Hunt List
8,642 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
90
|
CVE-2026-103039 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | 1 PoC | The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in |
|
80
|
CVE-2026-70740 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyper | |
|
80
|
CVE-2026-70745 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyper | |
|
80
|
CVE-2026-70817 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype | |
|
80
|
CVE-2026-70871 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora | |
|
80
|
CVE-2026-70873 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora | |
|
80
|
CVE-2026-70905 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware ( | |
|
80
|
CVE-2026-70926 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (compone | |
|
80
|
CVE-2026-70953 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (compon | |
|
80
|
CVE-2026-70954 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (compon | |
|
80
|
CVE-2026-70970 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware | |
|
80
|
CVE-2026-70995 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
80
|
CVE-2026-71074 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
80
|
CVE-2026-71152 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
80
|
CVE-2026-71164 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
80
|
CVE-2026-73905 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
80
|
CVE-2026-73912 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
80
|
CVE-2026-73921 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
80
|
CVE-2026-9074 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains | |
|
80
|
CVE-2026-61737 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | ng-antd-admin is an Angular and NestJS administration system template. Prior to | |
|
79
|
CVE-2026-72742 |
9.2 | 0.0051 | NET NO AUTH LOW CX NO UI | DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio o | |
|
79
|
CVE-2026-52735 |
9.3 | 0.0051 | NET NO AUTH LOW CX NO UI | ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, Zebra can accept | |
|
79
|
CVE-2026-32311 |
9.3 | 0.0051 | NET NO AUTH LOW CX NO UI | Flowsint is an open-source OSINT graph exploration tool designed for cybersecuri | |
|
79
|
CVE-2026-67285 |
9.2 | 0.0051 | NET NO AUTH LOW CX NO UI | Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inc | |
|
79
|
CVE-2026-41274 |
9.3 | 0.0050 | NET NO AUTH LOW CX NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
78
|
CVE-2026-110685 |
9.1 | 0.0051 | NET NO AUTH LOW CX NO UI | Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a t | |
|
78
|
CVE-2026-33654 |
8.9 | 0.0051 | NET NO AUTH LOW CX NO UI | nanobot is a personal AI assistant. Prior to version 0.1.6, an indirect prompt i | |
|
78
|
CVE-2026-73569 |
8.7 | 0.0051 | NET NO AUTH LOW CX NO UI | fast-xml-parser allows users to process XML from JS object without C/C++ based l | |
|
78
|
CVE-2026-119762 |
8.7 | 0.0051 | NET NO AUTH LOW CX NO UI | Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7 | |
|
78
|
CVE-2026-59084 |
9.1 | 0.0051 | NET NO AUTH LOW CX NO UI | Insufficient Technical Documentation vulnerability in Apache Tomcat since the re | |
|
78
|
CVE-2026-53727 |
8.9 | 0.0051 | NET NO AUTH LOW CX NO UI | css_parser is a Ruby CSS parser. From 2.2.0 until 3.0.0, CssParser::Parser#read_ | |
|
78
|
CVE-2026-9390 |
9.1 | 0.0050 | NET NO AUTH LOW CX NO UI | XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. veri | |
|
77
|
CVE-2026-58295 |
8.3 | 0.0051 | NET NO AUTH LOW CX NO UI | Access of resource using incompatible type ('type confusion') in Microsoft Edge | |
|
77
|
CVE-2026-44981 |
8.2 | 0.0051 | NET NO AUTH LOW CX NO UI | CrowdSec offers crowdsourced protection against malicious IPs. From 1.7.0 until | |
|
76
|
CVE-2026-67346 |
7.7 | 0.0051 | NET NO AUTH LOW CX NO UI | Swarms through 6.8.1, fixed in commit 8b0fc9e, contains a server-side request fo | |
|
75
|
CVE-2026-34652 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2 | |
|
75
|
CVE-2026-11625 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | Bytes::Random::Secure versions through 0.29 for Perl share internal state across | |
|
75
|
CVE-2026-11702 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state | |
|
75
|
CVE-2026-14570 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private | |
|
75
|
CVE-2026-34501 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redi | |
|
75
|
CVE-2026-34502 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memc | |
|
75
|
CVE-2026-75589 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINT | |
|
75
|
CVE-2026-50756 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtai | |
|
75
|
CVE-2026-10849 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body | |
|
75
|
CVE-2026-113728 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior | |
|
69
|
CVE-2026-76036 |
9.6 | 0.0051 | NET NO AUTH LOW CX | Buffer overflow in Dawn in Google Chrome on on Android prior to 151.0.7922.169 a | |
|
68
|
CVE-2026-16617 |
8.8 | 0.0050 | NET NO AUTH LOW CX | The Simple File List WordPress plugin through 6.3.11 does not properly sanitise | |
|
66
|
CVE-2026-88173 |
8.1 | 0.0051 | NET NO AUTH NO UI | Use after free in Windows Background Intelligent Transfer Service (BITS) allows | |
|
66
|
CVE-2026-110205 |
7.7 | 0.0051 | NET NO AUTH LOW CX | Roo Code through 3.54.0 contains a command approval bypass vulnerability in pars | |
|
66
|
CVE-2026-99059 |
7.7 | 0.0051 | NET NO AUTH NO UI | In the Linux kernel, the following vulnerability has been resolved: wireguard: |