Hunt List
12,830 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-22337 |
9.8 | 0.0032 | NET NO AUTH LOW CX NO UI | Incorrect Privilege Assignment vulnerability in Directorist Directorist Social L | |
|
80
|
CVE-2026-34901 |
9.8 | 0.0032 | NET NO AUTH LOW CX NO UI | Unauthenticated Privilege Escalation in iControlWP <= 5.5.3 versions. | |
|
80
|
CVE-2026-49058 |
9.8 | 0.0032 | NET NO AUTH LOW CX NO UI | Unauthenticated Privilege Escalation in LoginPress Pro <= 6.2.2 versions. | |
|
79
|
CVE-2026-58073 |
9.5 | 0.0032 | NET NO AUTH LOW CX NO UI | A vulnerability in Veeam Service Provider Console allowing an unauthenticated at | |
|
79
|
CVE-2026-33698 |
9.3 | 0.0032 | NET NO AUTH LOW CX NO UI | Chamilo LMS is a learning management system. Prior to 1.11.38, a chained attack | |
|
78
|
CVE-2026-68587 |
9.2 | 0.0032 | NET NO AUTH LOW CX NO UI | SiYuan versions before v3.7.3 contain an information disclosure vulnerability in | |
|
77
|
CVE-2026-56226 |
8.7 | 0.0032 | NET NO AUTH LOW CX NO UI | Capgo (Cap-go/capgo) before 12.128.2 exposes the Supabase PostgREST RPC function | |
|
77
|
CVE-2026-55195 |
8.7 | 0.0032 | NET NO AUTH LOW CX NO UI | py7zr is a Python-based library and utility to support 7zip archive compression, | |
|
77
|
CVE-2026-116179 |
8.7 | 0.0032 | NET NO AUTH LOW CX NO UI | vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that | |
|
77
|
CVE-2026-105212 |
8.7 | 0.0032 | NET NO AUTH LOW CX NO UI | ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypas | |
|
76
|
CVE-2026-34747 |
8.2 | 0.0032 | NET NO AUTH LOW CX NO UI | Payload is a free and open source headless content management system. Prior to v | |
|
76
|
CVE-2026-14336 |
8.2 | 0.0032 | NET NO AUTH LOW CX NO UI | PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check ( | |
|
76
|
CVE-2026-57768 |
8.2 | 0.0032 | NET NO AUTH LOW CX NO UI | Incorrect Privilege Assignment vulnerability in favethemes Houzez Login Register | |
|
76
|
CVE-2026-83398 |
8.2 | 0.0032 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware | |
|
76
|
CVE-2026-91358 |
8.2 | 0.0032 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Business Process Management Suite product of Oracle | |
|
75
|
CVE-2026-44764 |
7.3 | 0.0032 | NET NO AUTH LOW CX NO UI | Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integrat | |
|
75
|
CVE-2026-43873 |
7.5 | 0.0032 | NET NO AUTH LOW CX NO UI | WWBN AVideo is an open source video platform. In versions up to and including 29 | |
|
75
|
CVE-2025-61164 |
7.5 | 0.0032 | NET NO AUTH LOW CX NO UI | Cohere North AI v1.1.5 was discovered to contain an information leak via the Web | |
|
75
|
CVE-2026-103410 |
7.5 | 0.0032 | NET NO AUTH LOW CX NO UI | An Integer Overflow vulnerability in the DPI certificate scanner in Juniper Netw | |
|
75
|
CVE-2026-108762 |
7.3 | 0.0032 | NET NO AUTH LOW CX NO UI | Path-confinement bypass during metadata backup deletion in Apache Kylin. Impact | |
|
69
|
CVE-2026-23818 |
9.6 | 0.0032 | NET NO AUTH LOW CX | A vulnerability has been identified in the graphical user interface (GUI) of HPE | |
|
68
|
CVE-2026-115324 |
9.2 | 0.0032 | NET NO AUTH NO UI | mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector | |
|
68
|
CVE-2026-46989 |
9.1 | 0.0032 | NET LOW CX NO UI | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle E | |
|
68
|
CVE-2025-56798 |
8.8 | 0.0032 | NET NO AUTH LOW CX | Cross-Site Request Forgery (CSRF) vulnerability in Lime Technology, Inc.'s Unrai | |
|
67
|
CVE-2026-87901 |
8.3 | 0.0032 | NET NO AUTH LOW CX | Improper sanitization in the registration module allows reflected Cross-Site Scr | |
|
66
|
CVE-2026-94268 |
8.1 | 0.0032 | NET NO AUTH NO UI | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced C | |
|
66
|
CVE-2026-94380 |
8.1 | 0.0032 | NET NO AUTH LOW CX | Weak Password Recovery Mechanism for Forgotten Password vulnerability in HAVELSA | |
|
65
|
CVE-2026-55759 |
7.4 | 0.0032 | NET NO AUTH NO UI | Rocket.Chat is an open-source, secure, fully customizable communications platfor | |
|
65
|
CVE-2026-54833 |
7.4 | 0.0032 | NET NO AUTH NO UI | Unauthenticated Backdoor in Enable CORS <= 2.0.3 versions. | |
|
65
|
CVE-2026-91623 |
7.4 | 0.0032 | NET NO AUTH NO UI | Vulnerability in the Oracle Agile Product Lifecycle Management for Process produ | |
|
65
|
CVE-2026-60584 |
7.6 | 0.0032 | NET LOW CX NO UI | Vulnerability in the Oracle Transportation Management product of Oracle Supply C | |
|
65
|
CVE-2026-61208 |
7.6 | 0.0032 | NET LOW CX NO UI | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware | |
|
65
|
CVE-2026-70764 |
7.6 | 0.0032 | NET LOW CX NO UI | Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (c | |
|
65
|
CVE-2026-71048 |
7.6 | 0.0032 | NET LOW CX NO UI | Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply | |
|
65
|
CVE-2026-34076 |
7.4 | 0.0032 | NET NO AUTH NO UI | Clerk JavaScript is the official JavaScript repository for Clerk authentication. | |
|
64
|
CVE-2026-71276 |
7.1 | 0.0032 | NET LOW CX NO UI | Magistrala (formerly Mainflux)'s message-readers API reads a value from the HTTP | |
|
64
|
CVE-2026-115478 |
7.1 | 0.0032 | NET LOW CX NO UI | obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidia | |
|
64
|
CVE-2026-61124 |
7.1 | 0.0032 | NET NO AUTH LOW CX | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware | |
|
64
|
CVE-2026-62458 |
7.1 | 0.0032 | NET LOW CX NO UI | Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite ( | |
|
64
|
CVE-2026-109351 |
7.1 | 0.0032 | NET NO AUTH LOW CX | Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulne | |
|
64
|
CVE-2026-1078 |
7.2 | 0.0032 | NET NO AUTH LOW CX | An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pe | |
|
64
|
CVE-2026-114648 |
7.2 | 0.0032 | NET LOW CX NO UI | The MongoDB C# Driver does not neutralize dot and dollar characters in dictionar | |
|
64
|
CVE-2026-57405 |
7.1 | 0.0032 | NET LOW CX NO UI | Missing Authorization vulnerability in themehunk Open Shop open-shop allows Expl | |
|
64
|
CVE-2026-57740 |
7.1 | 0.0032 | NET LOW CX NO UI | Missing Authorization vulnerability in AcyMailing Newsletter Team AcyMailing SMT | |
|
64
|
CVE-2026-66470 |
7.1 | 0.0032 | NET LOW CX NO UI | Subscriber Broken Access Control in Frontend Admin by DynamiApps <= 3.29.10 vers | |
|
57
|
CVE-2026-101648 |
8.4 | 0.0032 | NET NO UI | Vulnerability in the Oracle Partner Management product of Oracle E-Business Suit | |
|
57
|
CVE-2026-45369 |
8.3 | 0.0032 | NET NO AUTH | python-utcp is the python implementation of UTCP. Prior to 1.1.3, the _substitut | |
|
57
|
CVE-2026-101431 |
8.7 | 0.0032 | NET LOW CX | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS | |
|
55
|
CVE-2026-116243 |
7.5 | 0.0032 | NET NO UI | pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a u | |
|
54
|
CVE-2026-28740 |
7.1 | 0.0032 | NET NO UI | Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authoriz |