Hunt List
8,520 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-46651 |
9.8 | 0.0038 | NET NO AUTH LOW CX NO UI | The Goobi viewer is a web application that allows digitised material to be displ | |
|
80
|
CVE-2026-61237 |
9.9 | 0.0038 | NET NO AUTH LOW CX NO UI | Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product | |
|
80
|
CVE-2026-62452 |
9.9 | 0.0038 | NET NO AUTH LOW CX NO UI | Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM | |
|
80
|
CVE-2026-34275 |
9.8 | 0.0038 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Advanced Inbound Telephony product of Oracle E-Busin | |
|
80
|
CVE-2026-10534 |
9.8 | 0.0038 | NET NO AUTH LOW CX NO UI | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to buffer | |
|
80
|
CVE-2026-39529 |
9.8 | 0.0037 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Elementra <= 1.0.9 versions. | |
|
80
|
CVE-2026-40725 |
9.8 | 0.0037 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in WooCommerce Product Filters < 2.0.6 vers | |
|
80
|
CVE-2026-49075 |
9.8 | 0.0037 | NET NO AUTH LOW CX NO UI | Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions. | |
|
80
|
CVE-2026-49107 |
9.8 | 0.0037 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions. | |
|
80
|
CVE-2026-54194 |
9.8 | 0.0037 | NET NO AUTH LOW CX NO UI | Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions. | |
|
79
|
CVE-2026-48088 |
9.4 | 0.0038 | NET NO AUTH LOW CX NO UI | OpenReception's appointment booking software provides an end-to-end encrypted ap | |
|
79
|
CVE-2026-61729 |
9.4 | 0.0038 | NET NO AUTH LOW CX NO UI | SOCFortress CoPilot focuses on providing a single pane of glass for all your sec | |
|
79
|
CVE-2026-44666 |
9.3 | 0.0038 | NET NO AUTH LOW CX NO UI | HRConvert2 is a self-hosted, drag-and-drop & nosql file conversion server & shar | |
|
78
|
CVE-2026-58080 |
8.8 | 0.0038 | NET NO AUTH LOW CX NO UI | In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails t | |
|
78
|
CVE-2025-40938 |
9.2 | 0.0038 | NET NO AUTH LOW CX NO UI | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). | |
|
78
|
CVE-2026-40583 |
8.8 | 0.0038 | NET NO AUTH LOW CX NO UI | UltraDAG is a minimal DAG-BFT blockchain in Rust. In version 0.1, a non-council | |
|
78
|
CVE-2026-91403 |
9.1 | 0.0037 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente | |
|
77
|
CVE-2026-56035 |
8.6 | 0.0038 | NET NO AUTH LOW CX NO UI | Unauthenticated Multiple Vulnerabilities in BitFire Security <= 5.0.3 versions. | |
|
77
|
CVE-2026-74906 |
8.7 | 0.0038 | NET NO AUTH LOW CX NO UI | SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight | |
|
77
|
CVE-2026-61033 |
8.6 | 0.0038 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware | |
|
77
|
CVE-2026-61045 |
8.6 | 0.0038 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware | |
|
77
|
CVE-2026-62625 |
8.6 | 0.0038 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middlewar | |
|
77
|
CVE-2026-62636 |
8.6 | 0.0038 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middlewar | |
|
77
|
CVE-2026-87304 |
8.6 | 0.0038 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl | |
|
77
|
CVE-2026-91273 |
8.6 | 0.0038 | NET NO AUTH LOW CX NO UI | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards | |
|
77
|
CVE-2026-70457 |
8.3 | 0.0038 | NET NO AUTH LOW CX NO UI | rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() whe | |
|
77
|
CVE-2026-32847 |
8.7 | 0.0038 | NET NO AUTH LOW CX NO UI | DeepCode through commit c991dc2 contains a path traversal vulnerability in the S | |
|
77
|
CVE-2026-72779 |
8.7 | 0.0038 | NET NO AUTH LOW CX NO UI | Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitra | |
|
77
|
CVE-2026-10848 |
8.6 | 0.0038 | NET NO AUTH LOW CX NO UI | The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in par | |
|
77
|
CVE-2026-92450 |
8.7 | 0.0037 | NET NO AUTH LOW CX NO UI | The authentication framework used by affected Kiloview E3 NDI encoder firmware s | |
|
75
|
CVE-2026-55501 |
7.3 | 0.0038 | NET NO AUTH LOW CX NO UI | 9Router is an AI router & token saver. Prior to 0.4.80, the dashboard login rate | |
|
75
|
CVE-2025-65805 |
7.5 | 0.0038 | NET NO AUTH LOW CX NO UI | OpenAirInterface CN5G AMF<=v2.1.9 has a buffer overflow vulnerability in process | |
|
75
|
CVE-2026-91765 |
7.5 | 0.0038 | NET NO AUTH LOW CX NO UI | cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level wi | |
|
75
|
CVE-2026-101835 |
7.5 | 0.0038 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suit | |
|
75
|
CVE-2026-87296 |
7.5 | 0.0038 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware ( | |
|
75
|
CVE-2026-91447 |
7.5 | 0.0038 | NET NO AUTH LOW CX NO UI | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone | |
|
75
|
CVE-2026-98952 |
7.3 | 0.0038 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: pfcp: make | |
|
75
|
CVE-2026-39480 |
7.5 | 0.0038 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in Backup Migration <= 2.1.1 versions. | |
|
74
|
CVE-2026-109198 |
7.2 | 0.0038 | NET NO AUTH LOW CX NO UI | The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPres | |
|
69
|
CVE-2026-60905 |
9.6 | 0.0038 | NET NO AUTH LOW CX | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
69
|
CVE-2026-14423 |
9.6 | 0.0038 | NET NO AUTH LOW CX | Type Confusion in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote | |
|
68
|
CVE-2026-113085 |
8.8 | 0.0038 | NET NO AUTH LOW CX | Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote | |
|
68
|
CVE-2026-56840 |
8.8 | 0.0037 | NET NO AUTH LOW CX | PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4. | |
|
67
|
CVE-2026-41200 |
8.5 | 0.0038 | NET NO AUTH LOW CX | STIG Manager is an API and web client for managing Security Technical Implement | |
|
66
|
CVE-2026-48725 |
8.1 | 0.0038 | NET NO AUTH LOW CX | Warp is an agentic development environment. From 0.2021.04.25.23.05.stable_00 un | |
|
65
|
CVE-2026-115570 |
7.4 | 0.0038 | NET NO AUTH NO UI | Electron is a framework for writing cross-platform desktop applications using Ja | |
|
64
|
CVE-2026-97024 |
7.1 | 0.0038 | NET NO AUTH LOW CX | A path traversal vulnerability in Flatpak's handling of the files/etc directory | |
|
64
|
CVE-2026-63572 |
7.1 | 0.0038 | NET NO AUTH LOW CX | Allocation of resources without limits in PKCS#12 keystore loading (Pkcs12Store. | |
|
64
|
CVE-2026-63578 |
7.1 | 0.0038 | NET NO AUTH LOW CX | Allocation of resources without limits in password-based private-key decryption | |
|
55
|
CVE-2026-107161 |
7.5 | 0.0038 | NET NO AUTH | A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge( |