Hunt List
8,495 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-5734 |
9.8 | 0.0033 | NET NO AUTH LOW CX NO UI | Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Fire | |
|
79
|
CVE-2026-76935 |
9.4 | 0.0033 | NET NO AUTH LOW CX NO UI | Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System | |
|
78
|
CVE-2026-63160 |
9.1 | 0.0033 | NET NO AUTH LOW CX NO UI | Omnispace Agora Project before 26.10.0 contains a vulnerability where the persis | |
|
78
|
CVE-2026-11832 |
9.1 | 0.0033 | NET NO AUTH LOW CX NO UI | Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predicta | |
|
78
|
CVE-2025-70516 |
9.1 | 0.0033 | NET NO AUTH LOW CX NO UI | The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce | |
|
78
|
CVE-2026-56324 |
8.8 | 0.0033 | NET NO AUTH LOW CX NO UI | Capgo before 12.128.2 contains a rate limit bypass vulnerability in the channel_ | |
|
77
|
CVE-2026-65007 |
8.7 | 0.0033 | NET NO AUTH LOW CX NO UI | The Grav api plugin (grav-plugin-api) before 1.0.8 fails to properly authorize A | |
|
77
|
CVE-2026-116877 |
8.7 | 0.0033 | NET NO AUTH LOW CX NO UI | Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource con | |
|
77
|
CVE-2026-67322 |
8.7 | 0.0033 | NET NO AUTH LOW CX NO UI | GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Re | |
|
77
|
CVE-2026-41683 |
8.6 | 0.0033 | NET NO AUTH LOW CX NO UI | i18next-http-middleware is a middleware to be used with Node.js web frameworks l | |
|
77
|
CVE-2026-93441 |
8.6 | 0.0033 | NET NO AUTH LOW CX NO UI | IBM QRadar SIEM could allow a remote attacker to cause a denial of service due t | |
|
76
|
CVE-2026-48764 |
8.2 | 0.0033 | NET NO AUTH LOW CX NO UI | TypeBot is a chatbot builder tool. In versions prior to 3.17.2, SSRF validation | |
|
76
|
CVE-2026-67214 |
8.2 | 0.0033 | NET NO AUTH LOW CX NO UI | nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the custo | |
|
76
|
CVE-2026-17543 |
8.1 | 0.0033 | NET NO AUTH LOW CX NO UI | Improper escaping of backslashes in attacker-provided parameters would allow for | |
|
76
|
CVE-2026-56836 |
8.2 | 0.0033 | NET NO AUTH LOW CX NO UI | PraisonAI is a multi-agent teams system. From version 4.5.112 to before version | |
|
76
|
CVE-2026-8827 |
8.2 | 0.0033 | NET NO AUTH LOW CX NO UI | The AddressRepository::getSqlQuery() method constructs a database query without | |
|
76
|
CVE-2026-61205 |
8.2 | 0.0033 | NET NO AUTH LOW CX NO UI | Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle Peop | |
|
76
|
CVE-2026-73925 |
8.2 | 0.0033 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
76
|
CVE-2026-116589 |
8.2 | 0.0033 | NET NO AUTH LOW CX NO UI | Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, | |
|
76
|
CVE-2026-100635 |
8.2 | 0.0033 | NET NO AUTH LOW CX NO UI | SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publ | |
|
75
|
CVE-2026-44602 |
7.5 | 0.0033 | NET NO AUTH LOW CX NO UI | Tor before 0.4.9.7 has a NULL pointer dereference when a CERT cell is received o | |
|
75
|
CVE-2026-15163 |
7.5 | 0.0033 | NET NO AUTH LOW CX NO UI | Multiple protocol dissector infinite loops in Wireshark 4.6.0 to 4.6.6 and 4.4.0 | |
|
75
|
CVE-2026-40879 |
7.5 | 0.0033 | NET NO AUTH LOW CX NO UI | Nest is a framework for building scalable Node.js server-side applications. Prio | |
|
75
|
CVE-2026-23824 |
7.5 | 0.0033 | NET NO AUTH LOW CX NO UI | Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Opera | |
|
75
|
CVE-2026-23825 |
7.5 | 0.0033 | NET NO AUTH LOW CX NO UI | Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Opera | |
|
75
|
CVE-2025-28344 |
7.5 | 0.0033 | NET NO AUTH LOW CX NO UI | striso-control-firmware 54c9722 is vulnerable to Buffer Overflow in function Aux | |
|
75
|
CVE-2026-33666 |
7.5 | 0.0033 | NET NO AUTH LOW CX NO UI | Zserio is a framework for serializing structured data with a compact and efficie | |
|
75
|
CVE-2026-54592 |
7.5 | 0.0033 | NET NO AUTH LOW CX NO UI | Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby ge | |
|
75
|
CVE-2026-35036 |
7.5 | 0.0033 | NET NO AUTH LOW CX NO UI | Ech0 is an open-source, self-hosted publishing platform for personal idea sharin | |
|
69
|
CVE-2026-14038 |
9.3 | 0.0033 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in New Tab Page in Google Chrome prio | |
|
68
|
CVE-2025-11715 |
8.8 | 0.0033 | NET NO AUTH LOW CX | Memory safety bugs present in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox | |
|
68
|
CVE-2026-14385 |
8.8 | 0.0033 | NET NO AUTH LOW CX | Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 150.0.7871.46 all | |
|
67
|
CVE-2026-87346 |
8.7 | 0.0033 | NET NO AUTH NO UI | Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (com | |
|
67
|
CVE-2026-49493 |
8.6 | 0.0033 | NET NO AUTH LOW CX | Markdown Preview Enhanced before 0.8.28 parses Bitfield fenced code blocks with | |
|
66
|
CVE-2026-13806 |
8.1 | 0.0033 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Accessibility in Google Chrome pri | |
|
66
|
CVE-2026-17686 |
8.1 | 0.0033 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Passwords in Google Chrome prior t | |
|
66
|
CVE-2026-19153 |
8.1 | 0.0033 | NET NO AUTH LOW CX | Insufficient validation of untrusted input in Workers in Google Chrome prior to | |
|
66
|
CVE-2026-91647 |
8.1 | 0.0033 | NET NO AUTH NO UI | Vulnerability in Oracle Essbase (component: Security). The supported version t | |
|
66
|
CVE-2026-54814 |
8.1 | 0.0033 | NET NO AUTH NO UI | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP | |
|
66
|
CVE-2026-14011 |
8.1 | 0.0033 | NET NO AUTH LOW CX | Out of bounds read in SurfaceCapture in Google Chrome prior to 150.0.7871.47 all | |
|
66
|
CVE-2026-17869 |
8.1 | 0.0033 | NET NO AUTH LOW CX | Out of bounds read in WebXR in Google Chrome prior to 151.0.7922.72 allowed a re | |
|
66
|
CVE-2026-17995 |
8.1 | 0.0033 | NET NO AUTH LOW CX | Out of bounds read in Dawn in Google Chrome prior to 151.0.7922.72 allowed a rem | |
|
65
|
CVE-2026-46699 |
7.6 | 0.0033 | NET NO AUTH LOW CX | conda-smithy is a tool for combining a conda recipe with configurations to build | |
|
65
|
CVE-2026-44460 |
7.4 | 0.0033 | NET NO AUTH NO UI | FileRise is a self-hosted web-based file manager with multi-file upload, editing | |
|
64
|
CVE-2026-54290 |
7.1 | 0.0033 | NET NO AUTH LOW CX | Hono is a Web application framework that provides support for any JavaScript run | |
|
64
|
CVE-2026-55564 |
7.1 | 0.0033 | NET NO AUTH LOW CX | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0 | |
|
57
|
CVE-2026-19138 |
8.3 | 0.0033 | NET NO AUTH | Heap buffer overflow in CrashReporting in Google Chrome prior to 151.0.7922.109 | |
|
55
|
CVE-2026-60467 |
7.5 | 0.0033 | NET NO AUTH | Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middlew | |
|
55
|
CVE-2026-70681 |
7.5 | 0.0033 | NET NO AUTH | Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite | |
|
55
|
CVE-2026-70856 |
7.5 | 0.0033 | NET NO AUTH | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone |