Hunt List
13,869 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-91299 |
10.0 | 0.0049 | NET NO AUTH LOW CX NO UI | Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD | |
|
79
|
CVE-2026-75837 |
9.3 | 0.0049 | NET NO AUTH LOW CX NO UI | Grav before 2.0.14 fails to guard the access field in the core group blueprint w | |
|
78
|
CVE-2026-13221 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 befo | |
|
78
|
CVE-2026-47040 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Net Services component of Oracle Database Server. S | |
|
78
|
CVE-2026-61130 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (compon | |
|
78
|
CVE-2026-61155 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search Platform Services product of | |
|
78
|
CVE-2026-60728 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware | |
|
78
|
CVE-2026-60754 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (compo | |
|
78
|
CVE-2026-70994 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
78
|
CVE-2026-70997 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
78
|
CVE-2026-45688 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | Rocket.Chat is an open-source, secure, fully customizable communications platfor | |
|
78
|
CVE-2026-48713 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missin | |
|
78
|
CVE-2026-48714 |
9.1 | 0.0049 | NET NO AUTH LOW CX NO UI | i18next-http-middleware is a middleware to be used with Node.js web frameworks l | |
|
78
|
CVE-2026-52868 |
8.8 | 0.0049 | NET NO AUTH LOW CX NO UI | An unauthenticated attacker can read worklist records from a directory outside t | |
|
78
|
CVE-2017-20266 |
8.8 | 0.0049 | NET NO AUTH LOW CX NO UI | Joomla SP Movie Database 1.3 contains an SQL injection vulnerability that allows | |
|
77
|
CVE-2024-58306 |
8.7 | 0.0049 | NET NO AUTH LOW CX NO UI | minaliC 2.0.0 contains a denial of service vulnerability that allows remote atta | |
|
77
|
CVE-2026-58469 |
8.7 | 0.0049 | NET NO AUTH LOW CX NO UI | GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underre | |
|
77
|
CVE-2026-59644 |
8.7 | 0.0049 | NET NO AUTH LOW CX NO UI | In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit | |
|
77
|
CVE-2026-12852 |
8.7 | 0.0049 | NET NO AUTH LOW CX NO UI | In Bouncy Castle for Java before 1.85, MLS wire decoder allocates attacker-decla | |
|
77
|
CVE-2026-116078 |
8.7 | 0.0049 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 | |
|
77
|
CVE-2026-88893 |
8.7 | 0.0049 | NET NO AUTH LOW CX NO UI | OpenPanel through 2.3.0 share lookup procedures fail to validate access controls | |
|
76
|
CVE-2026-113351 |
8.2 | 0.0049 | NET NO AUTH LOW CX NO UI | libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because | |
|
76
|
CVE-2026-116541 |
8.2 | 0.0049 | NET NO AUTH LOW CX NO UI | Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerabil | |
|
75
|
CVE-2026-54341 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | Dragonfly is an in-memory data store built for modern application workloads. Pri | |
|
75
|
CVE-2026-62918 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | Improper verification of cryptographic signature in Microsoft Teams allows an un | |
|
75
|
CVE-2026-114629 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Conten | |
|
75
|
CVE-2026-118761 |
7.5 | 0.0050 | NET NO AUTH LOW CX NO UI | Kubeflow Pipelines enables users to build and deploy portable, scalable machine | |
|
75
|
CVE-2026-10699 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | Missing release of memory after effective lifetime vulnerability in Progress MOV | |
|
75
|
CVE-2026-44436 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | Quicly is an IETF QUIC protocol implementation intended primarily for use within | |
|
75
|
CVE-2026-39769 |
7.5 | 0.0049 | NET NO AUTH LOW CX NO UI | Authentication Bypass Using an Alternate Path or Channel vulnerability in Iqonic | |
|
70
|
CVE-2026-50747 |
9.9 | 0.0049 | NET LOW CX NO UI | A malicious actor with access to the network and low privileges could exploit a | |
|
70
|
CVE-2026-5483 |
9.9 | 0.0049 | NET LOW CX NO UI | A flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in | |
|
68
|
CVE-2026-13967 |
8.8 | 0.0049 | NET NO AUTH LOW CX | Heap buffer overflow in V8 in Google Chrome prior to 150.0.7871.47 allowed a rem | |
|
68
|
CVE-2026-56841 |
8.8 | 0.0049 | NET LOW CX NO UI | A malicious actor with access to the network and low privileges could exploit an | |
|
68
|
CVE-2026-31706 |
8.8 | 0.0049 | NET LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ksmbd: vali | |
|
67
|
CVE-2026-114083 |
8.6 | 0.0050 | NET LOW CX NO UI | Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api | |
|
67
|
CVE-2026-116811 |
8.7 | 0.0049 | NET LOW CX NO UI | OpenPanel before 3.0.0 contains a sandbox escape vulnerability in the js-runtime | |
|
67
|
CVE-2026-59833 |
8.6 | 0.0049 | NET NO AUTH LOW CX | SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, S | |
|
67
|
CVE-2026-73696 |
8.6 | 0.0049 | NET LOW CX NO UI | Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after | |
|
67
|
CVE-2026-50107 |
8.6 | 0.0049 | NET LOW CX NO UI | When NGINX Plus or NGINX Open Source is configured as the data plane for NGINX G | |
|
66
|
CVE-2026-52707 |
8.1 | 0.0049 | NET NO AUTH NO UI | Unauthenticated Local File Inclusion in Kastell <= 2.0 versions. | |
|
66
|
CVE-2026-54591 |
8.1 | 0.0049 | NET NO AUTH LOW CX | AsyncSSH is a Python package which provides an asynchronous client and server im | |
|
66
|
CVE-2026-72903 |
8.1 | 0.0049 | NET NO AUTH LOW CX | Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1 | |
|
65
|
CVE-2026-117553 |
7.7 | 0.0050 | NET NO AUTH LOW CX | Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerabi | |
|
65
|
CVE-2026-105945 |
7.7 | 0.0049 | NET LOW CX NO UI | The Pulsar Packages Management Service can be configured to store packages on th | |
|
64
|
CVE-2026-56394 |
7.1 | 0.0049 | NET LOW CX NO UI | Craft CMS from 4.0.0-RC1 contains an authenticated path traversal vulnerability | |
|
63
|
CVE-2026-50189 |
8.9 | 0.0049 | NET LOW CX NO UI | Appsmith is a platform to build admin panels, internal tools, and dashboards. Pr | |
|
62
|
CVE-2026-12004 |
8.7 | 0.0049 | NET LOW CX NO UI | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access | |
|
57
|
CVE-2026-53413 |
8.3 | 0.0049 | NET NO AUTH | Missing bounds check in the annotator function of Zoom Clients allows buffer ove | |
|
57
|
CVE-2026-53415 |
8.3 | 0.0049 | NET NO AUTH | Use after Free in the annotator function of Zoom Clients may allow a meeting par |