Hunt List
12,782 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-43914 |
9.8 | 0.0029 | NET NO AUTH LOW CX NO UI | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, t | |
|
77
|
CVE-2026-33782 |
8.7 | 0.0029 | NET NO AUTH LOW CX NO UI | A Missing Release of Memory after Effective Lifetime vulnerability in the DHCP d | |
|
77
|
CVE-2026-33893 |
8.7 | 0.0029 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in Teamcenter V2312 (All versions < V2312.00 | |
|
77
|
CVE-2026-47209 |
8.6 | 0.0029 | NET NO AUTH LOW CX NO UI | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the BaseH | |
|
77
|
CVE-2026-91267 |
8.6 | 0.0029 | NET NO AUTH LOW CX NO UI | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards | |
|
77
|
CVE-2026-113387 |
8.6 | 0.0029 | NET NO AUTH LOW CX NO UI | The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration | |
|
76
|
CVE-2026-53801 |
8.2 | 0.0029 | NET NO AUTH LOW CX NO UI | rsync before 3.5.0 contains a symlink race condition vulnerability in the sender | |
|
75
|
CVE-2026-33710 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, RE | |
|
75
|
CVE-2026-6022 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | In Progress® Telerik® UI for AJAX prior to 2026.1.421, RadAsyncUpload contains a | |
|
75
|
CVE-2026-12317 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Fire | |
|
75
|
CVE-2026-40768 |
7.3 | 0.0029 | NET NO AUTH LOW CX NO UI | Unauthenticated Insecure Direct Object References (IDOR) in Salon booking system | |
|
75
|
CVE-2026-91502 |
7.3 | 0.0029 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware | |
|
75
|
CVE-2025-63663 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | Incorrect access control in the /api/v1/conversations/*/files API of GT Edge AI | |
|
75
|
CVE-2024-24844 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | Missing Authorization vulnerability in IdeaBox Creations PowerPack Pro for Eleme | |
|
75
|
CVE-2026-40767 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in wpForo Forum < 3.0.2 versions. | |
|
75
|
CVE-2026-82987 |
7.5 | 0.0029 | NET NO AUTH LOW CX NO UI | There exists a screen capture endpoint in vCast media streaming service in ViewS | |
|
70
|
CVE-2026-91354 |
9.9 | 0.0029 | NET LOW CX NO UI | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl | |
|
70
|
CVE-2026-91224 |
9.9 | 0.0029 | NET LOW CX NO UI | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo | |
|
69
|
CVE-2026-12411 |
9.6 | 0.0029 | NET LOW CX NO UI | Broken Access Control in the devLXDInstancePatchHandler component of Canonical L | |
|
68
|
CVE-2026-111585 |
8.8 | 0.0029 | NET NO AUTH LOW CX | An integer overflow in the remote-control screen processing component of TeamVie | |
|
68
|
CVE-2026-116389 |
8.8 | 0.0029 | NET LOW CX NO UI | Deserialization of Untrusted Data vulnerability in crossi72 Phoenix Media Rename | |
|
68
|
CVE-2026-116866 |
8.8 | 0.0029 | NET LOW CX NO UI | Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 v | |
|
68
|
CVE-2026-12007 |
8.8 | 0.0029 | NET NO AUTH LOW CX | Use after free in Core in Google Chrome on Windows prior to 149.0.7827.115 allow | |
|
68
|
CVE-2026-91268 |
8.8 | 0.0029 | NET LOW CX NO UI | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards | |
|
68
|
CVE-2026-91310 |
8.8 | 0.0029 | NET LOW CX NO UI | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards | |
|
68
|
CVE-2026-91442 |
8.8 | 0.0029 | NET LOW CX NO UI | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone | |
|
68
|
CVE-2026-91521 |
8.8 | 0.0029 | NET LOW CX NO UI | Vulnerability in the Oracle Agile Product Lifecycle Management for Process produ | |
|
68
|
CVE-2026-91535 |
8.8 | 0.0029 | NET LOW CX NO UI | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of | |
|
67
|
CVE-2026-41445 |
8.7 | 0.0029 | NET NO AUTH LOW CX | KissFFT before commit 8a8e66e contains an integer overflow vulnerability in the | |
|
67
|
CVE-2026-46558 |
8.3 | 0.0029 | NET LOW CX NO UI | Plane is an open-source project management tool. Prior to version 1.3.1, there i | |
|
67
|
CVE-2026-65056 |
8.3 | 0.0029 | NET NO AUTH LOW CX | mcp-webresearch 0.1.7 contains a server-side request forgery vulnerability that | |
|
66
|
CVE-2026-40905 |
8.1 | 0.0029 | NET NO AUTH LOW CX | LinkAce is a self-hosted archive to collect website links. Prior to 2.5.4, a pas | |
|
66
|
CVE-2026-13864 |
8.1 | 0.0029 | NET NO AUTH NO UI | Insufficient policy enforcement in WebHID in Google Chrome prior to 150.0.7871.4 | |
|
66
|
CVE-2025-11713 |
8.1 | 0.0029 | NET NO AUTH LOW CX | Insufficient escaping in the “Copy as cURL” feature could have been used to tric | |
|
66
|
CVE-2026-94262 |
8.1 | 0.0029 | NET NO AUTH NO UI | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced C | |
|
66
|
CVE-2026-58205 |
8.1 | 0.0029 | NET NO AUTH LOW CX | GRR is a resource management and reservation application. Prior to version 4.5.0 | |
|
66
|
CVE-2026-85749 |
8.1 | 0.0029 | NET LOW CX NO UI | MailWatch for MailScanner is a web-based front-end to MailScanner. Prior to 1.2. | |
|
65
|
CVE-2026-39546 |
7.6 | 0.0029 | NET LOW CX NO UI | Subscriber Privilege Escalation in MultiLoca <= 4.2.15 versions. | |
|
65
|
CVE-2026-100709 |
7.7 | 0.0029 | NET LOW CX NO UI | Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (p | |
|
65
|
CVE-2026-50091 |
7.4 | 0.0029 | NET NO AUTH NO UI | Aqara Home Android (com.lumiunited.aqarahome) 6.0.0 (and white-label clients emb | |
|
65
|
CVE-2026-61791 |
7.4 | 0.0029 | NET NO AUTH LOW CX | OCO-Server is a self-hosted endpoint management application for computer invento | |
|
64
|
CVE-2026-39977 |
7.1 | 0.0029 | NET NO AUTH LOW CX | flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1. | |
|
64
|
CVE-2026-49338 |
7.1 | 0.0029 | NET LOW CX NO UI | gonic is a music streaming server / free-software subsonic server API implementa | |
|
64
|
CVE-2026-18704 |
7.1 | 0.0029 | NET LOW CX NO UI | An issue in MongoDB Server's aggregation framework could allow an authenticated | |
|
59
|
CVE-2026-42919 |
7.1 | 0.0029 | NET LOW CX NO UI | A vulnerability exists in BIG-IP systems that may allow an authenticated attacke | |
|
57
|
CVE-2026-101824 |
8.7 | 0.0029 | NET LOW CX | Vulnerability in the Document Management and Collaboration product of Oracle E-B | |
|
55
|
CVE-2026-101797 |
7.5 | 0.0029 | NET NO AUTH | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon | |
|
55
|
CVE-2026-42850 |
7.4 | 0.0029 | NET NO AUTH | Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, it is | |
|
54
|
CVE-2026-39976 |
7.1 | 0.0029 | NET NO UI | Laravel Passport provides OAuth2 server support to Laravel. From 13.0.0 to befor | |
|
52
|
CVE-2026-55830 |
8.3 | 0.0029 | NET LOW CX | RestrictedPython is a tool that helps to define a subset of the Python language |