Hunt List
13,998 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
90
|
CVE-2026-103039 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | 1 PoC | The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in |
|
80
|
CVE-2026-62614 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middlewar | |
|
80
|
CVE-2026-62617 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middlewar | |
|
80
|
CVE-2026-62621 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middlewar | |
|
80
|
CVE-2026-62622 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middlewar | |
|
80
|
CVE-2026-62624 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middlewar | |
|
80
|
CVE-2026-62626 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middlewar | |
|
80
|
CVE-2026-62630 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middlewar | |
|
80
|
CVE-2026-62632 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middlewar | |
|
80
|
CVE-2026-62633 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middlewar | |
|
80
|
CVE-2026-62634 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middlewar | |
|
80
|
CVE-2026-62635 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middlewar | |
|
80
|
CVE-2026-62639 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middlewar | |
|
80
|
CVE-2026-62640 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middlewar | |
|
80
|
CVE-2026-70669 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middlewar | |
|
80
|
CVE-2026-70689 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in Oracle Essbase (component: Infrastructure). The supported ver | |
|
80
|
CVE-2026-70739 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyper | |
|
80
|
CVE-2026-70740 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyper | |
|
80
|
CVE-2026-70745 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyper | |
|
80
|
CVE-2026-70817 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype | |
|
80
|
CVE-2026-70871 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora | |
|
80
|
CVE-2026-70873 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hyperion Data Relationship Management product of Ora | |
|
80
|
CVE-2026-70905 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware ( | |
|
80
|
CVE-2026-70926 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (compone | |
|
80
|
CVE-2026-70953 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (compon | |
|
80
|
CVE-2026-70954 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (compon | |
|
80
|
CVE-2026-70970 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware | |
|
80
|
CVE-2026-70995 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
80
|
CVE-2026-71074 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
80
|
CVE-2026-71152 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
80
|
CVE-2026-71164 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
80
|
CVE-2026-73905 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
80
|
CVE-2026-73912 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
80
|
CVE-2026-73921 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imp | |
|
80
|
CVE-2026-83232 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware | |
|
80
|
CVE-2026-9074 |
9.8 | 0.0051 | NET NO AUTH LOW CX NO UI | IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains | |
|
79
|
CVE-2026-72742 |
9.2 | 0.0051 | NET NO AUTH LOW CX NO UI | DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio o | |
|
78
|
CVE-2026-110685 |
9.1 | 0.0051 | NET NO AUTH LOW CX NO UI | Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a t | |
|
78
|
CVE-2026-33654 |
8.9 | 0.0051 | NET NO AUTH LOW CX NO UI | nanobot is a personal AI assistant. Prior to version 0.1.6, an indirect prompt i | |
|
75
|
CVE-2026-34652 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2 | |
|
75
|
CVE-2026-11625 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | Bytes::Random::Secure versions through 0.29 for Perl share internal state across | |
|
75
|
CVE-2026-11702 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state | |
|
75
|
CVE-2026-14570 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private | |
|
75
|
CVE-2026-34501 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redi | |
|
75
|
CVE-2026-34502 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memc | |
|
75
|
CVE-2026-75589 |
7.5 | 0.0051 | NET NO AUTH LOW CX NO UI | Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINT | |
|
68
|
CVE-2026-62190 |
8.7 | 0.0051 | NET LOW CX NO UI | OpenClaw versions before 2026.6.9 contain an authorization bypass vulnerability | |
|
68
|
CVE-2026-67343 |
8.7 | 0.0051 | NET LOW CX NO UI | ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the | |
|
66
|
CVE-2026-50738 |
7.7 | 0.0051 | NET LOW CX NO UI | A use-after-free condition exists in pglogical's worker signaling code, where a | |
|
55
|
CVE-2026-53599 |
7.5 | 0.0051 | NET NO UI | REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_m |