Hunt List
8,594 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2025-58627 |
9.8 | 0.0045 | NET NO AUTH LOW CX NO UI | Authorization Bypass Through User-Controlled Key vulnerability in kamleshyadav M | |
|
80
|
CVE-2026-8721 |
9.8 | 0.0045 | NET NO AUTH LOW CX NO UI | Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with e | |
|
80
|
CVE-2026-11362 |
9.8 | 0.0045 | NET NO AUTH LOW CX NO UI | DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from e | |
|
80
|
CVE-2025-61165 |
9.8 | 0.0045 | NET NO AUTH LOW CX NO UI | An arbitrary file upload vulnerability in the /v1/my_drive/batch_upload componen | |
|
80
|
CVE-2026-78846 |
9.8 | 0.0045 | NET NO AUTH LOW CX NO UI | Multiple AiDot devices are vulnerable to a heap-based buffer overflow via SSDP l | |
|
80
|
CVE-2026-61424 |
10.0 | 0.0044 | NET NO AUTH LOW CX NO UI | Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in | |
|
79
|
CVE-2026-25660 |
9.3 | 0.0045 | NET NO AUTH LOW CX NO UI | CodeChecker is an analyzer tooling, defect database and viewer extension for the | |
|
79
|
CVE-2026-76311 |
9.4 | 0.0045 | NET NO AUTH LOW CX NO UI | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unaut | |
|
78
|
CVE-2026-46858 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Vulnerability in the APM - Application Performance Management product of Oracle | |
|
78
|
CVE-2026-60168 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beve | |
|
78
|
CVE-2026-60591 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beve | |
|
78
|
CVE-2026-62638 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middlewar | |
|
78
|
CVE-2026-70854 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype | |
|
78
|
CVE-2026-70976 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
78
|
CVE-2026-70977 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
78
|
CVE-2026-70979 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
78
|
CVE-2026-70981 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
78
|
CVE-2026-70984 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
78
|
CVE-2026-71102 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Vulnerability in the Portable Clusterware component of Oracle Database Server. | |
|
78
|
CVE-2026-20702 |
8.9 | 0.0045 | NET NO AUTH LOW CX NO UI | Protection mechanism failure for some Intel(R) Data Center Attestation Primitive | |
|
78
|
CVE-2026-62415 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Joomla Extension - joomdonation.com - Insecure default configuration Membership | |
|
78
|
CVE-2026-42278 |
8.8 | 0.0045 | NET NO AUTH LOW CX NO UI | UltraDAG is a minimal DAG-BFT blockchain in Rust. Prior to commit fb6ef59, the U | |
|
77
|
CVE-2026-32834 |
8.7 | 0.0045 | NET NO AUTH LOW CX NO UI | Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains a | |
|
77
|
CVE-2023-54402 |
8.7 | 0.0045 | NET NO AUTH LOW CX NO UI | iDocView contains a server-side request forgery vulnerability in its /doc/upload | |
|
77
|
CVE-2026-4436 |
8.6 | 0.0045 | NET NO AUTH LOW CX NO UI | A low-privileged remote attacker can send Modbus packets to manipulate register | |
|
77
|
CVE-2026-54603 |
8.6 | 0.0045 | NET NO AUTH LOW CX NO UI | OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, inc | |
|
77
|
CVE-2026-61576 |
8.3 | 0.0045 | NET NO AUTH LOW CX NO UI | Lightdash is an open source business intelligence platform. In affected versions | |
|
77
|
CVE-2026-58067 |
8.7 | 0.0045 | NET NO AUTH LOW CX NO UI | A vulnerability in Veeam Service Provider Console allowing an unauthenticated at | |
|
77
|
CVE-2019-25779 |
8.7 | 0.0045 | NET NO AUTH LOW CX NO UI | WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows u | |
|
77
|
CVE-2026-67427 |
8.6 | 0.0045 | NET NO AUTH LOW CX NO UI | Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior | |
|
75
|
CVE-2026-47204 |
7.5 | 0.0045 | NET NO AUTH LOW CX NO UI | Envoy is an open source edge and service proxy designed for cloud-native applica | |
|
75
|
CVE-2026-19630 |
7.5 | 0.0045 | NET NO AUTH LOW CX NO UI | In a BIND resolver, inbound DNS protocol messages with a particular structure wi | |
|
75
|
CVE-2026-97313 |
7.5 | 0.0045 | NET NO AUTH LOW CX NO UI | A recursive BIND server that receives a query with recursion desired (RD=1) foll | |
|
75
|
CVE-2026-33521 |
7.5 | 0.0045 | NET NO AUTH LOW CX NO UI | There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 a | |
|
75
|
CVE-2026-33750 |
7.5 | 0.0045 | NET NO AUTH LOW CX NO UI | The brace-expansion library generates arbitrary strings containing a common pref | |
|
75
|
CVE-2026-34487 |
7.5 | 0.0045 | NET NO AUTH LOW CX NO UI | Insertion of Sensitive Information into Log File vulnerability in the cloud memb | |
|
75
|
CVE-2026-6659 |
7.5 | 0.0045 | NET NO AUTH LOW CX NO UI | Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values | |
|
75
|
CVE-2026-50196 |
7.5 | 0.0045 | NET NO AUTH LOW CX NO UI | Steeltoe is an open source project that provides a collection of libraries that | |
|
75
|
CVE-2026-115482 |
7.5 | 0.0045 | NET NO AUTH LOW CX NO UI | In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of | |
|
69
|
CVE-2026-53943 |
9.6 | 0.0045 | NET NO AUTH LOW CX | Ghost is a Node.js content management system. From until 6.37.0, when Ghost is | |
|
68
|
CVE-2026-113101 |
8.8 | 0.0045 | NET NO AUTH LOW CX | Use after free in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed | |
|
68
|
CVE-2026-17712 |
8.8 | 0.0045 | NET NO AUTH LOW CX | Race in Skia in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote att | |
|
67
|
CVE-2026-75912 |
8.3 | 0.0045 | NET NO AUTH LOW CX | CodeWhale versions before 0.8.64 contain an argument injection vulnerability in | |
|
65
|
CVE-2026-47164 |
7.7 | 0.0045 | NET NO AUTH NO UI | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, V | |
|
65
|
CVE-2024-1249 |
7.4 | 0.0045 | NET NO AUTH LOW CX | A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which a | |
|
65
|
CVE-2026-10646 |
7.4 | 0.0045 | NET NO AUTH NO UI | Zephyr's BSD-sockets getaddrinfo() implementation (subsys/net/lib/sockets/getadd | |
|
65
|
CVE-2026-13341 |
7.4 | 0.0045 | NET NO AUTH LOW CX | A vulnerability exists in the Kong Konnect Model Context Protocol (MCP) server p | |
|
64
|
CVE-2026-98169 |
7.1 | 0.0045 | NET NO AUTH LOW CX | In the Linux kernel, the following vulnerability has been resolved: smb: client | |
|
64
|
CVE-2026-8919 |
7.2 | 0.0045 | NET NO AUTH LOW CX | Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK a | |
|
64
|
CVE-2026-64816 |
7.1 | 0.0045 | NET NO AUTH LOW CX | RapidRAW before 1.6.0 does not validate the lutPath field in preset files before |