Hunt List
8,554 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-42072 |
9.8 | 0.0044 | NET NO AUTH LOW CX NO UI | Nornicdb is a distributed low-latency, Graph+Vector, Temporal MVCC with all sub- | |
|
80
|
CVE-2026-112832 |
9.8 | 0.0044 | NET NO AUTH LOW CX NO UI | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP | |
|
80
|
CVE-2026-87337 |
10.0 | 0.0044 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware ( | |
|
80
|
CVE-2026-6510 |
9.8 | 0.0044 | NET NO AUTH LOW CX NO UI | The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation vi | |
|
80
|
CVE-2026-41070 |
10.0 | 0.0044 | NET NO AUTH LOW CX NO UI | openvpn-auth-oauth2 is a plugin/management interface client for OpenVPN server t | |
|
79
|
CVE-2026-109566 |
9.3 | 0.0044 | NET NO AUTH LOW CX NO UI | Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerabi | |
|
78
|
CVE-2026-18753 |
9.1 | 0.0044 | NET NO AUTH LOW CX NO UI | The product firmware contains an embedded, static RSA private key utilized by th | |
|
78
|
CVE-2026-18754 |
9.1 | 0.0044 | NET NO AUTH LOW CX NO UI | The product firmware contains an embedded, static RSA private key utilized by th | |
|
78
|
CVE-2026-71238 |
9.1 | 0.0044 | NET NO AUTH LOW CX NO UI | DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed w | |
|
78
|
CVE-2026-94423 |
9.1 | 0.0044 | NET NO AUTH LOW CX NO UI | Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server | |
|
78
|
CVE-2026-111633 |
8.8 | 0.0044 | NET NO AUTH LOW CX NO UI | ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows | |
|
77
|
CVE-2026-16731 |
8.3 | 0.0044 | NET NO AUTH LOW CX NO UI | OMICRON StationScout before version 3.05 contains a cryptographic timing side-ch | |
|
77
|
CVE-2026-18697 |
8.7 | 0.0044 | NET NO AUTH LOW CX NO UI | An issue in MongoDB Server's aggregation framework could allow an unauthenticate | |
|
77
|
CVE-2026-115352 |
8.7 | 0.0044 | NET NO AUTH LOW CX NO UI | Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inl | |
|
77
|
CVE-2026-76490 |
8.6 | 0.0044 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
77
|
CVE-2026-0621 |
8.7 | 0.0044 | NET NO AUTH LOW CX NO UI | Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a reg | |
|
77
|
CVE-2026-115348 |
8.7 | 0.0044 | NET NO AUTH LOW CX NO UI | Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability | |
|
77
|
CVE-2026-101688 |
8.6 | 0.0044 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of O | |
|
76
|
CVE-2026-8726 |
8.2 | 0.0044 | NET NO AUTH LOW CX NO UI | The extension fails to properly sanitize user input before using it in a databas | |
|
76
|
CVE-2026-21579 |
8.2 | 0.0044 | NET NO AUTH LOW CX NO UI | This High severity Information Disclosure vulnerability was introduced in versio | |
|
76
|
CVE-2026-12722 |
8.2 | 0.0044 | NET NO AUTH LOW CX NO UI | Missing authentication for critical function vulnerability in FTC Software IT Se | |
|
75
|
CVE-2026-0669 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v | |
|
75
|
CVE-2026-45047 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | bird-lg-go is a BIRD looking glass in Go. Prior to 1.4.5, the apiHandler (and si | |
|
75
|
CVE-2026-12707 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | Summary Cloudflare quiche was discovered to be vulnerable to memory resource | |
|
75
|
CVE-2026-87369 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (com | |
|
75
|
CVE-2026-87395 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl | |
|
75
|
CVE-2026-91254 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel | |
|
75
|
CVE-2026-91255 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel | |
|
75
|
CVE-2026-91344 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl | |
|
75
|
CVE-2026-91345 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl | |
|
75
|
CVE-2026-91350 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl | |
|
75
|
CVE-2025-66735 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | youlai-boot V2.21.1 is vulnerable to Incorrect Access Control. The getRoleForm f | |
|
75
|
CVE-2026-28943 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | A logging issue was addressed with improved data redaction. This issue is fixed | |
|
75
|
CVE-2026-28987 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | A logging issue was addressed with improved data redaction. This issue is fixed | |
|
75
|
CVE-2026-8396 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | Improper restriction of XML external entity reference vulnerability in Netcad So | |
|
75
|
CVE-2026-6554 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a sig | |
|
75
|
CVE-2026-20236 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
75
|
CVE-2026-20356 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
75
|
CVE-2026-114144 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.par | |
|
75
|
CVE-2026-16374 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | Information disclosure in the Framework component in DevTools. This vulnerabilit | |
|
75
|
CVE-2026-16391 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | Information disclosure in the Storage: IndexedDB component. This vulnerability w | |
|
75
|
CVE-2026-16405 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | Information disclosure in the Networking: WebSockets component. This vulnerabili | |
|
75
|
CVE-2026-14861 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | The User Verification by PickPlugins WordPress plugin through 2.0.47 does not ve | |
|
66
|
CVE-2026-54409 |
8.1 | 0.0044 | NET NO AUTH NO UI | A malicious actor with access to the network and under certain conditions could | |
|
66
|
CVE-2026-103898 |
8.1 | 0.0044 | NET NO AUTH NO UI | The Wp Social Login and Register Social Counter plugin for WordPress is vulnerab | |
|
66
|
CVE-2026-112820 |
8.1 | 0.0044 | NET NO AUTH NO UI | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP | |
|
64
|
CVE-2026-49253 |
7.1 | 0.0044 | NET NO AUTH LOW CX | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ft | |
|
57
|
CVE-2026-79881 |
8.3 | 0.0044 | NET NO AUTH | An authentication bypass vulnerability in the underlying operating system of AOS | |
|
55
|
CVE-2026-62999 |
7.5 | 0.0044 | NET NO AUTH | Copier is a library and CLI app for rendering project templates. From 9.5.0 thro | |
|
55
|
CVE-2026-35465 |
7.5 | 0.0044 | NET NO AUTH | SecureDrop Client is a desktop app for journalists to securely communicate with |