Hunt List
12,788 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-16349 |
9.8 | 0.0030 | NET NO AUTH LOW CX NO UI | Same-origin policy bypass in the DOM: Navigation component. This vulnerability w | |
|
80
|
CVE-2026-29200 |
9.9 | 0.0030 | NET NO AUTH LOW CX NO UI | A critical IDOR vulnerability has been discovered in Comet Backup affecting all | |
|
79
|
CVE-2026-75832 |
9.3 | 0.0030 | NET NO AUTH LOW CX NO UI | The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before vers | |
|
79
|
CVE-2026-39530 |
9.3 | 0.0030 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in SpeakOut! Email Petitions <= 4.6.5 versions. | |
|
78
|
CVE-2026-44196 |
9.1 | 0.0030 | NET NO AUTH LOW CX NO UI | Pingvin Share X is a secure and easy self-hosted file sharing platform. From 1.1 | |
|
78
|
CVE-2026-47702 |
9.1 | 0.0030 | NET NO AUTH LOW CX NO UI | TypeBot is a chatbot builder tool. In version 3.16.1, API tokens (bearer credent | |
|
78
|
CVE-2024-34324 |
9.1 | 0.0030 | NET NO AUTH LOW CX NO UI | An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a se | |
|
78
|
CVE-2026-18353 |
8.8 | 0.0030 | NET NO AUTH LOW CX NO UI | PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its **unve | |
|
78
|
CVE-2026-111804 |
8.8 | 0.0030 | NET NO AUTH LOW CX NO UI | Apache Traffic Server's experimental wasm plugin has a use-after-free in its tra | |
|
78
|
CVE-2026-48242 |
9.2 | 0.0030 | NET NO AUTH LOW CX NO UI | Open ISES Tickets before 3.44.2 contains hardcoded MySQL database connection cre | |
|
78
|
CVE-2026-30803 |
8.8 | 0.0030 | NET NO AUTH LOW CX NO UI | Integer Underflow (Wrap or Wraparound) vulnerability in RTI Connext Micro (Core | |
|
77
|
CVE-2026-114597 |
8.7 | 0.0030 | NET NO AUTH LOW CX NO UI | In EPICS Base release 7.0.10 and prior, an insufficient validation of element or | |
|
77
|
CVE-2026-114598 |
8.7 | 0.0030 | NET NO AUTH LOW CX NO UI | In EPICS Base release 7.0.10 and prior, an insufficient validation of element or | |
|
76
|
CVE-2026-63573 |
8.2 | 0.0030 | NET NO AUTH LOW CX NO UI | Observable discrepancy in the CMS RSA PKCS#1 v1.5 key-transport unwrap (KeyTrans | |
|
76
|
CVE-2026-11848 |
7.9 | 0.0030 | NET NO AUTH LOW CX NO UI | The iRM-IEI Remote Management developed by IEI Integration Corp has a Missing Au | |
|
75
|
CVE-2025-65877 |
7.5 | 0.0030 | NET NO AUTH LOW CX NO UI | Lvzhou CMS before commit c4ea0eb9cab5f6739b2c87e77d9ef304017ed615 (2025-09-22) i | |
|
75
|
CVE-2026-57921 |
7.5 | 0.0030 | NET NO AUTH LOW CX NO UI | In JetBrains YouTrack before 2026.2.16593 improper access control allowed readin | |
|
75
|
CVE-2026-92546 |
7.5 | 0.0030 | NET NO AUTH LOW CX NO UI | Authentication bypass by spoofing vulnerability in Keepnet Labs Cybersecurity In | |
|
75
|
CVE-2026-33266 |
7.5 | 0.0030 | NET NO AUTH LOW CX NO UI | Use of Hard-coded Cryptographic Key vulnerability in Apache OpenMeetings. The r | |
|
69
|
CVE-2026-53662 |
9.6 | 0.0030 | NET NO AUTH LOW CX | immich is a high performance self-hosted photo and video management solution. Fr | |
|
69
|
CVE-2026-34989 |
9.4 | 0.0030 | NET LOW CX NO UI | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo | |
|
68
|
CVE-2026-35610 |
8.8 | 0.0030 | NET LOW CX NO UI | PolarLearn is a free and open-source learning program. In 0-PRERELEASE-14 and ea | |
|
68
|
CVE-2026-43215 |
8.8 | 0.0030 | NET NO AUTH LOW CX | In the Linux kernel, the following vulnerability has been resolved: cifs: Fix l | |
|
68
|
CVE-2026-70432 |
8.8 | 0.0030 | NET LOW CX NO UI | A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 669 | |
|
67
|
CVE-2026-115330 |
8.7 | 0.0030 | NET LOW CX NO UI | Lotus through 0.10.2 contains an sql injection vulnerability that allows authent | |
|
66
|
CVE-2026-49825 |
8.2 | 0.0030 | NET NO AUTH LOW CX | lxml is a library for processing XML and HTML in the Python language. Prior to 6 | |
|
65
|
CVE-2026-112344 |
7.6 | 0.0030 | NET LOW CX NO UI | Syncplify Server! 6.0.0 before 8.8.0 contains a path traversal vulnerability tha | |
|
65
|
CVE-2026-114616 |
7.4 | 0.0030 | NET NO AUTH NO UI | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior | |
|
65
|
CVE-2026-48743 |
7.5 | 0.0030 | NET NO AUTH NO UI | Envoy is an open source edge and service proxy designed for cloud-native applica | |
|
65
|
CVE-2026-101387 |
7.6 | 0.0030 | NET LOW CX NO UI | Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (compone | |
|
65
|
CVE-2026-101833 |
7.6 | 0.0030 | NET LOW CX NO UI | Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suit | |
|
64
|
CVE-2026-70808 |
7.1 | 0.0030 | NET LOW CX NO UI | Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (compon | |
|
64
|
CVE-2026-70816 |
7.1 | 0.0030 | NET LOW CX NO UI | Vulnerability in the Oracle Financials for EMEA product of Oracle E-Business Sui | |
|
64
|
CVE-2026-70833 |
7.1 | 0.0030 | NET LOW CX NO UI | Vulnerability in the Oracle Landed Cost Management product of Oracle E-Business | |
|
64
|
CVE-2026-70839 |
7.1 | 0.0030 | NET LOW CX NO UI | Vulnerability in the Oracle Financials for EMEA product of Oracle E-Business Sui | |
|
64
|
CVE-2026-70844 |
7.1 | 0.0030 | NET LOW CX NO UI | Vulnerability in the Oracle Loans product of Oracle E-Business Suite (component: | |
|
64
|
CVE-2026-70971 |
7.1 | 0.0030 | NET LOW CX NO UI | Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle | |
|
64
|
CVE-2026-61449 |
7.1 | 0.0030 | NET NO AUTH LOW CX | Grav 2.0.1 contains a decompression-bomb size-cap bypass in ZipArchiver and GPM\ | |
|
64
|
CVE-2026-101450 |
7.1 | 0.0030 | NET NO AUTH LOW CX | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS | |
|
64
|
CVE-2026-114391 |
7.1 | 0.0030 | NET LOW CX NO UI | ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonM | |
|
64
|
CVE-2026-114652 |
7.1 | 0.0030 | NET LOW CX NO UI | A data-query-logic neutralization weakness in the update-statement construction | |
|
64
|
CVE-2026-56256 |
7.1 | 0.0030 | NET LOW CX NO UI | Capgo before 12.128.2 enforces mandatory two-factor authentication only at the U | |
|
64
|
CVE-2026-9130 |
7.1 | 0.0030 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerabil | |
|
57
|
CVE-2026-60677 |
8.4 | 0.0030 | NET NO UI | Vulnerability in the Oracle Common Application Components product of Oracle E-Bu | |
|
57
|
CVE-2026-12437 |
8.3 | 0.0030 | NET NO AUTH | Use after free in WebShare in Google Chrome on Windows prior to 149.0.7827.155 a | |
|
57
|
CVE-2026-35569 |
8.7 | 0.0030 | NET LOW CX | ApostropheCMS is an open-source Node.js content management system. Versions 4.28 | |
|
54
|
CVE-2026-60623 |
7.1 | 0.0030 | NET NO UI | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connec | |
|
54
|
CVE-2026-60693 |
7.1 | 0.0030 | NET NO UI | Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (c | |
|
54
|
CVE-2026-70809 |
7.1 | 0.0030 | NET NO UI | Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (compon | |
|
40
|
CVE-2026-22011 |
7.6 | 0.0030 | NET | Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite |