Hunt List
8,494 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-42160 |
10.0 | 0.0032 | NET NO AUTH LOW CX NO UI | Data Space Portal is an open-source Software as a Service (SaaS) solution design | |
|
80
|
CVE-2026-48930 |
9.8 | 0.0032 | NET NO AUTH LOW CX NO UI | A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lea | |
|
80
|
CVE-2026-12665 |
9.8 | 0.0032 | NET NO AUTH LOW CX NO UI | IBM MQ could allow a remote attacker to execute arbitrary code due to a stack bu | |
|
80
|
CVE-2026-40190 |
9.8 | 0.0031 | NET NO AUTH LOW CX NO UI | LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. | |
|
80
|
CVE-2026-112846 |
9.8 | 0.0031 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save | |
|
80
|
CVE-2026-112847 |
9.8 | 0.0031 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allo | |
|
80
|
CVE-2026-112848 |
9.8 | 0.0031 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev | |
|
80
|
CVE-2026-112851 |
9.8 | 0.0031 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotloc | |
|
80
|
CVE-2026-112854 |
9.8 | 0.0031 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center h | |
|
80
|
CVE-2026-112855 |
9.8 | 0.0031 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows | |
|
80
|
CVE-2026-112856 |
9.8 | 0.0031 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vaga | |
|
80
|
CVE-2026-112858 |
9.8 | 0.0031 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos all | |
|
80
|
CVE-2026-112859 |
9.8 | 0.0031 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies | |
|
79
|
CVE-2026-102789 |
9.3 | 0.0032 | NET NO AUTH LOW CX NO UI | Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controlle | |
|
78
|
CVE-2026-75595 |
9.1 | 0.0032 | NET NO AUTH LOW CX NO UI | Netty is an asynchronous, event-driven network application framework. Prior to 4 | |
|
78
|
CVE-2026-116199 |
9.2 | 0.0032 | NET NO AUTH LOW CX NO UI | Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController: | |
|
78
|
CVE-2026-65057 |
9.2 | 0.0031 | NET NO AUTH LOW CX NO UI | Keep (commit 91c75e0) contains a server-side request forgery vulnerability that | |
|
78
|
CVE-2026-112712 |
9.1 | 0.0031 | NET NO AUTH LOW CX NO UI | @fastify/middie is the Express-style middleware engine for Fastify. In versions | |
|
76
|
CVE-2026-28525 |
8.2 | 0.0032 | NET NO AUTH LOW CX NO UI | SWUpdate contains an integer underflow vulnerability in the multipart upload par | |
|
76
|
CVE-2026-46509 |
8.2 | 0.0032 | NET NO AUTH LOW CX NO UI | deepobj provides get, set, delete deep objects in javascript. Prior to 1.0.3, pr | |
|
76
|
CVE-2026-35142 |
8.2 | 0.0032 | NET NO AUTH LOW CX NO UI | HCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability. | |
|
75
|
CVE-2026-112359 |
7.5 | 0.0032 | NET NO AUTH LOW CX NO UI | Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows | |
|
75
|
CVE-2026-116393 |
7.5 | 0.0032 | NET NO AUTH LOW CX NO UI | Missing Authorization vulnerability in iHomefinder, Inc. Optima Express optima-e | |
|
75
|
CVE-2026-114193 |
7.5 | 0.0032 | NET NO AUTH LOW CX NO UI | Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp | |
|
75
|
CVE-2026-115599 |
7.5 | 0.0032 | NET NO AUTH LOW CX NO UI | Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Ex | |
|
75
|
CVE-2025-63248 |
7.5 | 0.0032 | NET NO AUTH LOW CX NO UI | DWSurvey 6.14.0 is vulnerable to Incorrect Access Control. When deleting a quest | |
|
75
|
CVE-2026-44302 |
7.5 | 0.0032 | NET NO AUTH LOW CX NO UI | Snappier is a high performance C# implementation of the Snappy compression algor | |
|
75
|
CVE-2026-46474 |
7.5 | 0.0032 | NET NO AUTH LOW CX NO UI | Trog::TOTP versions before 1.006 for Perl generate secrets using rand. Secrets | |
|
75
|
CVE-2026-67978 |
7.5 | 0.0032 | NET NO AUTH LOW CX NO UI | An issue in the SBN UDP interface of NASA cFS v7.0.1 allows attackers to cause a | |
|
75
|
CVE-2026-28930 |
7.5 | 0.0032 | NET NO AUTH LOW CX NO UI | A permissions issue was addressed with additional restrictions. This issue is fi | |
|
75
|
CVE-2026-35229 |
7.5 | 0.0031 | NET NO AUTH LOW CX NO UI | Vulnerability in the Java VM component of Oracle Database Server. Supported ver | |
|
75
|
CVE-2026-35231 |
7.5 | 0.0031 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Financial Services Transaction Filtering product of | |
|
75
|
CVE-2026-47193 |
7.5 | 0.0031 | NET NO AUTH LOW CX NO UI | OpenProject is open-source, web-based project management software. Prior to 17.3 | |
|
68
|
CVE-2025-13014 |
8.8 | 0.0032 | NET NO AUTH LOW CX | Use-after-free in the Audio/Video component. This vulnerability was fixed in Fir | |
|
68
|
CVE-2026-42629 |
8.8 | 0.0032 | NET NO AUTH LOW CX | Unauthenticated Broken Authentication in PowerPack Pro for Elementor < v2.13.0 v | |
|
68
|
CVE-2026-111120 |
8.8 | 0.0032 | NET NO AUTH LOW CX | The VikRentCar Car Rental Management System plugin for WordPress is vulnerable t | |
|
68
|
CVE-2026-15183 |
9.2 | 0.0031 | NET NO AUTH NO UI | Multiple input validation vulnerabilities in the Snowflake Spark Connector (spar | |
|
66
|
CVE-2026-62485 |
8.2 | 0.0032 | NET NO AUTH LOW CX | Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle | |
|
66
|
CVE-2026-62605 |
8.2 | 0.0032 | NET NO AUTH LOW CX | Vulnerability in the Oracle Partner Management product of Oracle E-Business Suit | |
|
66
|
CVE-2026-71016 |
8.2 | 0.0032 | NET NO AUTH LOW CX | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
66
|
CVE-2026-71018 |
8.2 | 0.0032 | NET NO AUTH LOW CX | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
66
|
CVE-2026-27333 |
8.1 | 0.0032 | NET NO AUTH NO UI | Unauthenticated Deserialization of untrusted data in Paid Videochat Turnkey Site | |
|
66
|
CVE-2026-65758 |
8.2 | 0.0031 | NET NO AUTH NO UI | Joomla Extension - tassos.gr - Sensitive data exposure in Convert Forms extensio | |
|
66
|
CVE-2026-39307 |
8.1 | 0.0031 | NET NO AUTH LOW CX | PraisonAI is a multi-agent teams system. Prior to 1.5.113, The PraisonAI templat | |
|
66
|
CVE-2026-87862 |
8.1 | 0.0031 | NET NO AUTH NO UI | Importing a `includeSubDomains` parent HSTS entry before a longer-lived child en | |
|
65
|
CVE-2026-91494 |
7.4 | 0.0032 | NET NO AUTH NO UI | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion | |
|
65
|
CVE-2026-12348 |
7.4 | 0.0032 | NET NO AUTH LOW CX | Address bar spoofing in Arc Search for Android allows a remote attacker to displ | |
|
65
|
CVE-2026-85297 |
7.7 | 0.0031 | NET NO AUTH LOW CX | Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Clou | |
|
64
|
CVE-2026-61288 |
7.1 | 0.0032 | NET NO AUTH LOW CX | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
64
|
CVE-2026-58230 |
7.0 | 0.0031 | NET NO AUTH NO UI | SAP Approuter does not sufficiently validate certain token content under specifi |