Hunt List
8,520 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2024-44065 |
9.8 | 0.0038 | NET NO AUTH LOW CX NO UI | Time-based blind SQL Injection vulnerability in Cloudlog v2.6.15 at the endpoint | |
|
80
|
CVE-2026-33608 |
9.8 | 0.0038 | NET NO AUTH LOW CX NO UI | An attacker can send a notify request that causes a new secondary domain to be a | |
|
80
|
CVE-2026-49106 |
9.8 | 0.0038 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Const | |
|
80
|
CVE-2026-49109 |
9.8 | 0.0038 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Integration for Salesforce and Contact F | |
|
80
|
CVE-2026-49763 |
9.8 | 0.0038 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Integration for Contact Form 7 HubSpot < | |
|
80
|
CVE-2026-49765 |
9.8 | 0.0038 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Fo | |
|
79
|
CVE-2026-47708 |
9.3 | 0.0038 | NET NO AUTH LOW CX NO UI | MCP-for-Stata is an MCP server for Stata to integrate Stata into an agent. Prior | |
|
78
|
CVE-2026-52723 |
9.1 | 0.0038 | NET NO AUTH LOW CX NO UI | ePA 3.x Integration implements the authorization workflow and writes Medical Inf | |
|
78
|
CVE-2026-55888 |
8.8 | 0.0038 | NET NO AUTH LOW CX NO UI | XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, mal | |
|
77
|
CVE-2026-61458 |
8.7 | 0.0038 | NET NO AUTH LOW CX NO UI | PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/ | |
|
77
|
CVE-2026-42047 |
8.6 | 0.0038 | NET NO AUTH LOW CX NO UI | Inngest is a platform for running event-driven and scheduled background function | |
|
76
|
CVE-2026-35274 |
8.2 | 0.0038 | NET NO AUTH LOW CX NO UI | Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle Peop | |
|
76
|
CVE-2026-46485 |
8.2 | 0.0038 | NET NO AUTH LOW CX NO UI | Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments u | |
|
75
|
CVE-2026-34376 |
7.5 | 0.0038 | NET NO AUTH LOW CX NO UI | PdfDing is a selfhosted PDF manager, viewer and editor offering a seamless user | |
|
75
|
CVE-2025-28343 |
7.5 | 0.0038 | NET NO AUTH LOW CX NO UI | striso-control-firmware 54c9722 is vulnerable to Buffer Overflow in function Thr | |
|
75
|
CVE-2025-61498 |
7.5 | 0.0038 | NET NO AUTH LOW CX NO UI | A buffer overflow in the UPnP service of Tenda AC8 Hardware v03.03.10.01 allows | |
|
75
|
CVE-2026-50870 |
7.5 | 0.0038 | NET NO AUTH LOW CX NO UI | An information disclosure vulnerability in the configuration endpoint of Ben Bus | |
|
69
|
CVE-2026-19157 |
9.6 | 0.0038 | NET NO AUTH LOW CX | Out of bounds write in ANGLE in Google Chrome on Android prior to 151.0.7922.109 | |
|
69
|
CVE-2026-11708 |
9.3 | 0.0038 | NET NO AUTH LOW CX | IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site script | |
|
69
|
CVE-2026-11712 |
9.3 | 0.0038 | NET NO AUTH LOW CX | IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site script | |
|
69
|
CVE-2026-11707 |
9.3 | 0.0038 | NET NO AUTH LOW CX | IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Applicati | |
|
69
|
CVE-2026-60220 |
9.3 | 0.0038 | NET NO AUTH LOW CX | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (compo | |
|
69
|
CVE-2026-60632 |
9.3 | 0.0038 | NET NO AUTH LOW CX | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
69
|
CVE-2026-71037 |
9.3 | 0.0038 | NET NO AUTH LOW CX | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
68
|
CVE-2026-20267 |
9.0 | 0.0038 | NET NO AUTH NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
68
|
CVE-2026-7951 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Out of bounds write in WebRTC in Google Chrome prior to 148.0.7778.96 allowed a | |
|
68
|
CVE-2026-8524 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Out of bounds write in WebAudio in Google Chrome prior to 148.0.7778.168 allowed | |
|
68
|
CVE-2026-8526 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Out of bounds write in WebRTC in Google Chrome prior to 148.0.7778.168 allowed a | |
|
68
|
CVE-2026-13031 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Use after free in Blink in Google Chrome prior to 149.0.7827.197 allowed a remot | |
|
68
|
CVE-2026-13033 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Out of bounds read and write in Blink>InterestGroups in Google Chrome prior to 1 | |
|
68
|
CVE-2026-13036 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Use after free in Blink in Google Chrome prior to 149.0.7827.197 allowed a remot | |
|
68
|
CVE-2026-13038 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Use after free in Autofill in Google Chrome on Windows prior to 149.0.7827.197 a | |
|
68
|
CVE-2026-13805 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Use after free in GFX in Google Chrome on Mac prior to 150.0.7871.47 allowed a r | |
|
68
|
CVE-2026-13811 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Use after free in IME in Google Chrome prior to 150.0.7871.47 allowed a remote a | |
|
68
|
CVE-2026-13821 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Use after free in Canvas in Google Chrome prior to 150.0.7871.47 allowed a remot | |
|
68
|
CVE-2026-13845 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Use after free in DOM in Google Chrome prior to 150.0.7871.47 allowed a remote a | |
|
68
|
CVE-2026-13848 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Use after free in Forms in Google Chrome prior to 150.0.7871.47 allowed a remote | |
|
68
|
CVE-2026-13888 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Use after free in Extensions in Google Chrome prior to 150.0.7871.47 allowed a r | |
|
68
|
CVE-2026-14091 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Use after free in DevTools in Google Chrome prior to 150.0.7871.47 allowed a rem | |
|
68
|
CVE-2026-14107 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Use after free in Scheduling in Google Chrome prior to 150.0.7871.47 allowed a r | |
|
66
|
CVE-2026-14111 |
8.1 | 0.0038 | NET NO AUTH NO UI | Use after free in WebProtect in Google Chrome prior to 150.0.7871.47 allowed an | |
|
66
|
CVE-2026-60700 |
8.1 | 0.0038 | NET NO AUTH LOW CX | Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Su | |
|
66
|
CVE-2026-61281 |
8.1 | 0.0038 | NET NO AUTH LOW CX | Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyper | |
|
66
|
CVE-2026-62591 |
8.1 | 0.0038 | NET NO AUTH LOW CX | Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (compon | |
|
66
|
CVE-2026-70746 |
8.1 | 0.0038 | NET NO AUTH LOW CX | Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyper | |
|
66
|
CVE-2026-70901 |
8.1 | 0.0038 | NET NO AUTH LOW CX | Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora | |
|
65
|
CVE-2026-60820 |
7.4 | 0.0038 | NET NO AUTH NO UI | Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (compon | |
|
64
|
CVE-2026-96644 |
7.1 | 0.0038 | NET NO AUTH LOW CX | Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImage | |
|
56
|
CVE-2026-13410 |
8.2 | 0.0038 | NET NO AUTH | Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification | |
|
55
|
CVE-2026-10545 |
7.5 | 0.0038 | NET NO AUTH | IBM Planning Analytics Local 2.1.0 through 2.1.21 is vulnerable to an open redir |