Hunt List
12,833 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-62874 |
10.0 | 0.0032 | NET NO AUTH LOW CX NO UI | Insufficient verification of data authenticity in Azure Billing allows an unauth | |
|
78
|
CVE-2026-72794 |
9.2 | 0.0032 | NET NO AUTH LOW CX NO UI | siyuan versions before v3.7.4 expose the session cookie signing key through the | |
|
78
|
CVE-2026-4337 |
8.8 | 0.0032 | NET NO AUTH LOW CX NO UI | Unrestricted Upload of File with Dangerous Type vulnerability in the PuMuKIT app | |
|
77
|
CVE-2026-110838 |
8.7 | 0.0033 | NET NO AUTH LOW CX NO UI | FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the | |
|
76
|
CVE-2026-55641 |
8.2 | 0.0033 | NET NO AUTH LOW CX NO UI | 9Router is an AI router & token saver. Prior to 0.5.2, 9router determines whethe | |
|
75
|
CVE-2025-46175 |
7.5 | 0.0033 | NET NO AUTH LOW CX NO UI | Ruoyi v4.8.0 is vulnerable to Incorrect Access Control. There is a missing check | |
|
75
|
CVE-2026-28913 |
7.5 | 0.0033 | NET NO AUTH LOW CX NO UI | The issue was addressed with improved memory handling. This issue is fixed in Sa | |
|
75
|
CVE-2026-49112 |
7.5 | 0.0033 | NET NO AUTH LOW CX NO UI | Unauthenticated Path Traversal in Shared Files <= 1.7.64 versions. | |
|
75
|
CVE-2026-9690 |
7.5 | 0.0033 | NET NO AUTH LOW CX NO UI | Unauthenticated Arbitrary File Download in WP Media folder Addon <= 4.0.1 versio | |
|
75
|
CVE-2026-28964 |
7.5 | 0.0032 | NET NO AUTH LOW CX NO UI | An inconsistent user interface issue was addressed with improved state managemen | |
|
70
|
CVE-2026-53942 |
9.9 | 0.0032 | NET LOW CX NO UI | Conda Organization Infrastructure is a centralized location for infrastructure c | |
|
69
|
CVE-2026-109705 |
9.6 | 0.0032 | NET NO AUTH LOW CX | Sandbox escape, site isolation issue due to incorrect boundary conditions, use-a | |
|
69
|
CVE-2026-109707 |
9.6 | 0.0032 | NET NO AUTH LOW CX | Sandbox escape due to use-after-free in the Networking component. This vulnerabi | |
|
68
|
CVE-2026-112242 |
8.8 | 0.0033 | NET LOW CX NO UI | Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profi | |
|
67
|
CVE-2026-7489 |
8.7 | 0.0033 | NET LOW CX NO UI | CTMS developed by Sunnet has a SQL Injection vulnerability, allowing authenticat | |
|
67
|
CVE-2026-48716 |
8.7 | 0.0033 | NET NO AUTH NO UI | nanobot is a personal AI assistant. In versions 0.1.5.post3 and prior, the Whats | |
|
67
|
CVE-2026-54759 |
8.7 | 0.0033 | NET NO AUTH LOW CX | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, L | |
|
66
|
CVE-2026-101791 |
8.1 | 0.0033 | NET LOW CX NO UI | Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product | |
|
66
|
CVE-2026-101831 |
8.1 | 0.0033 | NET LOW CX NO UI | Vulnerability in the Oracle Quality product of Oracle E-Business Suite (componen | |
|
66
|
CVE-2026-83361 |
8.1 | 0.0033 | NET LOW CX NO UI | Vulnerability in the Oracle Contract Lifecycle Management for Public Sector prod | |
|
66
|
CVE-2026-91269 |
8.1 | 0.0033 | NET LOW CX NO UI | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards | |
|
66
|
CVE-2026-14032 |
8.1 | 0.0032 | NET NO AUTH NO UI | Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allow | |
|
65
|
CVE-2026-101830 |
7.7 | 0.0033 | NET LOW CX NO UI | Vulnerability in the Oracle Project Contracts product of Oracle E-Business Suite | |
|
65
|
CVE-2026-91568 |
7.7 | 0.0033 | NET LOW CX NO UI | Vulnerability in the RDBMS component of Oracle Database Server. Supported versi | |
|
64
|
CVE-2026-58056 |
7.2 | 0.0033 | NET LOW CX NO UI | RustDesk gates incoming control messages on per-capability flags rather than on | |
|
64
|
CVE-2026-109938 |
7.1 | 0.0033 | NET NO AUTH LOW CX | Positive mapped-video coordinates overflow and abort FreeRDP clients A malicious | |
|
64
|
CVE-2026-109939 |
7.1 | 0.0033 | NET NO AUTH LOW CX | FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in update_read_ | |
|
64
|
CVE-2026-109941 |
7.1 | 0.0033 | NET NO AUTH LOW CX | FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in http | |
|
64
|
CVE-2026-7819 |
7.2 | 0.0032 | NET LOW CX NO UI | Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 File Manager. check_ | |
|
64
|
CVE-2026-109942 |
7.1 | 0.0032 | NET NO AUTH LOW CX | FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_pack | |
|
64
|
CVE-2026-74047 |
7.1 | 0.0032 | NET LOW CX NO UI | Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability | |
|
57
|
CVE-2026-46804 |
8.7 | 0.0033 | NET LOW CX | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
57
|
CVE-2026-47017 |
8.7 | 0.0033 | NET LOW CX | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS | |
|
57
|
CVE-2026-60443 |
8.7 | 0.0033 | NET LOW CX | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
57
|
CVE-2026-60469 |
8.7 | 0.0033 | NET LOW CX | Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middlew | |
|
57
|
CVE-2026-60470 |
8.7 | 0.0033 | NET LOW CX | Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middlew | |
|
57
|
CVE-2026-60523 |
8.7 | 0.0033 | NET LOW CX | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
57
|
CVE-2026-61078 |
8.7 | 0.0033 | NET LOW CX | Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product | |
|
57
|
CVE-2026-60981 |
8.7 | 0.0033 | NET LOW CX | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
57
|
CVE-2026-61215 |
8.7 | 0.0033 | NET LOW CX | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware | |
|
57
|
CVE-2026-61219 |
8.7 | 0.0033 | NET LOW CX | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware | |
|
57
|
CVE-2026-70778 |
8.7 | 0.0033 | NET LOW CX | Vulnerability in the Oracle Customer Care product of Oracle E-Business Suite (co | |
|
57
|
CVE-2026-70903 |
8.7 | 0.0033 | NET LOW CX | Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora | |
|
57
|
CVE-2026-71000 |
8.7 | 0.0033 | NET LOW CX | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
55
|
CVE-2026-60945 |
7.3 | 0.0033 | NET LOW CX | Vulnerability in the Oracle Learning Management product of Oracle E-Business Sui | |
|
50
|
CVE-2026-60534 |
7.7 | 0.0032 | NET NO UI | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion | |
|
50
|
CVE-2026-70694 |
7.7 | 0.0032 | NET NO UI | Vulnerability in the Oracle Payments product of Oracle E-Business Suite (compone | |
|
50
|
CVE-2026-70695 |
7.7 | 0.0032 | NET NO UI | Vulnerability in the Oracle Payments product of Oracle E-Business Suite (compone | |
|
50
|
CVE-2026-70804 |
7.7 | 0.0032 | NET NO UI | Vulnerability in the Oracle Public Sector Human Resources product of Oracle E-Bu | |
|
49
|
CVE-2026-34496 |
7.1 | 0.0033 | NET NO UI | Cwe-269 vulnerability in Johnson Controls victor Web on Windows allows capec-233 |