Hunt List
8,525 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-11546 |
9.8 | 0.0040 | NET NO AUTH LOW CX NO UI | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected | |
|
80
|
CVE-2026-68426 |
9.8 | 0.0040 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: xfrm: fix s | |
|
80
|
CVE-2026-63377 |
9.8 | 0.0040 | NET NO AUTH LOW CX NO UI | TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators | |
|
80
|
CVE-2026-12341 |
9.8 | 0.0040 | NET NO AUTH LOW CX NO UI | This vulnerability impacts all versions of IdentityIQ and allows an unauthentica | |
|
80
|
CVE-2026-62003 |
9.8 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Mission <= 1.22 versions. | |
|
80
|
CVE-2026-62004 |
9.8 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Motorix <= 1.11 versions. | |
|
80
|
CVE-2026-62005 |
9.8 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions. | |
|
80
|
CVE-2026-62010 |
9.8 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions. | |
|
80
|
CVE-2026-62011 |
9.8 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions. | |
|
80
|
CVE-2026-62015 |
9.8 | 0.0040 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions. | |
|
79
|
CVE-2026-66592 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
78
|
CVE-2026-48144 |
9.1 | 0.0040 | NET NO AUTH LOW CX NO UI | Improper Validation of Certificate with Host Mismatch vulnerability in Apache Th | |
|
78
|
CVE-2026-113867 |
9.1 | 0.0040 | NET NO AUTH LOW CX NO UI | Thunderbird did not escape attribute values when serializing outgoing XMPP stanz | |
|
78
|
CVE-2016-20101 |
9.2 | 0.0040 | NET NO AUTH LOW CX NO UI | Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vuln | |
|
78
|
CVE-2026-64940 |
8.8 | 0.0040 | NET NO AUTH LOW CX NO UI | Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulne | |
|
78
|
CVE-2026-7182 |
9.2 | 0.0040 | NET NO AUTH LOW CX NO UI | Diagram's export module is vulnerable to Path Traversal in src attribute due to | |
|
78
|
CVE-2026-48989 |
8.9 | 0.0040 | NET NO AUTH LOW CX NO UI | Windows-MCP is an open-source project that integrates AI agents with Windows. In | |
|
77
|
CVE-2026-91353 |
8.6 | 0.0040 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl | |
|
77
|
CVE-2026-102558 |
8.6 | 0.0040 | NET NO AUTH LOW CX NO UI | A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), So | |
|
76
|
CVE-2026-61011 |
8.2 | 0.0040 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware | |
|
76
|
CVE-2026-61016 |
8.2 | 0.0040 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware | |
|
76
|
CVE-2026-111064 |
8.2 | 0.0040 | NET NO AUTH LOW CX NO UI | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. | |
|
75
|
CVE-2026-35486 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | text-generation-webui is an open-source web interface for running Large Language | |
|
75
|
CVE-2026-42893 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | Improper neutralization of special elements used in a command ('command injectio | |
|
75
|
CVE-2026-59203 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS par | |
|
75
|
CVE-2026-91325 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards | |
|
75
|
CVE-2026-91448 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone | |
|
75
|
CVE-2026-28944 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | The issue was addressed with improved memory handling. This issue is fixed in Sa | |
|
75
|
CVE-2026-28962 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | This issue was addressed with improved access restrictions. This issue is fixed | |
|
75
|
CVE-2026-8609 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | An unauthenticated attacker can repeatedly call Grafana's OAuth login route with | |
|
75
|
CVE-2026-72754 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | When Routinator encounters a CRL with many entries, it may hang or run out of me | |
|
75
|
CVE-2026-72756 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | Routinator exits when an rsync URI for a file obtained over RRDP contains a path | |
|
75
|
CVE-2026-72758 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | When parsing an AS range in Routinator, if the maximum value of the range is sma | |
|
69
|
CVE-2026-33102 |
9.3 | 0.0040 | NET NO AUTH LOW CX | Url redirection to untrusted site ('open redirect') in M365 Copilot allows an un | |
|
68
|
CVE-2026-5285 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Use after free in WebGL in Google Chrome prior to 146.0.7680.178 allowed a remot | |
|
68
|
CVE-2026-15125 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 a | |
|
68
|
CVE-2026-17751 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Inappropriate implementation in AdFilter in Google Chrome prior to 151.0.7922.72 | |
|
68
|
CVE-2026-17956 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Inappropriate implementation in Scheduling in Google Chrome prior to 151.0.7922. | |
|
68
|
CVE-2026-17969 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.7 | |
|
68
|
CVE-2026-98451 |
8.8 | 0.0040 | NET NO AUTH LOW CX | In the Linux kernel, the following vulnerability has been resolved: smb: client | |
|
68
|
CVE-2026-8509 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Heap buffer overflow in WebML in Google Chrome prior to 148.0.7778.168 allowed a | |
|
67
|
CVE-2026-55738 |
8.7 | 0.0040 | NET NO AUTH LOW CX | A stack-based buffer overflow exists in the raw_to_header function in src/microt | |
|
67
|
CVE-2026-119979 |
8.7 | 0.0040 | NET NO AUTH LOW CX | LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model d | |
|
66
|
CVE-2026-58500 |
8.2 | 0.0040 | NET NO AUTH LOW CX | MCP Appium is an MCP server that provides AI assistants with tools to automate m | |
|
66
|
CVE-2026-13819 |
8.1 | 0.0040 | NET NO AUTH LOW CX | Out of bounds read in ANGLE in Google Chrome on Mac prior to 150.0.7871.47 allow | |
|
66
|
CVE-2026-33437 |
8.1 | 0.0040 | NET NO AUTH LOW CX | Stirling-PDF is a locally hosted web application that facilitates various operat | |
|
66
|
CVE-2026-56670 |
8.2 | 0.0040 | NET NO AUTH LOW CX | ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes int | |
|
66
|
CVE-2026-56672 |
8.2 | 0.0040 | NET NO AUTH LOW CX | ComfyUI is a node-based diffusion model GUI, API, and backend. Prior to 0.28.0, | |
|
64
|
CVE-2026-42212 |
7.1 | 0.0040 | NET NO AUTH LOW CX | SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postproce | |
|
64
|
CVE-2026-54321 |
7.0 | 0.0040 | NET NO AUTH NO UI | Daytona is a secure and elastic infrastructure runtime for AI-generated code exe |