Hunt List
8,518 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-17024 |
9.8 | 0.0035 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e | |
|
80
|
CVE-2024-34320 |
9.8 | 0.0035 | NET NO AUTH LOW CX NO UI | ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect acces | |
|
79
|
CVE-2026-35306 |
9.3 | 0.0035 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (compo | |
|
79
|
CVE-2026-61207 |
9.3 | 0.0035 | NET NO AUTH LOW CX NO UI | Vulnerability in the PeopleSoft Enterprise SCM eProcurement product of Oracle Pe | |
|
79
|
CVE-2026-62618 |
9.3 | 0.0035 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middlewar | |
|
79
|
CVE-2026-70673 |
9.3 | 0.0035 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middlewar | |
|
79
|
CVE-2026-70998 |
9.3 | 0.0035 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
79
|
CVE-2026-71065 |
9.3 | 0.0035 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
79
|
CVE-2026-40797 |
9.3 | 0.0035 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti | |
|
79
|
CVE-2026-11849 |
9.3 | 0.0035 | NET NO AUTH LOW CX NO UI | The iRM-IEI Remote Management developed by IEI Integration Corp has a Hardcoded | |
|
78
|
CVE-2026-62232 |
9.1 | 0.0035 | NET NO AUTH LOW CX NO UI | Grav before 2.0.4 contains a two-factor authentication bypass vulnerability in t | |
|
77
|
CVE-2026-76641 |
8.7 | 0.0035 | NET NO AUTH LOW CX NO UI | Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows att | |
|
77
|
CVE-2026-44499 |
8.7 | 0.0035 | NET NO AUTH LOW CX NO UI | ZEBRA is a Zcash node written entirely in Rust. Prior to version 4.4.0, a compos | |
|
77
|
CVE-2026-45169 |
8.7 | 0.0035 | NET NO AUTH LOW CX NO UI | Idira Privileged Access Manager (PAM) Self-Hosted Vault versions prior to 15.0.3 | |
|
76
|
CVE-2026-60284 |
8.2 | 0.0035 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (compo | |
|
76
|
CVE-2026-60428 |
8.2 | 0.0035 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middlewar | |
|
76
|
CVE-2026-60615 |
8.2 | 0.0035 | NET NO AUTH LOW CX NO UI | Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle | |
|
76
|
CVE-2026-60668 |
8.2 | 0.0035 | NET NO AUTH LOW CX NO UI | Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle | |
|
76
|
CVE-2026-60674 |
8.2 | 0.0035 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of | |
|
76
|
CVE-2026-60810 |
8.2 | 0.0035 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Supply Chain Trading Connector product of Oracle E-B | |
|
76
|
CVE-2026-61089 |
8.2 | 0.0035 | NET NO AUTH LOW CX NO UI | Vulnerability in the PeopleSoft Enterprise SCM Inventory product of Oracle Peopl | |
|
76
|
CVE-2026-61038 |
8.2 | 0.0035 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware | |
|
76
|
CVE-2026-61054 |
8.2 | 0.0035 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware | |
|
76
|
CVE-2026-70702 |
8.2 | 0.0035 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Payments product of Oracle E-Business Suite (compone | |
|
76
|
CVE-2026-70773 |
8.2 | 0.0035 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business | |
|
76
|
CVE-2026-70852 |
8.2 | 0.0035 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Demand Planning product of Oracle Supply Chain (comp | |
|
76
|
CVE-2026-70887 |
8.2 | 0.0035 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora | |
|
76
|
CVE-2026-70897 |
8.2 | 0.0035 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora | |
|
76
|
CVE-2026-71130 |
8.2 | 0.0035 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp | |
|
76
|
CVE-2026-71159 |
8.2 | 0.0035 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
76
|
CVE-2026-35227 |
8.2 | 0.0035 | NET NO AUTH LOW CX NO UI | An unauthenticated remote attacker may exhaust all available TCP connections in | |
|
75
|
CVE-2026-44375 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Nerdbank.MessagePack is a NativeAOT-compatible MessagePack serialization library | |
|
75
|
CVE-2026-19448 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 A stack memory corruption vulnerab | |
|
75
|
CVE-2026-104189 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | The 3D Viewer for Nextcloud is a comprehensive 3D model viewer application for N | |
|
75
|
CVE-2026-34063 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Nimiq's network-libp2p is a Nimiq network implementation based on libp2p. Prior | |
|
75
|
CVE-2026-10638 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | subsys/net/ip/icmpv6.c reads the network interface from a net_pkt after that pac | |
|
75
|
CVE-2026-54719 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | goshs is a feature-rich single-binary file server for red teamers and developers | |
|
75
|
CVE-2026-42855 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ES | |
|
75
|
CVE-2026-42551 |
7.5 | 0.0035 | NET NO AUTH LOW CX NO UI | Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Request::getMe | |
|
69
|
CVE-2026-5289 |
9.6 | 0.0035 | NET NO AUTH LOW CX | Use after free in Navigation in Google Chrome prior to 146.0.7680.178 allowed a | |
|
68
|
CVE-2026-13035 |
8.8 | 0.0035 | NET NO AUTH LOW CX | Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.197 allo | |
|
68
|
CVE-2026-14108 |
8.8 | 0.0035 | NET NO AUTH LOW CX | Use after free in PDFium in Google Chrome prior to 150.0.7871.47 allowed a remot | |
|
68
|
CVE-2026-118008 |
8.8 | 0.0035 | NET NO AUTH LOW CX | Privilege escalation in the DOM: Navigation component. This vulnerability was fi | |
|
67
|
CVE-2026-63344 |
8.6 | 0.0035 | NET NO AUTH LOW CX | Refitter is a tool for generating a C# REST API client using the Refit library. | |
|
67
|
CVE-2026-63346 |
8.6 | 0.0035 | NET NO AUTH LOW CX | Refitter is a tool for generating a C# REST API client using the Refit library. | |
|
66
|
CVE-2026-48060 |
8.1 | 0.0035 | NET NO AUTH LOW CX | Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to | |
|
66
|
CVE-2026-92287 |
8.1 | 0.0035 | NET NO AUTH LOW CX | Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and Py | |
|
64
|
CVE-2026-114042 |
7.1 | 0.0035 | NET NO AUTH LOW CX | FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel th | |
|
64
|
CVE-2026-114046 |
7.1 | 0.0035 | NET NO AUTH LOW CX | FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard | |
|
55
|
CVE-2026-53950 |
7.5 | 0.0035 | NET NO AUTH | @tryghost/activitypub is Ghost’s social/federation client app. Prior to 3.1.0, t |