Hunt List
12,825 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2025-67108 |
10.0 | 0.0031 | NET NO AUTH LOW CX NO UI | eProsima Fast-DDS v3.3 was discovered to contain improper validation for ticket | |
|
80
|
CVE-2026-39305 |
10.0 | 0.0031 | NET NO AUTH LOW CX NO UI | PraisonAI is a multi-agent teams system. Prior to 1.5.113, the Action Orchestrat | |
|
80
|
CVE-2026-52704 |
10.0 | 0.0031 | NET NO AUTH LOW CX NO UI | Improper Control of Generation of Code ('Code Injection') vulnerability in Edgar | |
|
78
|
CVE-2026-42994 |
8.8 | 0.0031 | NET NO AUTH LOW CX NO UI | Bitwarden CLI 2026.4.0 from 2026-04-22T21:57Z to 2026-04-22T23:30Z, when obtaine | |
|
78
|
CVE-2026-72793 |
9.2 | 0.0031 | NET NO AUTH LOW CX NO UI | SiYuan versions before v3.7.4 fail to mask sensitive configuration fields in the | |
|
78
|
CVE-2026-72795 |
9.2 | 0.0031 | NET NO AUTH LOW CX NO UI | SiYuan versions before v3.7.4 fail to filter embedded block content by publish a | |
|
78
|
CVE-2026-73608 |
9.2 | 0.0031 | NET NO AUTH LOW CX NO UI | SiYuan's development branch (endpoint introduced by commit 9b8e8956f, not presen | |
|
78
|
CVE-2026-40313 |
9.1 | 0.0031 | NET NO AUTH LOW CX NO UI | PraisonAI is a multi-agent teams system. In versions 4.5.139 and below, the GitH | |
|
77
|
CVE-2026-72801 |
8.7 | 0.0031 | NET NO AUTH LOW CX NO UI | SiYuan versions before v3.7.4 disclose encrypted-notebook key-derivation materia | |
|
75
|
CVE-2026-62551 |
7.3 | 0.0031 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle | |
|
75
|
CVE-2026-73891 |
7.3 | 0.0031 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
75
|
CVE-2026-73894 |
7.3 | 0.0031 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
75
|
CVE-2026-73918 |
7.3 | 0.0031 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
75
|
CVE-2026-73933 |
7.3 | 0.0031 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
75
|
CVE-2026-28924 |
7.5 | 0.0031 | NET NO AUTH LOW CX NO UI | A race condition was addressed with improved handling of symbolic links. This is | |
|
75
|
CVE-2026-13184 |
7.5 | 0.0031 | NET NO AUTH LOW CX NO UI | In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.Conf | |
|
74
|
CVE-2026-110662 |
7.2 | 0.0031 | NET NO AUTH LOW CX NO UI | The MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress | |
|
74
|
CVE-2026-57210 |
7.0 | 0.0031 | NET NO AUTH LOW CX NO UI | Heimdall is a cloud native Identity Aware Proxy and Access Control Decision serv | |
|
69
|
CVE-2026-13853 |
9.6 | 0.0031 | NET NO AUTH LOW CX | Use after free in Journeys in Google Chrome prior to 150.0.7871.47 allowed a rem | |
|
69
|
CVE-2026-13854 |
9.6 | 0.0031 | NET NO AUTH LOW CX | Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allowed | |
|
69
|
CVE-2026-13861 |
9.6 | 0.0031 | NET NO AUTH LOW CX | Use after free in Core in Google Chrome prior to 150.0.7871.47 allowed a remote | |
|
69
|
CVE-2026-13878 |
9.6 | 0.0031 | NET NO AUTH LOW CX | Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allow | |
|
69
|
CVE-2026-13880 |
9.6 | 0.0031 | NET NO AUTH LOW CX | Use after free in USB in Google Chrome on Mac prior to 150.0.7871.47 allowed a r | |
|
69
|
CVE-2026-14113 |
9.6 | 0.0031 | NET NO AUTH LOW CX | Use after free in Updater in Google Chrome on Windows prior to 150.0.7871.47 all | |
|
68
|
CVE-2025-13020 |
8.8 | 0.0031 | NET NO AUTH LOW CX | Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixe | |
|
68
|
CVE-2026-8540 |
8.8 | 0.0031 | NET NO AUTH LOW CX | Type Confusion in V8 in Google Chrome prior to 148.0.7778.168 allowed a remote a | |
|
68
|
CVE-2025-57739 |
8.8 | 0.0031 | NET LOW CX NO UI | An improper neutralization of special elements used in an SQL Command ("SQL Inje | |
|
68
|
CVE-2026-75891 |
8.8 | 0.0031 | NET LOW CX NO UI | The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Obj | |
|
67
|
CVE-2026-45800 |
8.7 | 0.0031 | NET LOW CX NO UI | Vvveb is a powerful and easy to use CMS with page builder to build websites, blo | |
|
67
|
CVE-2026-119144 |
8.7 | 0.0031 | NET LOW CX NO UI | Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side | |
|
67
|
CVE-2026-63152 |
8.6 | 0.0031 | NET LOW CX NO UI | Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vul | |
|
67
|
CVE-2026-63165 |
8.6 | 0.0031 | NET LOW CX NO UI | Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in | |
|
67
|
CVE-2026-112837 |
8.5 | 0.0031 | NET LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
67
|
CVE-2026-39736 |
8.5 | 0.0031 | NET LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
66
|
CVE-2026-48788 |
8.2 | 0.0031 | NET NO AUTH LOW CX | Remark42 is a self-hosted comment engine for blogs, articles, or any other place | |
|
66
|
CVE-2026-42084 |
8.1 | 0.0031 | NET LOW CX NO UI | OpenC3 COSMOS provides the functionality needed to send commands to and receive | |
|
66
|
CVE-2026-45013 |
8.1 | 0.0031 | NET NO AUTH LOW CX | ApostropheCMS is an open-source Node.js content management system. Versions up t | |
|
65
|
CVE-2026-41419 |
7.6 | 0.0031 | NET LOW CX NO UI | 4ga Boards is a boards system for realtime project management. Prior to 3.3.5, a | |
|
65
|
CVE-2026-60641 |
7.6 | 0.0031 | NET NO AUTH LOW CX | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
64
|
CVE-2026-40788 |
7.1 | 0.0031 | NET LOW CX NO UI | Subscriber Broken Access Control in ChatBot <= 7.9.7 versions. | |
|
64
|
CVE-2026-109294 |
7.1 | 0.0031 | NET LOW CX NO UI | Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumpti | |
|
64
|
CVE-2026-114067 |
7.1 | 0.0031 | NET LOW CX NO UI | Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability | |
|
64
|
CVE-2026-9081 |
7.1 | 0.0031 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 contains a Serve | |
|
64
|
CVE-2026-112278 |
7.1 | 0.0031 | NET NO AUTH LOW CX | rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in proce | |
|
62
|
CVE-2026-54222 |
8.6 | 0.0031 | NET LOW CX NO UI | UBB.threads is vulnerable to Blind SQL Injection, allowing attackers with access | |
|
58
|
CVE-2026-71539 |
8.9 | 0.0031 | NET NO UI | n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, a | |
|
57
|
CVE-2026-55596 |
8.7 | 0.0031 | NET LOW CX | Plate is a rich-text editor with AI and shadcn/ui. From 53.0.0 until 53.1.4, the | |
|
57
|
CVE-2026-35258 |
8.7 | 0.0031 | NET LOW CX | Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (compon | |
|
57
|
CVE-2026-11401 |
8.6 | 0.0031 | NET LOW CX | An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced G | |
|
57
|
CVE-2026-118242 |
8.5 | 0.0031 | NET LOW CX | Highcharts JS is a JavaScript charting library based on SVG. From 2.3.0 until 3. |