593 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Vulnerability in the PeopleSoft Enterprise FIN Staffing Front Office product of | |
|
75
|
CVE-2026-71023 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
75
|
CVE-2026-73879 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
75
|
CVE-2026-73903 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
75
|
CVE-2026-107052 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead v | |
|
74
|
CVE-2026-6653 |
7.0 | 0.0036 | NET NO AUTH LOW CX NO UI | Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2. | |
|
69
|
CVE-2026-16624 |
9.6 | 0.0036 | NET LOW CX NO UI | Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any a | |
|
69
|
CVE-2026-118321 |
9.6 | 0.0035 | NET NO AUTH LOW CX | Improper input validation in Core in Google Chrome on on Android prior to 156.0. | |
|
69
|
CVE-2026-118340 |
9.6 | 0.0035 | NET NO AUTH LOW CX | Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remo | |
|
69
|
CVE-2026-5289 |
9.6 | 0.0035 | NET NO AUTH LOW CX | Use after free in Navigation in Google Chrome prior to 146.0.7680.178 allowed a | |
|
68
|
CVE-2026-16496 |
8.9 | 0.0036 | NET NO AUTH NO UI | The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization | |
|
68
|
CVE-2025-62034 |
8.8 | 0.0035 | NET LOW CX NO UI | Incorrect Privilege Assignment vulnerability in uxper Togo togo.This issue affec | |
|
68
|
CVE-2026-113030 |
8.8 | 0.0035 | NET NO AUTH LOW CX | Improper access control in V8 in Google Chrome prior to 156.0.8078.47 allowed a | |
|
68
|
CVE-2026-115967 |
8.8 | 0.0035 | NET LOW CX NO UI | Weak Authentication vulnerability in Hamid Alinia Login with phone number login- | |
|
67
|
CVE-2026-49142 |
8.7 | 0.0036 | NET LOW CX NO UI | OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in th | |
|
67
|
CVE-2026-62979 |
8.4 | 0.0036 | NET LOW CX NO UI | jack lets users share media libraries through their Radarr/Sonarr stack, peer-to | |
|
65
|
CVE-2026-72566 |
7.7 | 0.0035 | NET LOW CX NO UI | A server-side request forgery (SSRF) vulnerability in automatisch through commit | |
|
64
|
CVE-2026-40518 |
7.1 | 0.0036 | NET LOW CX NO UI | ByteDance DeerFlow before commit 2176b2b contains a path traversal and arbitrary | |
|
64
|
CVE-2026-41653 |
7.0 | 0.0036 | NET NO AUTH LOW CX | BentoPDF is a client-side PDF toolkit that is self hostable. Prior to version 2. | |
|
64
|
CVE-2026-45225 |
7.2 | 0.0036 | NET LOW CX NO UI | Heym before 0.0.21 contains a path traversal vulnerability in the file upload en | |
|
64
|
CVE-2026-56335 |
7.1 | 0.0036 | NET LOW CX NO UI | Capgo before 12.128.2 contains an authorization bypass vulnerability where write | |
|
64
|
CVE-2026-73331 |
7.1 | 0.0036 | NET LOW CX NO UI | CamaleonCMS 2.9.1 contains an authenticated SQL injection vulnerability that all | |
|
64
|
CVE-2026-63099 |
7.1 | 0.0035 | NET LOW CX NO UI | TheHive through 4.1.24 contains a broken object-level authorization vulnerabilit | |
|
64
|
CVE-2026-63100 |
7.1 | 0.0035 | NET LOW CX NO UI | Maybe through 0.6.0 contains a missing authorization vulnerability that allows a | |
|
64
|
CVE-2026-115477 |
7.1 | 0.0035 | NET LOW CX NO UI | obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidia | |
|
64
|
CVE-2026-42012 |
7.1 | 0.0035 | NET NO AUTH LOW CX | A flaw was found in gnutls. A remote attacker could exploit this vulnerability b | |
|
62
|
CVE-2024-58293 |
8.6 | 0.0035 | NET LOW CX NO UI | Akaunting 3.1.8 contains a server-side template injection vulnerability that all | |
|
61
|
CVE-2026-60955 |
8.2 | 0.0036 | NET LOW CX NO UI | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar |