Hunt List
8,505 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-5935 |
9.8 | 0.0034 | NET NO AUTH LOW CX NO UI | IBM Total Storage Service Console (TSSC) / TS4500 IMC 9.2, 9.3, 9.4, 9.5, 9.6 TS | |
|
78
|
CVE-2026-114219 |
9.1 | 0.0034 | NET NO AUTH LOW CX NO UI | NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerabil | |
|
78
|
CVE-2026-56245 |
8.8 | 0.0034 | NET NO AUTH LOW CX NO UI | Supabase Capgo before 12.128.2 contains an authorization bypass vulnerability in | |
|
77
|
CVE-2026-61439 |
8.7 | 0.0034 | NET NO AUTH LOW CX NO UI | PraisonAI versions before 4.6.78 contain a prompt injection defense misconfigura | |
|
75
|
CVE-2026-33813 |
7.5 | 0.0034 | NET NO AUTH LOW CX NO UI | Parsing a WEBP image with an invalid, large size panics on 32-bit platforms. | |
|
75
|
CVE-2026-4503 |
7.5 | 0.0034 | NET NO AUTH LOW CX NO UI | IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow could allow an unauthenticated | |
|
68
|
CVE-2026-92892 |
9.0 | 0.0034 | NET NO AUTH NO UI | Potential arbitrary code execution under specific configurations. Updated Octobe | |
|
68
|
CVE-2026-118331 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Improper input validation in FileAPI in Google Chrome prior to 156.0.8078.73 all | |
|
68
|
CVE-2026-118344 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Use after free in Layout in Google Chrome prior to 156.0.8078.73 allowed a remot | |
|
68
|
CVE-2026-118348 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowe | |
|
67
|
CVE-2026-60427 |
8.7 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middlewar | |
|
67
|
CVE-2026-60448 |
8.7 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
67
|
CVE-2026-60553 |
8.7 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware | |
|
67
|
CVE-2026-60597 |
8.7 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the PeopleSoft Enterprise FIN Cash Management product of Oracle | |
|
67
|
CVE-2026-60903 |
8.7 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
67
|
CVE-2026-60934 |
8.7 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
67
|
CVE-2026-60935 |
8.7 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
67
|
CVE-2026-60954 |
8.7 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
67
|
CVE-2026-60980 |
8.7 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
67
|
CVE-2026-61193 |
8.7 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware | |
|
67
|
CVE-2026-62589 |
8.7 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (compon | |
|
67
|
CVE-2026-70900 |
8.7 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora | |
|
67
|
CVE-2026-49492 |
8.6 | 0.0034 | NET NO AUTH LOW CX | Markdown Preview Enhanced before 0.8.28 opens external files and links from the | |
|
67
|
CVE-2026-66001 |
8.5 | 0.0034 | NET NO AUTH LOW CX | Frappe is a full-stack web application framework. Prior to 15.114.0 and 16.26.0, | |
|
66
|
CVE-2026-13187 |
8.1 | 0.0034 | NET NO AUTH NO UI | In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider t | |
|
66
|
CVE-2026-119421 |
8.2 | 0.0034 | NET NO AUTH NO UI | Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) contains a m | |
|
65
|
CVE-2026-14838 |
7.4 | 0.0034 | NET NO AUTH NO UI | Use of GET request method with sensitive query strings vulnerability in Bilin So | |
|
65
|
CVE-2026-46943 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle Retail EFTLink product of Oracle Retail Applications | |
|
65
|
CVE-2026-60179 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connec | |
|
65
|
CVE-2026-60317 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connec | |
|
65
|
CVE-2026-60725 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: Ge | |
|
65
|
CVE-2026-60823 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (compone | |
|
65
|
CVE-2026-61113 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle Application Object Library product of Oracle E-Busin | |
|
65
|
CVE-2026-61135 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (compon | |
|
65
|
CVE-2026-61164 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
65
|
CVE-2026-61173 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: | |
|
65
|
CVE-2026-61210 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the PeopleSoft Enterprise SCM Manufacturing product of Oracle P | |
|
65
|
CVE-2026-61234 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of | |
|
65
|
CVE-2026-60759 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle Internet Procurement Connector product of Oracle E-B | |
|
65
|
CVE-2026-60766 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (compon | |
|
65
|
CVE-2026-60792 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone | |
|
65
|
CVE-2026-60797 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (compon | |
|
65
|
CVE-2026-60803 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (compo | |
|
65
|
CVE-2026-60915 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
65
|
CVE-2026-60933 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
65
|
CVE-2026-62492 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle | |
|
65
|
CVE-2026-62538 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle | |
|
65
|
CVE-2026-70672 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middlewar | |
|
65
|
CVE-2026-70699 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle Payments product of Oracle E-Business Suite (compone | |
|
65
|
CVE-2026-70779 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite |