Hunt List
8,520 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-11714 |
9.8 | 0.0037 | NET NO AUTH LOW CX NO UI | IBM WebSphere Application Server Liberty is affected by a server-side request fo | |
|
80
|
CVE-2026-50083 |
9.8 | 0.0036 | NET NO AUTH LOW CX NO UI | The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client c | |
|
80
|
CVE-2024-34323 |
10.0 | 0.0036 | NET NO AUTH LOW CX NO UI | ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct | |
|
80
|
CVE-2026-109780 |
9.8 | 0.0036 | NET NO AUTH LOW CX NO UI | Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixe | |
|
80
|
CVE-2026-82120 |
9.8 | 0.0036 | NET NO AUTH LOW CX NO UI | Heap-based Buffer Overflow Vulnerability in HiRDB. This issue affects HiRDB Se | |
|
80
|
CVE-2026-46919 |
9.8 | 0.0036 | NET NO AUTH LOW CX NO UI | Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM | |
|
79
|
CVE-2026-39492 |
9.3 | 0.0036 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in WP Maps <= 4.9.1 versions. | |
|
79
|
CVE-2026-39493 |
9.3 | 0.0036 | NET NO AUTH LOW CX NO UI | Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.9.27 versio | |
|
78
|
CVE-2026-118769 |
9.2 | 0.0037 | NET NO AUTH LOW CX NO UI | Botan is a C++ cryptography library. From 2.1.0 until 3.13.0, the Botan C API fu | |
|
78
|
CVE-2026-112362 |
9.1 | 0.0037 | NET NO AUTH LOW CX NO UI | @fastify/express is a Fastify plugin that runs Express middleware inside Fastify | |
|
78
|
CVE-2026-63149 |
9.1 | 0.0037 | NET NO AUTH LOW CX NO UI | Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerabi | |
|
78
|
CVE-2026-45363 |
9.1 | 0.0036 | NET NO AUTH LOW CX NO UI | ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. | |
|
77
|
CVE-2026-41146 |
8.7 | 0.0037 | NET NO AUTH LOW CX NO UI | facil.io is a C micro-framework for web applications. Prior to commit 5128747363 | |
|
77
|
CVE-2026-116878 |
8.7 | 0.0037 | NET NO AUTH LOW CX NO UI | Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource con | |
|
77
|
CVE-2026-22734 |
8.6 | 0.0036 | NET NO AUTH LOW CX NO UI | Cloud Foundry UUA is vulnerable to a bypass that allows an attacker to obtain a | |
|
77
|
CVE-2026-63568 |
8.7 | 0.0036 | NET NO AUTH LOW CX NO UI | Allocation of resources without limits or throttling in the CMP/CRMF password-ba | |
|
77
|
CVE-2026-44339 |
8.6 | 0.0036 | NET NO AUTH LOW CX NO UI | PraisonAI is a multi-agent teams system. Prior to praisonai version 4.6.37 and p | |
|
77
|
CVE-2026-67431 |
8.3 | 0.0036 | NET NO AUTH LOW CX NO UI | MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and cli | |
|
76
|
CVE-2026-70637 |
8.2 | 0.0037 | NET NO AUTH LOW CX NO UI | LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c th | |
|
76
|
CVE-2026-41458 |
8.2 | 0.0036 | NET NO AUTH LOW CX NO UI | OwnTone Server versions 28.4 through 29.0 contain a race condition vulnerability | |
|
75
|
CVE-2025-50950 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Audiofile v0.3.7 was discovered to contain a NULL pointer dereference via the Mo | |
|
75
|
CVE-2026-31931 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Suricata is a network IDS, IPS and NSM engine. From version 8.0.0 to before vers | |
|
75
|
CVE-2026-31933 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Suricata is a network IDS, IPS and NSM engine. Prior to versions 7.0.15 and 8.0. | |
|
75
|
CVE-2026-49056 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in WooCommerce PDF Invoices, Packing Sli | |
|
75
|
CVE-2026-8050 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | In SignalRGB versions prior to 1.3.7.0, seven of the thirteen IOCTL handlers der | |
|
75
|
CVE-2026-59877 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior t | |
|
75
|
CVE-2026-116584 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Seroval facilitates JavaScript value stringification, including complex structur | |
|
75
|
CVE-2026-110245 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to obtain se | |
|
75
|
CVE-2026-63341 |
7.5 | 0.0037 | NET NO AUTH LOW CX NO UI | Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the M | |
|
75
|
CVE-2026-43655 |
7.3 | 0.0037 | NET NO AUTH LOW CX NO UI | An out-of-bounds read was addressed with improved bounds checking. This issue is | |
|
75
|
CVE-2026-13149 |
7.7 | 0.0036 | NET NO AUTH LOW CX NO UI | brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() f | |
|
75
|
CVE-2026-31937 |
7.5 | 0.0036 | NET NO AUTH LOW CX NO UI | Suricata is a network IDS, IPS and NSM engine. Prior to version 7.0.15, ineffici | |
|
75
|
CVE-2026-41254 |
7.5 | 0.0036 | NET NO AUTH LOW CX NO UI | Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c | |
|
75
|
CVE-2026-6759 |
7.5 | 0.0036 | NET NO AUTH LOW CX NO UI | Use-after-free in the Widget: Cocoa component. This vulnerability was fixed in F | |
|
75
|
CVE-2026-116372 |
7.7 | 0.0036 | NET NO AUTH LOW CX NO UI | MISP mispguard is a security filtering proxy that inspects and blocks MISP feed | |
|
75
|
CVE-2025-51735 |
7.5 | 0.0036 | NET NO AUTH LOW CX NO UI | CSV formula injection vulnerability in HCL Technologies Ltd. Unica 12.0.0. | |
|
75
|
CVE-2026-1718 |
7.5 | 0.0036 | NET NO AUTH LOW CX NO UI | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a deni | |
|
75
|
CVE-2026-44635 |
7.5 | 0.0036 | NET NO AUTH LOW CX NO UI | Kysely is a type-safe TypeScript SQL query builder. From 0.26.0 to 0.28.16, Defa | |
|
75
|
CVE-2026-49061 |
7.5 | 0.0036 | NET NO AUTH LOW CX NO UI | Unauthenticated Arbitrary File Download in WPC Product Options for WooCommerce < | |
|
69
|
CVE-2026-70855 |
9.3 | 0.0036 | NET NO AUTH LOW CX | Vulnerability in the Siebel Apps - Self Service product of Oracle Siebel CRM (co | |
|
68
|
CVE-2026-6307 |
8.8 | 0.0037 | NET NO AUTH LOW CX | Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a re | |
|
68
|
CVE-2026-20043 |
9.0 | 0.0036 | NET NO AUTH NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
68
|
CVE-2026-101842 |
8.8 | 0.0036 | NET NO AUTH LOW CX | Vulnerability in the Strategic Network Optimization product of Oracle E-Business | |
|
68
|
CVE-2026-87397 |
8.8 | 0.0036 | NET NO AUTH LOW CX | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl | |
|
68
|
CVE-2026-91296 |
8.8 | 0.0036 | NET NO AUTH LOW CX | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards | |
|
66
|
CVE-2026-22325 |
8.1 | 0.0036 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Promo <= 1.3.0 versions. | |
|
66
|
CVE-2026-22330 |
8.1 | 0.0036 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Right Way <= 4.0 versions. | |
|
66
|
CVE-2026-22331 |
8.1 | 0.0036 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in AutoParts <= 1.5.8 versions. | |
|
66
|
CVE-2026-115333 |
8.2 | 0.0036 | NET NO AUTH NO UI | Lotus through 0.10.2 contains an improper authentication vulnerability in the Go | |
|
55
|
CVE-2026-13802 |
7.5 | 0.0036 | NET NO AUTH | Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote |