Hunt List
8,546 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-102560 |
9.8 | 0.0042 | NET NO AUTH LOW CX NO UI | A flaw was found in libsoup. When the permessage-deflate WebSocket extension com | |
|
80
|
CVE-2026-62006 |
9.8 | 0.0042 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Nuts <= 1.12 versions. | |
|
80
|
CVE-2026-62008 |
9.8 | 0.0042 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions. | |
|
80
|
CVE-2026-62012 |
9.8 | 0.0042 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions. | |
|
80
|
CVE-2026-62017 |
9.8 | 0.0042 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions. | |
|
79
|
CVE-2026-112296 |
9.3 | 0.0042 | NET NO AUTH LOW CX NO UI | FlyCms through commit edfdf724 contains a default credentials vulnerability that | |
|
78
|
CVE-2026-71277 |
9.1 | 0.0042 | NET NO AUTH LOW CX NO UI | rust-iot-platform's AuthToken request-guard implementation (api/src/main.rs) onl | |
|
78
|
CVE-2026-101590 |
9.1 | 0.0042 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: hel | |
|
78
|
CVE-2026-91265 |
9.1 | 0.0042 | NET NO AUTH LOW CX NO UI | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards | |
|
78
|
CVE-2026-91305 |
9.1 | 0.0042 | NET NO AUTH LOW CX NO UI | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards | |
|
78
|
CVE-2026-114607 |
9.1 | 0.0042 | NET NO AUTH LOW CX NO UI | Better Auth is an authentication and authorization library for TypeScript. From | |
|
78
|
CVE-2026-112709 |
9.2 | 0.0042 | NET NO AUTH LOW CX NO UI | A heap-based buffer overflow vulnerability in the Fireware OS authentication ser | |
|
78
|
CVE-2026-112710 |
9.2 | 0.0042 | NET NO AUTH LOW CX NO UI | A heap-based buffer overflow vulnerability exists in the Fireware OS authenticat | |
|
78
|
CVE-2026-64829 |
9.1 | 0.0042 | NET NO AUTH LOW CX NO UI | Question2Answer through 1.8.8 contains a session invalidation vulnerability that | |
|
77
|
CVE-2026-114055 |
8.7 | 0.0042 | NET NO AUTH LOW CX NO UI | vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vuln | |
|
77
|
CVE-2026-58075 |
8.7 | 0.0042 | NET NO AUTH LOW CX NO UI | A vulnerability allowing an unauthenticated attacker to read arbitrary files fro | |
|
77
|
CVE-2026-57960 |
8.3 | 0.0042 | NET NO AUTH LOW CX NO UI | Hi.Events through 1.9.0 public check-in list endpoints use short_id as sole acce | |
|
77
|
CVE-2026-62927 |
8.7 | 0.0042 | NET NO AUTH LOW CX NO UI | In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the or | |
|
77
|
CVE-2026-102559 |
8.6 | 0.0042 | NET NO AUTH LOW CX NO UI | A flaw was found in libsoup. When constructing a masked WebSocket client frame f | |
|
77
|
CVE-2026-115723 |
8.3 | 0.0042 | NET NO AUTH LOW CX NO UI | Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive | |
|
76
|
CVE-2026-54890 |
8.2 | 0.0042 | NET NO AUTH LOW CX NO UI | Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (e | |
|
76
|
CVE-2026-40193 |
8.2 | 0.0042 | NET NO AUTH LOW CX NO UI | maddy is a composable, all-in-one mail server. Versions prior to 0.9.3 contain a | |
|
76
|
CVE-2026-58071 |
8.2 | 0.0042 | NET NO AUTH LOW CX NO UI | A vulnerability in Veeam Service Provider Console allowing an unauthenticated at | |
|
76
|
CVE-2026-40892 |
8.1 | 0.0042 | NET NO AUTH LOW CX NO UI | PJSIP is a free and open source multimedia communication library written in C. I | |
|
76
|
CVE-2026-17544 |
8.1 | 0.0042 | NET NO AUTH LOW CX NO UI | Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with s | |
|
76
|
CVE-2026-16315 |
8.1 | 0.0042 | NET NO AUTH LOW CX NO UI | OMICRON StationGuard before version 4.10 contains a cryptographic timing side-ch | |
|
75
|
CVE-2026-106565 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | ImageMagick is free and open-source software used for editing and manipulating d | |
|
75
|
CVE-2026-106567 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | ImageMagick is free and open-source software used for editing and manipulating d | |
|
75
|
CVE-2026-101759 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Communications Billing and Revenue Management produc | |
|
75
|
CVE-2026-86415 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | libcurl's connection cache match function never considers the automatic client c | |
|
75
|
CVE-2026-42285 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go P | |
|
75
|
CVE-2026-54060 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.co | |
|
75
|
CVE-2026-5730 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Authorization bypass through User-Controlled key vulnerability in Idvlabs Softwa | |
|
75
|
CVE-2026-5799 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Authorization bypass through User-Controlled key vulnerability in Idvlabs Softwa | |
|
75
|
CVE-2026-14165 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | An Authorization Bypass Through User-Controlled Key vulnerability affecting Tule | |
|
75
|
CVE-2026-82231 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | A Thrift client in Apache bRPC (version < 1.18.0, built with WITH_THRIFT which i | |
|
74
|
CVE-2026-96767 |
7.2 | 0.0042 | NET NO AUTH LOW CX NO UI | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vuln | |
|
69
|
CVE-2026-40088 |
9.6 | 0.0042 | NET NO AUTH LOW CX | PraisonAI is a multi-agent teams system. Prior to 4.5.121, the execute_command f | |
|
68
|
CVE-2026-40873 |
8.9 | 0.0042 | NET NO AUTH LOW CX | mailcow: dockerized is an open source groupware/email suite based on docker. In | |
|
68
|
CVE-2026-113076 |
8.8 | 0.0042 | NET NO AUTH LOW CX | Use after free in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 | |
|
68
|
CVE-2026-63685 |
8.8 | 0.0042 | NET NO AUTH LOW CX | Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extensi | |
|
68
|
CVE-2026-15767 |
8.8 | 0.0042 | NET NO AUTH LOW CX | Heap buffer overflow in libyuv in Google Chrome on Windows prior to 150.0.7871.1 | |
|
66
|
CVE-2026-115546 |
8.1 | 0.0042 | NET NO AUTH NO UI | Okta Access Gateway (OAG) does not validate the selected authentication source d | |
|
66
|
CVE-2026-58282 |
8.1 | 0.0042 | NET NO AUTH NO UI | Improper access control in Microsoft Edge (Chromium-based) allows an unauthorize | |
|
66
|
CVE-2026-58286 |
8.1 | 0.0042 | NET NO AUTH NO UI | Improper access control in Microsoft Edge (Chromium-based) allows an unauthorize | |
|
66
|
CVE-2026-44019 |
8.1 | 0.0042 | NET NO AUTH LOW CX | Docling Core defines core data types and transformations for the document proces | |
|
66
|
CVE-2026-10653 |
8.1 | 0.0042 | NET NO AUTH NO UI | The Zephyr net_buf library (lib/net_buf/buf.c) manipulated both of its reference | |
|
65
|
CVE-2026-47829 |
7.7 | 0.0042 | NET NO AUTH LOW CX | Argument Injection in bosh-cli allows a compromised BOSH Director to inject arbi | |
|
65
|
CVE-2026-58169 |
7.7 | 0.0042 | NET NO AUTH LOW CX | Vibe-Trading before 0.1.10 contains a DNS rebinding authentication bypass vulner | |
|
55
|
CVE-2026-28039 |
7.5 | 0.0042 | NET NO AUTH | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP |