Hunt List
8,661 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-76606 |
10.0 | 0.0050 | NET NO AUTH LOW CX NO UI | Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4 | |
|
80
|
CVE-2026-91323 |
9.8 | 0.0050 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware | |
|
80
|
CVE-2026-6443 |
9.8 | 0.0050 | NET NO AUTH LOW CX NO UI | All plugins by Essentialplugin for WordPress are vulnerable to an injected backd | |
|
80
|
CVE-2026-51380 |
9.8 | 0.0050 | NET NO AUTH LOW CX NO UI | Buffer Overflow vulnerability in Tenda AC10 v3 (firmware V03.03.16.09) allows at | |
|
79
|
CVE-2026-63106 |
9.3 | 0.0050 | NET NO AUTH LOW CX NO UI | ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerabil | |
|
79
|
CVE-2026-111693 |
9.3 | 0.0050 | NET NO AUTH LOW CX NO UI | DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vul | |
|
79
|
CVE-2026-75837 |
9.3 | 0.0049 | NET NO AUTH LOW CX NO UI | Grav before 2.0.14 fails to guard the access field in the core group blueprint w | |
|
78
|
CVE-2026-49759 |
8.8 | 0.0050 | NET NO AUTH LOW CX NO UI | Stack-based Buffer Overflow vulnerability in Erlang OTP erts (inet_drv) allows a | |
|
78
|
CVE-2026-55884 |
9.2 | 0.0050 | NET NO AUTH LOW CX NO UI | Tilt defines dev environments as code for microservice apps on Kubernetes. From | |
|
78
|
CVE-2026-57830 |
8.8 | 0.0050 | NET NO AUTH LOW CX NO UI | Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in H | |
|
78
|
CVE-2026-75856 |
9.2 | 0.0050 | NET NO AUTH LOW CX NO UI | CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerabil | |
|
78
|
CVE-2026-26232 |
9.1 | 0.0050 | NET NO AUTH LOW CX NO UI | Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization co | |
|
78
|
CVE-2026-26247 |
9.1 | 0.0050 | NET NO AUTH LOW CX NO UI | Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge metho | |
|
78
|
CVE-2026-13221 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 befo | |
|
78
|
CVE-2026-47040 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Net Services component of Oracle Database Server. S | |
|
78
|
CVE-2026-61130 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (compon | |
|
78
|
CVE-2026-61155 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search Platform Services product of | |
|
78
|
CVE-2026-60728 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware | |
|
78
|
CVE-2026-60754 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (compo | |
|
78
|
CVE-2026-70994 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
78
|
CVE-2026-70997 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
77
|
CVE-2026-6376 |
8.7 | 0.0050 | NET NO AUTH LOW CX NO UI | A weakness in SpiceJet’s public booking retrieval page permits full passenger bo | |
|
77
|
CVE-2026-102559 |
8.6 | 0.0050 | NET NO AUTH LOW CX NO UI | A flaw was found in libsoup. When constructing a masked WebSocket client frame f | |
|
77
|
CVE-2026-39313 |
8.7 | 0.0050 | NET NO AUTH LOW CX NO UI | mcp-framework is a framework for building Model Context Protocol (MCP) servers. | |
|
77
|
CVE-2024-58306 |
8.7 | 0.0049 | NET NO AUTH LOW CX NO UI | minaliC 2.0.0 contains a denial of service vulnerability that allows remote atta | |
|
76
|
CVE-2026-49982 |
8.2 | 0.0050 | NET NO AUTH LOW CX NO UI | tmp is a temporary file and directory creator for node.js. In version 0.2.6, the | |
|
75
|
CVE-2026-76290 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthentica | |
|
75
|
CVE-2026-54341 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | Dragonfly is an in-memory data store built for modern application workloads. Pri | |
|
75
|
CVE-2026-62918 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | Improper verification of cryptographic signature in Microsoft Teams allows an un | |
|
75
|
CVE-2026-118761 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | Kubeflow Pipelines enables users to build and deploy portable, scalable machine | |
|
74
|
CVE-2026-42404 |
7.2 | 0.0050 | NET NO AUTH LOW CX NO UI | Apache Neethi does not impose any restrictions on URIs when manually fetching re | |
|
69
|
CVE-2026-113014 |
9.6 | 0.0050 | NET NO AUTH LOW CX | Use after free in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowe | |
|
69
|
CVE-2026-113023 |
9.6 | 0.0050 | NET NO AUTH LOW CX | Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 | |
|
69
|
CVE-2026-113089 |
9.6 | 0.0050 | NET NO AUTH LOW CX | Improper input validation in PrintPreview in Google Chrome prior to 156.0.8078.4 | |
|
69
|
CVE-2026-113235 |
9.6 | 0.0050 | NET NO AUTH LOW CX | Improper input validation in Passwords in Google Chrome prior to 156.0.8078.47 a | |
|
69
|
CVE-2026-113252 |
9.6 | 0.0050 | NET NO AUTH LOW CX | Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0 | |
|
69
|
CVE-2026-113300 |
9.6 | 0.0050 | NET NO AUTH LOW CX | Out of bounds write in Forms in Google Chrome prior to 156.0.8078.47 allowed a r | |
|
69
|
CVE-2026-113328 |
9.6 | 0.0050 | NET NO AUTH LOW CX | Improper input validation in Privacy in Google Chrome prior to 156.0.8078.47 all | |
|
69
|
CVE-2026-113336 |
9.6 | 0.0050 | NET NO AUTH LOW CX | Memory corruption in Compositing in Google Chrome prior to 156.0.8078.47 allowed | |
|
68
|
CVE-2026-71281 |
8.8 | 0.0050 | NET NO AUTH LOW CX | Hugging Face peft's LoRA-GA and CorDA initialization modules (src/peft/tuners/lo | |
|
68
|
CVE-2026-65542 |
8.8 | 0.0050 | NET NO AUTH LOW CX | Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions. | |
|
68
|
CVE-2026-13967 |
8.8 | 0.0049 | NET NO AUTH LOW CX | Heap buffer overflow in V8 in Google Chrome prior to 150.0.7871.47 allowed a rem | |
|
67
|
CVE-2026-94422 |
8.7 | 0.0050 | NET NO AUTH LOW CX | An incorrect implementation of message filtering in xdg-dbus-proxy versions befo | |
|
67
|
CVE-2026-64835 |
8.7 | 0.0050 | NET NO AUTH LOW CX | FFmpeg versions 4.4 through 8.1.2 contain an out-of-bounds memory access vulnera | |
|
67
|
CVE-2026-45576 |
8.3 | 0.0050 | NET NO AUTH LOW CX | zrok is software for sharing web services, files, and network resources. From 0. | |
|
66
|
CVE-2026-97783 |
8.1 | 0.0050 | NET NO AUTH LOW CX | Improper neutralization of input during web page generation ('cross-site scripti | |
|
65
|
CVE-2026-117553 |
7.7 | 0.0050 | NET NO AUTH LOW CX | Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerabi | |
|
64
|
CVE-2025-71436 |
7.1 | 0.0050 | NET NO AUTH LOW CX | Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffe | |
|
55
|
CVE-2026-88083 |
7.5 | 0.0050 | NET NO AUTH | Stack-based buffer overflow in SQL Server allows an unauthorized attacker to exe | |
|
55
|
CVE-2026-69805 |
7.5 | 0.0050 | NET NO AUTH | External control of file name or path in .NET allows an unauthorized attacker to |