Hunt List
8,540 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
79
|
CVE-2026-61186 |
9.4 | 0.0041 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Agile Engineering Data Management product of Oracle | |
|
79
|
CVE-2026-62629 |
9.4 | 0.0041 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middlewar | |
|
78
|
CVE-2026-35615 |
9.2 | 0.0042 | NET NO AUTH LOW CX NO UI | PraisonAI is a multi-agent teams system. Prior to 1.5.113, _validate_path() call | |
|
78
|
CVE-2026-28698 |
9.2 | 0.0042 | NET NO AUTH LOW CX NO UI | Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive sys | |
|
78
|
CVE-2026-87302 |
9.1 | 0.0042 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware | |
|
78
|
CVE-2026-91225 |
9.1 | 0.0042 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo | |
|
78
|
CVE-2026-59702 |
9.2 | 0.0041 | NET NO AUTH LOW CX NO UI | repomix contains a server-side request forgery vulnerability in the POST /api/pa | |
|
77
|
CVE-2026-59499 |
8.6 | 0.0042 | NET NO AUTH LOW CX NO UI | : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pr | |
|
77
|
CVE-2026-110938 |
8.7 | 0.0042 | NET NO AUTH LOW CX NO UI | In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable t | |
|
76
|
CVE-2026-35149 |
8.2 | 0.0042 | NET NO AUTH LOW CX NO UI | HCL DFXServer is affected by an Authentication Bypass vulnerability via server r | |
|
76
|
CVE-2026-34578 |
8.2 | 0.0042 | NET NO AUTH LOW CX NO UI | OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.6, OPNs | |
|
75
|
CVE-2026-54841 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in Vitepos <= 3.4.2 versions. | |
|
75
|
CVE-2026-57912 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Johnson & Johnson Campus Recruiting before 2025-10-31 allows viewing of data pro | |
|
75
|
CVE-2026-57913 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Johnson & Johnson Audit Tracking Management System (ATMS) before 2026-04-21 allo | |
|
75
|
CVE-2026-54824 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in Ads by WPQuads <= 3.0.3 versions. | |
|
75
|
CVE-2026-54834 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in Object Cache 4 everyone <= 2.3.2 vers | |
|
75
|
CVE-2026-56060 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in Print Invoice & Delivery Notes for Wo | |
|
75
|
CVE-2026-10706 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | In Adalo’s no-code app builder, (Versions 1 and 2) the attackers may extract ful | |
|
75
|
CVE-2026-7189 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Insertion of sensitive information into sent data vulnerability in Proliz Softwa | |
|
75
|
CVE-2026-7488 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Insertion of sensitive information into sent data vulnerability in IKAS Technolo | |
|
75
|
CVE-2026-65430 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Joomla Extension - regularlabs.com - MaxMind Credential leakage in GeoIP extensi | |
|
75
|
CVE-2026-65755 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Artic | |
|
75
|
CVE-2026-59528 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates <= 1.1 | |
|
75
|
CVE-2026-59548 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in Byteflows Travel & Hotel Booking | |
|
75
|
CVE-2026-65881 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Joomla Extension - joomdle.com - Insecure default configuration allows read/writ | |
|
75
|
CVE-2026-65543 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions. | |
|
75
|
CVE-2026-66432 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Subscriber Sensitive Data Exposure in WPJAM Basic <= 7.0.2.1 versions. | |
|
75
|
CVE-2026-66462 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in WooCommerce Appointments <= 5.3.8 ver | |
|
75
|
CVE-2026-66463 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in iCARRY <= 2.9 versions. | |
|
75
|
CVE-2026-32468 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway <= 2.11.14 ver | |
|
75
|
CVE-2026-66585 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in WP Cafe Pro < 3.0.15 versions. | |
|
75
|
CVE-2026-91608 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: | |
|
75
|
CVE-2026-108086 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | ** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity referen | |
|
75
|
CVE-2024-51316 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | The Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerability in the | |
|
75
|
CVE-2026-119187 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Forge (also called node-forge) is a native implementation of Transport Layer Sec | |
|
69
|
CVE-2026-46789 |
9.6 | 0.0042 | NET NO AUTH LOW CX | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
69
|
CVE-2026-70958 |
9.6 | 0.0042 | NET NO AUTH LOW CX | Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle | |
|
69
|
CVE-2026-8152 |
9.3 | 0.0041 | NET NO AUTH LOW CX | Unblu Spark contains an open redirect vulnerability that can be escalated to a D | |
|
68
|
CVE-2026-26178 |
8.8 | 0.0042 | NET NO AUTH LOW CX | Integer size truncation in Windows Advanced Rasterization Platform (WARP) allows | |
|
68
|
CVE-2026-60651 |
8.8 | 0.0042 | NET NO AUTH LOW CX | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
68
|
CVE-2026-60967 |
8.8 | 0.0042 | NET NO AUTH LOW CX | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS | |
|
68
|
CVE-2026-62619 |
8.8 | 0.0042 | NET NO AUTH LOW CX | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middlewar | |
|
68
|
CVE-2026-71106 |
8.8 | 0.0042 | NET NO AUTH LOW CX | Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Ora | |
|
68
|
CVE-2026-113276 |
8.8 | 0.0042 | NET NO AUTH LOW CX | Memory corruption in Passwords in Google Chrome on on Android prior to 156.0.807 | |
|
68
|
CVE-2026-16379 |
8.8 | 0.0042 | NET NO AUTH LOW CX | Privilege escalation in the DOM: Content Processes component. This vulnerability | |
|
66
|
CVE-2026-35276 |
8.1 | 0.0042 | NET NO AUTH NO UI | Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle Peop | |
|
66
|
CVE-2026-101672 |
8.1 | 0.0042 | NET NO AUTH NO UI | Vulnerability in the Oracle Call Center Technology product of Oracle E-Business | |
|
66
|
CVE-2026-101700 |
8.1 | 0.0042 | NET NO AUTH NO UI | Vulnerability in the Oracle Application Object Library product of Oracle E-Busin | |
|
65
|
CVE-2026-10652 |
7.4 | 0.0042 | NET NO AUTH NO UI | Zephyr's DNS resolver (subsys/net/lib/dns) parses resource records from DNS resp | |
|
64
|
CVE-2026-63387 |
7.0 | 0.0042 | NET NO AUTH NO UI | Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libe |