Hunt List
12,861 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-116386 |
9.8 | 0.0035 | NET NO AUTH LOW CX NO UI | Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 v | |
|
80
|
CVE-2026-13776 |
9.8 | 0.0035 | NET NO AUTH LOW CX NO UI | Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote | |
|
79
|
CVE-2026-111402 |
9.3 | 0.0035 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
78
|
CVE-2025-31699 |
9.1 | 0.0035 | NET NO AUTH LOW CX NO UI | Apache Traffic Server can return an origin connection to the shared pool while t | |
|
78
|
CVE-2026-116557 |
9.1 | 0.0035 | NET NO AUTH LOW CX NO UI | The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to u | |
|
77
|
CVE-2026-45169 |
8.7 | 0.0035 | NET NO AUTH LOW CX NO UI | Idira Privileged Access Manager (PAM) Self-Hosted Vault versions prior to 15.0.3 | |
|
77
|
CVE-2026-9219 |
8.3 | 0.0035 | NET NO AUTH LOW CX NO UI | Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior h | |
|
77
|
CVE-2026-114110 |
8.7 | 0.0035 | NET NO AUTH LOW CX NO UI | Astral uv before 0.11.6 contains a path traversal vulnerability that allows atta | |
|
76
|
CVE-2026-112381 |
8.2 | 0.0035 | NET NO AUTH LOW CX NO UI | Apache Traffic Server can crash with a null pointer dereference when a client PO | |
|
76
|
CVE-2026-41907 |
8.1 | 0.0035 | NET NO AUTH LOW CX NO UI | uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v | |
|
76
|
CVE-2026-41471 |
8.2 | 0.0035 | NET NO AUTH LOW CX NO UI | The Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contain | |
|
75
|
CVE-2026-115417 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adap | |
|
75
|
CVE-2026-115907 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | zip is a zip library for Rust that supports reading and writing simple ZIP files | |
|
70
|
CVE-2026-91637 |
9.9 | 0.0035 | NET LOW CX NO UI | Vulnerability in Oracle Essbase (component: Security). The supported version t | |
|
69
|
CVE-2026-12564 |
9.6 | 0.0035 | NET LOW CX NO UI | A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The | |
|
69
|
CVE-2026-54630 |
9.6 | 0.0035 | NET LOW CX NO UI | Part-DB is an open source inventory management system for electronic components. | |
|
68
|
CVE-2026-114661 |
9.0 | 0.0035 | NET LOW CX NO UI | OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in | |
|
68
|
CVE-2026-42843 |
8.8 | 0.0035 | NET LOW CX NO UI | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access | |
|
68
|
CVE-2026-118008 |
8.8 | 0.0035 | NET NO AUTH LOW CX | Privilege escalation in the DOM: Navigation component. This vulnerability was fi | |
|
67
|
CVE-2026-44400 |
8.7 | 0.0035 | NET LOW CX NO UI | MailEnable Enterprise Premium 10.55 and earlier contains an improper authorizati | |
|
67
|
CVE-2026-63344 |
8.6 | 0.0035 | NET NO AUTH LOW CX | Refitter is a tool for generating a C# REST API client using the Refit library. | |
|
67
|
CVE-2026-63346 |
8.6 | 0.0035 | NET NO AUTH LOW CX | Refitter is a tool for generating a C# REST API client using the Refit library. | |
|
67
|
CVE-2026-63345 |
8.6 | 0.0035 | NET NO AUTH LOW CX | Refitter is a tool for generating a C# REST API client using the Refit library. | |
|
67
|
CVE-2026-17191 |
8.5 | 0.0035 | NET LOW CX NO UI | An input validation vulnerability exists in an API component of the orchestrator | |
|
67
|
CVE-2026-31939 |
8.3 | 0.0035 | NET LOW CX NO UI | Chamilo LMS is a learning management system. Prior to 1.11.38, there is a path t | |
|
67
|
CVE-2026-45732 |
8.3 | 0.0035 | NET LOW CX NO UI | n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, a | |
|
67
|
CVE-2026-11340 |
8.3 | 0.0035 | NET LOW CX NO UI | Missing Authorization vulnerability in HAVELSAN Inc. Liman MYS allows Accessing | |
|
67
|
CVE-2026-116019 |
8.7 | 0.0035 | NET LOW CX NO UI | Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows | |
|
67
|
CVE-2026-54415 |
8.6 | 0.0035 | NET LOW CX NO UI | Missing Authorization in the server management routes (routes/admin.php) in Azur | |
|
66
|
CVE-2026-28381 |
8.1 | 0.0035 | NET LOW CX NO UI | The Snowflake datasource allows for GET/PUT commands, which can allow any user w | |
|
66
|
CVE-2026-54842 |
8.1 | 0.0035 | NET LOW CX NO UI | Missing Authorization vulnerability in Royal Plugins Royal MCP allows Exploiting | |
|
66
|
CVE-2026-59796 |
8.1 | 0.0035 | NET LOW CX NO UI | In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to | |
|
66
|
CVE-2026-13445 |
8.1 | 0.0035 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.1 can allow an authenticated attacker to exp | |
|
66
|
CVE-2026-32821 |
8.1 | 0.0035 | NET LOW CX NO UI | dataCycle is a data management system for centrally storing, managing, searching | |
|
66
|
CVE-2026-13444 |
8.1 | 0.0035 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to access another us | |
|
66
|
CVE-2026-72563 |
8.1 | 0.0035 | NET LOW CX NO UI | A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allo | |
|
66
|
CVE-2026-72595 |
8.1 | 0.0035 | NET LOW CX NO UI | A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allo | |
|
66
|
CVE-2026-13169 |
8.1 | 0.0035 | NET LOW CX NO UI | The Eventin WordPress plugin before 4.1.21 does not properly verify ownership o | |
|
66
|
CVE-2026-11861 |
8.1 | 0.0035 | NET LOW CX NO UI | A flaw was found in FreeIPA. When a trust relationship is configured between Fre | |
|
66
|
CVE-2026-101834 |
8.1 | 0.0035 | NET NO AUTH NO UI | Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suit | |
|
66
|
CVE-2026-83409 |
8.1 | 0.0035 | NET NO AUTH NO UI | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware ( | |
|
66
|
CVE-2026-87305 |
8.1 | 0.0035 | NET NO AUTH NO UI | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards | |
|
66
|
CVE-2026-91313 |
8.1 | 0.0035 | NET NO AUTH NO UI | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards | |
|
65
|
CVE-2026-43884 |
7.7 | 0.0035 | NET LOW CX NO UI | WWBN AVideo is an open source video platform. In versions up to and including 29 | |
|
64
|
CVE-2026-42156 |
7.1 | 0.0035 | NET LOW CX NO UI | Flowsint is an open-source OSINT graph exploration tool designed for cybersecuri | |
|
64
|
CVE-2026-7017 |
7.1 | 0.0035 | NET NO AUTH LOW CX | HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-or | |
|
57
|
CVE-2026-116675 |
8.5 | 0.0035 | NET LOW CX | TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5. | |
|
57
|
CVE-2026-118255 |
8.4 | 0.0035 | NET LOW CX | Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3. | |
|
55
|
CVE-2026-68900 |
7.6 | 0.0035 | NET LOW CX | Wekan is open source kanban built with Meteor. From 8.72 until 10.23, addBoardHT | |
|
55
|
CVE-2026-5284 |
7.5 | 0.0035 | NET NO AUTH | Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote |