Hunt List
8,520 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-61239 |
9.9 | 0.0037 | NET NO AUTH LOW CX NO UI | Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product | |
|
80
|
CVE-2026-60916 |
9.9 | 0.0037 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusio | |
|
80
|
CVE-2026-73930 |
9.9 | 0.0037 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
79
|
CVE-2026-49076 |
9.3 | 0.0037 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
79
|
CVE-2026-39746 |
9.3 | 0.0037 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
79
|
CVE-2026-32557 |
9.3 | 0.0037 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
79
|
CVE-2026-119597 |
9.3 | 0.0037 | NET NO AUTH LOW CX NO UI | OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability t | |
|
77
|
CVE-2026-26062 |
8.7 | 0.0037 | NET NO AUTH LOW CX NO UI | Fleet is open source device management software. Prior to version 4.81.0, Fleet | |
|
77
|
CVE-2026-56082 |
8.7 | 0.0037 | NET NO AUTH LOW CX NO UI | Capgo (Cap-go/capgo) before 12.128.2 contains an improper access control vulnera | |
|
77
|
CVE-2026-54365 |
8.7 | 0.0037 | NET NO AUTH LOW CX NO UI | CentreStack before 17.3 contains an unauthenticated deserialization vulnerabilit | |
|
77
|
CVE-2026-111075 |
8.7 | 0.0037 | NET NO AUTH LOW CX NO UI | In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to per | |
|
77
|
CVE-2026-55604 |
8.6 | 0.0037 | NET NO AUTH LOW CX NO UI | DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 | |
|
77
|
CVE-2026-110474 |
8.7 | 0.0037 | NET NO AUTH LOW CX NO UI | This vulnerability exists in the CreditNirvana Agentic AI Call Centre applicatio | |
|
77
|
CVE-2026-46776 |
8.6 | 0.0037 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middlewar | |
|
77
|
CVE-2026-61286 |
8.6 | 0.0037 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle E | |
|
77
|
CVE-2026-96616 |
8.3 | 0.0037 | NET NO AUTH LOW CX NO UI | Authentication tokens issued by the E3's web management interface on login are g | |
|
76
|
CVE-2026-118260 |
8.2 | 0.0037 | NET NO AUTH LOW CX NO UI | Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump m | |
|
76
|
CVE-2026-118261 |
8.2 | 0.0037 | NET NO AUTH LOW CX NO UI | Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress | |
|
76
|
CVE-2026-40168 |
8.2 | 0.0037 | NET NO AUTH LOW CX NO UI | Postiz is an AI social media scheduling tool. Prior to 2.21.5, the /api/public/s | |
|
76
|
CVE-2026-66708 |
8.2 | 0.0037 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in Total Upkeep <= 1.17.2 versions. | |
|
76
|
CVE-2026-73356 |
8.2 | 0.0037 | NET NO AUTH LOW CX NO UI | Unauthenticated Arbitrary Content Deletion in Breeze <= 2.5.12 versions. | |
|
75
|
CVE-2026-40116 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | PraisonAI is a multi-agent teams system. Prior to 4.5.128, the /media-stream Web | |
|
75
|
CVE-2026-34065 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | nimiq-primitives contains primitives (e.g., block, account, transaction) to be u | |
|
75
|
CVE-2026-25425 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in User Registration <= 5.1.2 versions. | |
|
75
|
CVE-2026-62242 |
7.7 | 0.0037 | NET NO AUTH LOW CX NO UI | Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vul | |
|
75
|
CVE-2026-33254 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | An attacker can create a large number of concurrent DoQ or DoH3 connections, cau | |
|
75
|
CVE-2026-33594 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | A client can trigger excessive memory allocation by generating a lot of queries | |
|
75
|
CVE-2026-33595 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | A client can trigger excessive memory allocation by generating a lot of errors r | |
|
75
|
CVE-2026-19082 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap byte | |
|
74
|
CVE-2026-44982 |
7.2 | 0.0037 | NET NO AUTH LOW CX NO UI | CrowdSec offers crowdsourced protection against malicious IPs. From 1.5.0 until | |
|
68
|
CVE-2026-77903 |
9.0 | 0.0037 | NET NO AUTH NO UI | Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized | |
|
68
|
CVE-2026-6301 |
8.8 | 0.0037 | NET NO AUTH LOW CX | Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a re | |
|
68
|
CVE-2026-119716 |
9.2 | 0.0037 | NET NO AUTH NO UI | pybars3 through 0.9.7 contains a code injection vulnerability in pybars/_compile | |
|
68
|
CVE-2026-43908 |
8.8 | 0.0037 | NET NO AUTH LOW CX | OpenImageIO is a toolset for reading, writing, and manipulating image files of a | |
|
68
|
CVE-2026-43909 |
8.8 | 0.0037 | NET NO AUTH LOW CX | OpenImageIO is a toolset for reading, writing, and manipulating image files of a | |
|
68
|
CVE-2026-14422 |
8.8 | 0.0037 | NET NO AUTH LOW CX | Out of bounds read and write in Tint in Google Chrome prior to 150.0.7871.46 all | |
|
68
|
CVE-2026-17729 |
8.8 | 0.0037 | NET NO AUTH LOW CX | Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote at | |
|
68
|
CVE-2026-17971 |
8.8 | 0.0037 | NET NO AUTH LOW CX | Inappropriate implementation in Frame in Google Chrome prior to 151.0.7922.72 al | |
|
67
|
CVE-2026-42557 |
8.6 | 0.0037 | NET NO AUTH LOW CX | jupyterlab is an extensible environment for interactive and reproducible computi | |
|
65
|
CVE-2026-45741 |
7.5 | 0.0037 | NET NO AUTH NO UI | Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier | |
|
64
|
CVE-2026-49346 |
7.1 | 0.0037 | NET NO AUTH LOW CX | libde265 is an open source implementation of the h.265 video codec. Prior to ver | |
|
57
|
CVE-2026-13131 |
8.3 | 0.0037 | NET NO AUTH | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe | |
|
57
|
CVE-2026-13132 |
8.3 | 0.0037 | NET NO AUTH | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe | |
|
57
|
CVE-2026-57264 |
8.3 | 0.0037 | NET NO AUTH | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe | |
|
57
|
CVE-2026-57265 |
8.3 | 0.0037 | NET NO AUTH | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe | |
|
57
|
CVE-2026-57266 |
8.3 | 0.0037 | NET NO AUTH | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe | |
|
57
|
CVE-2026-57267 |
8.3 | 0.0037 | NET NO AUTH | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe | |
|
57
|
CVE-2026-57269 |
8.3 | 0.0037 | NET NO AUTH | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe | |
|
57
|
CVE-2026-57270 |
8.3 | 0.0037 | NET NO AUTH | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe | |
|
57
|
CVE-2026-57271 |
8.3 | 0.0037 | NET NO AUTH | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Playe |