Hunt List
8,520 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-15966 |
9.8 | 0.0037 | NET NO AUTH LOW CX NO UI | Permissive cross-domain security policy with untrusted domains vulnerability in | |
|
80
|
CVE-2026-15967 |
9.8 | 0.0037 | NET NO AUTH LOW CX NO UI | Insufficient session expiration vulnerability in Progress MOVEit Transfer. This | |
|
80
|
CVE-2026-89111 |
10.0 | 0.0037 | NET NO AUTH LOW CX NO UI | The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting mul | |
|
79
|
CVE-2026-67426 |
9.3 | 0.0037 | NET NO AUTH LOW CX NO UI | Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior | |
|
79
|
CVE-2026-3893 |
9.4 | 0.0037 | NET NO AUTH LOW CX NO UI | The Carlson VASCO-B GNSS Receiver lacks an authentication mechanism, allowing a | |
|
79
|
CVE-2026-40042 |
9.3 | 0.0037 | NET NO AUTH LOW CX NO UI | Pachno 1.0.6 contains an XML external entity injection vulnerability that allows | |
|
79
|
CVE-2026-58122 |
9.3 | 0.0037 | NET NO AUTH LOW CX NO UI | Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability tha | |
|
79
|
CVE-2026-22340 |
9.3 | 0.0037 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in WPJobster <= 6.3.5 versions. | |
|
79
|
CVE-2026-39438 |
9.3 | 0.0037 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in ListingPro <= 2.9.10 versions. | |
|
79
|
CVE-2026-39596 |
9.3 | 0.0037 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in Blocksy Companion Pro < 2.1.29 versions. | |
|
78
|
CVE-2026-111663 |
9.2 | 0.0037 | NET NO AUTH LOW CX NO UI | Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that | |
|
77
|
CVE-2026-56677 |
8.6 | 0.0037 | NET NO AUTH LOW CX NO UI | 9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/ | |
|
77
|
CVE-2026-75596 |
8.7 | 0.0037 | NET NO AUTH LOW CX NO UI | Netty is an asynchronous, event-driven network application framework. Prior to 4 | |
|
76
|
CVE-2026-14504 |
8.2 | 0.0037 | NET NO AUTH LOW CX NO UI | An authorization bypass in Nexus Repository 3's component upload API allowed a u | |
|
76
|
CVE-2026-101690 |
8.2 | 0.0037 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of O | |
|
75
|
CVE-2026-40046 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ | |
|
75
|
CVE-2026-116656 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Tanium addressed an uncontrolled resource consumption vulnerability in Enforce. | |
|
75
|
CVE-2026-116662 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Tanium addressed a compression bomb vulnerability in Enforce. | |
|
75
|
CVE-2026-87086 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Tanium addressed a denial of service vulnerability in Provision. | |
|
75
|
CVE-2026-118036 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027 | |
|
75
|
CVE-2026-12305 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Fire | |
|
75
|
CVE-2026-59765 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files a | |
|
75
|
CVE-2026-61739 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | SOCFortress CoPilot focuses on providing a single pane of glass for all your sec | |
|
75
|
CVE-2025-60549 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the | |
|
75
|
CVE-2025-60550 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the | |
|
75
|
CVE-2025-60552 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the | |
|
75
|
CVE-2026-16373 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Information disclosure in the Privacy component in Firefox for Android. This vul | |
|
75
|
CVE-2026-60075 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic ba | |
|
75
|
CVE-2026-56834 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4. | |
|
74
|
CVE-2026-96894 |
7.2 | 0.0037 | NET NO AUTH LOW CX NO UI | The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for Wo | |
|
74
|
CVE-2026-0263 |
7.2 | 0.0037 | NET NO AUTH LOW CX NO UI | A buffer overflow vulnerability in the IKEv2 processing of Palo Alto Networks PA | |
|
74
|
CVE-2026-114730 |
7.2 | 0.0037 | NET NO AUTH LOW CX NO UI | Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a s | |
|
69
|
CVE-2026-13798 |
9.6 | 0.0037 | NET NO AUTH LOW CX | Heap buffer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allow | |
|
69
|
CVE-2026-17680 |
9.6 | 0.0037 | NET NO AUTH LOW CX | Heap buffer overflow in Color in Google Chrome on ChromeOS prior to 151.0.7922.7 | |
|
69
|
CVE-2026-17758 |
9.6 | 0.0037 | NET NO AUTH LOW CX | Heap buffer overflow in Dawn in Google Chrome prior to 151.0.7922.72 allowed a r | |
|
69
|
CVE-2026-43900 |
9.3 | 0.0037 | NET NO AUTH LOW CX | DeepChat is an open-source artificial intelligence agent platform that unifies m | |
|
68
|
CVE-2026-35320 |
9.0 | 0.0037 | NET NO AUTH NO UI | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
68
|
CVE-2026-14087 |
8.8 | 0.0037 | NET NO AUTH LOW CX | Heap buffer overflow in WebNN in Google Chrome on Windows prior to 150.0.7871.47 | |
|
68
|
CVE-2026-17951 |
8.8 | 0.0037 | NET NO AUTH LOW CX | Heap buffer overflow in WebRTC in Google Chrome prior to 151.0.7922.72 allowed a | |
|
68
|
CVE-2026-113118 |
8.8 | 0.0037 | NET NO AUTH LOW CX | Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed | |
|
66
|
CVE-2026-35279 |
8.1 | 0.0037 | NET NO AUTH NO UI | Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle Peop | |
|
66
|
CVE-2026-46927 |
8.1 | 0.0037 | NET NO AUTH NO UI | Vulnerability in the Oracle Receivables product of Oracle E-Business Suite (comp | |
|
66
|
CVE-2026-27543 |
8.1 | 0.0037 | NET NO AUTH NO UI | Unauthenticated Privilege Escalation in MStore API <= 4.20.0 versions. | |
|
65
|
CVE-2026-47026 |
7.4 | 0.0037 | NET NO AUTH LOW CX | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS | |
|
64
|
CVE-2026-47118 |
7.1 | 0.0037 | NET NO AUTH LOW CX | Agent Zero before version 1.15 contains a path traversal vulnerability that allo | |
|
64
|
CVE-2026-115572 |
7.1 | 0.0037 | NET NO AUTH LOW CX | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an att | |
|
64
|
CVE-2026-47214 |
7.1 | 0.0037 | NET NO AUTH LOW CX | Docling simplifies document processing by parsing diverse formats and providing | |
|
64
|
CVE-2026-96637 |
7.1 | 0.0037 | NET NO AUTH LOW CX | Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in s | |
|
64
|
CVE-2026-96643 |
7.1 | 0.0037 | NET NO AUTH LOW CX | Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load() in src | |
|
57
|
CVE-2026-49471 |
8.3 | 0.0037 | NET NO AUTH | Serena is a powerful MCP toolkit for coding that provides semantic retrieval and |