Hunt List
8,504 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-42222 |
9.8 | 0.0034 | NET NO AUTH LOW CX NO UI | Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an | |
|
80
|
CVE-2026-54807 |
9.8 | 0.0034 | NET NO AUTH LOW CX NO UI | Unauthenticated Privilege Escalation in Registration Form for WooCommerce <= 1.0 | |
|
80
|
CVE-2026-57926 |
9.8 | 0.0034 | NET NO AUTH LOW CX NO UI | In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable t | |
|
79
|
CVE-2026-105215 |
9.3 | 0.0034 | NET NO AUTH LOW CX NO UI | ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in | |
|
79
|
CVE-2026-35305 |
9.3 | 0.0034 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (compo | |
|
79
|
CVE-2026-91230 |
9.3 | 0.0034 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo | |
|
78
|
CVE-2026-5085 |
9.1 | 0.0034 | NET NO AUTH LOW CX NO UI | Solstice::Session versions through 1440 for Perl generates session ids insecurel | |
|
78
|
CVE-2026-113812 |
9.1 | 0.0034 | NET NO AUTH LOW CX NO UI | Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle co | |
|
78
|
CVE-2015-20128 |
8.8 | 0.0034 | NET NO AUTH LOW CX NO UI | FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows | |
|
77
|
CVE-2025-71437 |
8.7 | 0.0034 | NET NO AUTH LOW CX NO UI | Astral uv before 0.8.22 contains a path traversal vulnerability in source distri | |
|
77
|
CVE-2026-33778 |
8.7 | 0.0034 | NET NO AUTH LOW CX NO UI | An Improper Validation of Syntactic Correctness of Input vulnerability in the I | |
|
75
|
CVE-2025-66969 |
7.5 | 0.0034 | NET NO AUTH LOW CX NO UI | Integer overflow in OpenModSim (<=1.11.0), leading to denial of service | |
|
75
|
CVE-2026-18449 |
7.5 | 0.0034 | NET NO AUTH LOW CX NO UI | The BMC does not correctly enforce integrity and encryption requirements for IPM | |
|
75
|
CVE-2026-106972 |
7.5 | 0.0034 | NET NO AUTH LOW CX NO UI | Uncontrolled recursion in MessagePack\BufferUnpacker::unpack() in rybakit/msgpac | |
|
75
|
CVE-2026-103963 |
7.5 | 0.0034 | NET NO AUTH LOW CX NO UI | A flaw was found in glib-networking. When establishing connections using Transpo | |
|
75
|
CVE-2026-62864 |
7.5 | 0.0034 | NET NO AUTH LOW CX NO UI | Ring is a Clojure web applications library inspired by Python's WSGI and Ruby's | |
|
75
|
CVE-2026-62297 |
7.5 | 0.0034 | NET NO AUTH LOW CX NO UI | ag-psd is a JavaScript library for reading and writing Photoshop Document files. | |
|
75
|
CVE-2026-40117 |
7.5 | 0.0034 | NET NO AUTH LOW CX NO UI | PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, read_skill_file | |
|
74
|
CVE-2026-62616 |
7.2 | 0.0034 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middlewar | |
|
68
|
CVE-2025-10537 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Memory safety bugs present in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox | |
|
68
|
CVE-2026-3953 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Improper neutralization of input during web page generation ('cross-site scripti | |
|
68
|
CVE-2026-7928 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Use after free in WebRTC in Google Chrome on Windows prior to 148.0.7778.96 allo | |
|
68
|
CVE-2026-7980 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Use after free in WebAudio in Google Chrome prior to 148.0.7778.96 allowed a rem | |
|
68
|
CVE-2026-7987 |
8.8 | 0.0034 | NET NO AUTH LOW CX | Use after free in WebRTC in Google Chrome prior to 148.0.7778.96 allowed a remot | |
|
67
|
CVE-2026-81726 |
8.3 | 0.0034 | NET NO AUTH NO UI | NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact AP | |
|
66
|
CVE-2026-116172 |
8.2 | 0.0034 | NET NO AUTH NO UI | vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerabili | |
|
66
|
CVE-2026-116173 |
8.2 | 0.0034 | NET NO AUTH NO UI | vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that a | |
|
66
|
CVE-2026-22326 |
8.1 | 0.0034 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Reprizo <= 1.0.8 versions. | |
|
66
|
CVE-2026-22338 |
8.1 | 0.0034 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in EcoBlue <= 1.15 versions. | |
|
66
|
CVE-2026-34893 |
8.1 | 0.0034 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Thegov Core < 2.0.23 versions. | |
|
66
|
CVE-2026-34895 |
8.1 | 0.0034 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Softlab Core < 1.2.11 versions. | |
|
66
|
CVE-2026-39547 |
8.1 | 0.0034 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Getaway < 1.8 versions. | |
|
66
|
CVE-2026-39558 |
8.1 | 0.0034 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Malmö <= 2.2 versions. | |
|
66
|
CVE-2026-39582 |
8.1 | 0.0034 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Hitek < 1.8.3 versions. | |
|
66
|
CVE-2026-39523 |
8.1 | 0.0034 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Solene Core <= 2.3.2 versions. | |
|
66
|
CVE-2026-39559 |
8.1 | 0.0034 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Uppercase < 1.2.2 versions. | |
|
66
|
CVE-2026-39590 |
8.1 | 0.0034 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Atomlab <= 2.4.5 versions. | |
|
65
|
CVE-2026-70783 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle Service Contracts product of Oracle E-Business Suite | |
|
65
|
CVE-2026-70823 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype | |
|
65
|
CVE-2026-70898 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora | |
|
65
|
CVE-2026-71009 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
65
|
CVE-2026-71143 |
7.4 | 0.0034 | NET NO AUTH NO UI | Vulnerability in the Oracle Communications Unified Inventory Management product | |
|
65
|
CVE-2026-18534 |
7.4 | 0.0034 | NET NO AUTH LOW CX | ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden aft | |
|
65
|
CVE-2026-114488 |
7.4 | 0.0034 | NET NO AUTH NO UI | A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP | |
|
64
|
CVE-2026-102010 |
7.0 | 0.0034 | NET NO AUTH NO UI | A flaw was found in GCC. When an application calls the erase_if function on a bi | |
|
64
|
CVE-2026-40039 |
7.1 | 0.0034 | NET NO AUTH LOW CX | Pachno 1.0.6 contains an open redirection vulnerability that allows attackers to | |
|
64
|
CVE-2026-49295 |
7.1 | 0.0034 | NET NO AUTH LOW CX | libde265 is an open source implementation of the h.265 video codec. Prior to ver | |
|
55
|
CVE-2026-13283 |
7.5 | 0.0034 | NET NO AUTH | Use after free in AdFilter in Google Chrome on Android prior to 149.0.7827.201 a | |
|
55
|
CVE-2026-13831 |
7.5 | 0.0034 | NET NO AUTH | Out of bounds read and write in GPU in Google Chrome prior to 150.0.7871.47 allo | |
|
55
|
CVE-2026-13855 |
7.5 | 0.0034 | NET NO AUTH | Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allowed |