Hunt List
12,859 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-109774 |
9.8 | 0.0034 | NET NO AUTH LOW CX NO UI | Invalid pointer, undefined behavior in the DOM: Notifications component. This vu | |
|
80
|
CVE-2026-46389 |
9.8 | 0.0034 | NET NO AUTH LOW CX NO UI | UDS Identity Config builds the Keycloak configuration image (realm, plugins, the | |
|
80
|
CVE-2026-113616 |
9.8 | 0.0034 | NET NO AUTH LOW CX NO UI | The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-r | |
|
79
|
CVE-2026-111411 |
9.3 | 0.0034 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
78
|
CVE-2026-50638 |
9.1 | 0.0034 | NET NO AUTH LOW CX NO UI | Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect | |
|
78
|
CVE-2026-44603 |
9.1 | 0.0034 | NET NO AUTH LOW CX NO UI | Tor before 0.4.9.7 has an out-of-bounds read by one byte via a malformed BEGIN c | |
|
78
|
CVE-2026-107017 |
9.1 | 0.0034 | NET NO AUTH LOW CX NO UI | Insecure permissions in the ShortcutDispatchActivity component of canvoki versio | |
|
78
|
CVE-2026-107028 |
9.1 | 0.0034 | NET NO AUTH LOW CX NO UI | Insecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows un | |
|
78
|
CVE-2025-30052 |
8.8 | 0.0034 | NET NO AUTH LOW CX NO UI | The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass vi | |
|
78
|
CVE-2026-58102 |
9.1 | 0.0034 | NET NO AUTH LOW CX NO UI | Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow a heap out-of-bounds r | |
|
77
|
CVE-2026-0646 |
8.7 | 0.0034 | NET NO AUTH LOW CX NO UI | A denial-of-service security issue exists within the 1794-AENTR adapter due to i | |
|
77
|
CVE-2026-60235 |
8.6 | 0.0034 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (compo | |
|
77
|
CVE-2026-60671 |
8.6 | 0.0034 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of | |
|
77
|
CVE-2026-41680 |
8.7 | 0.0034 | NET NO AUTH LOW CX NO UI | Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Deni | |
|
77
|
CVE-2026-6823 |
8.3 | 0.0034 | NET NO AUTH LOW CX NO UI | HKUDS OpenHarness prior to PR #147 remediation contains an insecure default conf | |
|
75
|
CVE-2026-37454 |
7.5 | 0.0034 | NET NO AUTH LOW CX NO UI | Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 a | |
|
75
|
CVE-2026-116580 |
7.3 | 0.0034 | NET NO AUTH LOW CX NO UI | Seroval facilitates JavaScript value stringification, including complex structur | |
|
70
|
CVE-2026-63297 |
9.9 | 0.0034 | NET LOW CX NO UI | An authorization bypass vulnerability in LXD due to a timing flaw during configu | |
|
70
|
CVE-2026-91658 |
9.9 | 0.0034 | NET LOW CX NO UI | Vulnerability in Oracle Essbase (component: Security). The supported version t | |
|
70
|
CVE-2026-91663 |
9.9 | 0.0034 | NET LOW CX NO UI | Vulnerability in Oracle Essbase (component: Security). The supported version t | |
|
69
|
CVE-2026-45833 |
9.4 | 0.0034 | NET LOW CX NO UI | A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python | |
|
68
|
CVE-2026-8915 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflo | |
|
68
|
CVE-2026-7870 |
8.8 | 0.0034 | NET LOW CX NO UI | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a user to gain elevated privileges due | |
|
68
|
CVE-2026-6299 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Use after free in Prerender in Google Chrome prior to 147.0.7727.101 allowed a r | |
|
68
|
CVE-2026-6300 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Use after free in CSS in Google Chrome prior to 147.0.7727.101 allowed a remote | |
|
68
|
CVE-2026-6316 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Use after free in Forms in Google Chrome prior to 147.0.7727.101 allowed a remot | |
|
68
|
CVE-2026-6317 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Use after free in Cast in Google Chrome prior to 147.0.7727.101 allowed a remote | |
|
67
|
CVE-2026-45687 |
8.5 | 0.0034 | NET LOW CX NO UI | Rocket.Chat is an open-source, secure, fully customizable communications platfor | |
|
66
|
CVE-2026-33381 |
8.1 | 0.0034 | NET LOW CX NO UI | When a user's access to mint tokens for a service account is revoked, it is some | |
|
66
|
CVE-2026-114715 |
8.1 | 0.0034 | NET LOW CX NO UI | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorre | |
|
66
|
CVE-2026-84725 |
8.1 | 0.0034 | NET NO AUTH NO UI | when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplie | |
|
66
|
CVE-2026-48064 |
8.1 | 0.0034 | NET NO AUTH NO UI | pam_usb provides hardware authentication for Linux using ordinary removable medi | |
|
66
|
CVE-2026-25439 |
8.1 | 0.0034 | NET NO AUTH NO UI | Authentication Bypass Using an Alternate Path or Channel vulnerability in Bookne | |
|
66
|
CVE-2026-42088 |
8.1 | 0.0034 | NET LOW CX NO UI | OpenC3 COSMOS provides the functionality needed to send commands to and receive | |
|
66
|
CVE-2026-13187 |
8.1 | 0.0034 | NET NO AUTH NO UI | In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider t | |
|
66
|
CVE-2026-93786 |
8.1 | 0.0034 | NET LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ksmbd: pres | |
|
65
|
CVE-2026-7466 |
7.7 | 0.0034 | NET NO AUTH LOW CX | AgentFlow contains an arbitrary code execution vulnerability that allows attacke | |
|
65
|
CVE-2026-108334 |
7.4 | 0.0034 | NET LOW CX NO UI | A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant op | |
|
64
|
CVE-2026-56221 |
7.1 | 0.0034 | NET LOW CX NO UI | Cap-go before 12.128.2 contains multiple SQL injection vulnerabilities in cloudf | |
|
64
|
CVE-2026-60492 |
7.1 | 0.0034 | NET LOW CX NO UI | Vulnerability in the JD Edwards EnterpriseOne HCM Foundation product of Oracle J | |
|
64
|
CVE-2026-73617 |
7.1 | 0.0034 | NET LOW CX NO UI | Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB d | |
|
64
|
CVE-2026-53902 |
7.1 | 0.0034 | NET LOW CX NO UI | MCO does not properly enforce authorization checks in the /customer/servlet/mco/ | |
|
62
|
CVE-2026-71574 |
8.5 | 0.0034 | NET LOW CX NO UI | Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endp | |
|
59
|
CVE-2026-22615 |
7.2 | 0.0034 | NET LOW CX NO UI | Due to improper input validation in one of the Eaton Intelligent Power Protector | |
|
57
|
CVE-2026-12530 |
8.4 | 0.0034 | NET LOW CX | Improper neutralization of argument delimiters in the install_packages() method | |
|
57
|
CVE-2026-19173 |
8.3 | 0.0034 | NET NO AUTH | Out of bounds write in Skia in Google Chrome prior to 151.0.7922.109 allowed a r | |
|
57
|
CVE-2026-9203 |
8.5 | 0.0034 | NET NO UI | A server-side request forgery vulnerability in Progress MarkLogic Server before | |
|
55
|
CVE-2026-32824 |
7.3 | 0.0034 | NET LOW CX | dataCycle is a data management system for centrally storing, managing, searching | |
|
55
|
CVE-2026-32825 |
7.3 | 0.0034 | NET LOW CX | dataCycle is a data management system for centrally storing, managing, searching | |
|
50
|
CVE-2026-62594 |
7.7 | 0.0034 | NET NO UI | Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (compon |