Hunt List
13,787 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-62001 |
9.8 | 0.0048 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions. | |
|
80
|
CVE-2026-69083 |
9.9 | 0.0047 | NET NO AUTH LOW CX NO UI | SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullT | |
|
80
|
CVE-2026-57433 |
9.8 | 0.0047 | NET NO AUTH LOW CX NO UI | Storable versions before 3.41 for Perl have a signed integer overflow when deser | |
|
80
|
CVE-2026-35307 |
10.0 | 0.0047 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (compo | |
|
80
|
CVE-2026-35308 |
10.0 | 0.0047 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (compo | |
|
80
|
CVE-2026-46803 |
10.0 | 0.0047 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware | |
|
80
|
CVE-2026-35304 |
9.8 | 0.0047 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (compo | |
|
80
|
CVE-2026-46845 |
9.8 | 0.0047 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware | |
|
80
|
CVE-2026-46884 |
9.8 | 0.0047 | NET NO AUTH LOW CX NO UI | Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (compo | |
|
80
|
CVE-2026-46887 |
9.8 | 0.0047 | NET NO AUTH LOW CX NO UI | Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (compo | |
|
80
|
CVE-2026-46889 |
9.8 | 0.0047 | NET NO AUTH LOW CX NO UI | Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (compo | |
|
80
|
CVE-2026-16184 |
9.8 | 0.0047 | NET NO AUTH LOW CX NO UI | IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to b | |
|
80
|
CVE-2026-76474 |
9.8 | 0.0047 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
79
|
CVE-2026-44643 |
9.3 | 0.0048 | NET NO AUTH LOW CX NO UI | Angular Expressions provides expressions for the Angular.JS web framework as a s | |
|
79
|
CVE-2026-47754 |
9.3 | 0.0047 | NET NO AUTH LOW CX NO UI | Metacat is data repository software that helps researchers preserve, share, and | |
|
78
|
CVE-2026-56266 |
9.2 | 0.0048 | NET NO AUTH LOW CX NO UI | Crawl4AI before 0.8.7 contains a server-side request forgery vulnerability in th | |
|
78
|
CVE-2017-20252 |
8.8 | 0.0048 | NET NO AUTH LOW CX NO UI | Joomla NextGen Editor 2.1.0 contains an SQL injection vulnerability that allows | |
|
78
|
CVE-2026-112896 |
8.8 | 0.0047 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can r | |
|
77
|
CVE-2026-52747 |
8.6 | 0.0048 | NET NO AUTH LOW CX NO UI | ModSecurity is an open source, cross platform web application firewall (WAF) eng | |
|
76
|
CVE-2026-72922 |
8.2 | 0.0048 | NET NO AUTH LOW CX NO UI | AutoGPT is a workflow automation platform for creating, deploying, and managing | |
|
76
|
CVE-2026-33946 |
8.2 | 0.0047 | NET NO AUTH LOW CX NO UI | MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and cli | |
|
76
|
CVE-2026-113351 |
8.2 | 0.0047 | NET NO AUTH LOW CX NO UI | libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because | |
|
75
|
CVE-2026-56150 |
7.5 | 0.0048 | NET NO AUTH LOW CX NO UI | Allocation of Resources Without Limits or Throttling (CWE-770) in Fleet Server c | |
|
75
|
CVE-2026-41084 |
7.5 | 0.0048 | NET NO AUTH LOW CX NO UI | A bug in Apache Airflow's bulk Task Instances API (`PATCH/DELETE /api/v2/dags/{d | |
|
75
|
CVE-2026-56852 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | A norm.Iter can enter an infinite loop when handling input containing invalid UT | |
|
75
|
CVE-2026-120194 |
7.5 | 0.0047 | NET NO AUTH LOW CX NO UI | A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_qu | |
|
69
|
CVE-2026-113186 |
9.6 | 0.0047 | NET NO AUTH LOW CX | Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowe | |
|
69
|
CVE-2026-113189 |
9.6 | 0.0047 | NET NO AUTH LOW CX | Improper input validation in Core in Google Chrome prior to 156.0.8078.47 allowe | |
|
69
|
CVE-2026-113261 |
9.6 | 0.0047 | NET NO AUTH LOW CX | Improper input validation in WebAppInstalls in Google Chrome prior to 156.0.8078 | |
|
69
|
CVE-2026-113270 |
9.6 | 0.0047 | NET NO AUTH LOW CX | Missing authorization in Internals in Google Chrome prior to 156.0.8078.47 allow | |
|
69
|
CVE-2026-113283 |
9.6 | 0.0047 | NET NO AUTH LOW CX | Improper privilege management in CredentialProvider in Google Chrome on on Windo | |
|
69
|
CVE-2026-113342 |
9.6 | 0.0047 | NET NO AUTH LOW CX | Privilege elevation in Network in Google Chrome prior to 156.0.8078.47 allowed a | |
|
68
|
CVE-2026-43632 |
9.2 | 0.0048 | NET NO AUTH NO UI | llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulner | |
|
68
|
CVE-2023-27309 |
8.8 | 0.0048 | NET LOW CX NO UI | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.2). | |
|
68
|
CVE-2026-24186 |
8.8 | 0.0048 | NET LOW CX NO UI | NVIDIA FLARE SDK contains a vulnerability in FOBS, where an attacker may cause | |
|
68
|
CVE-2026-7372 |
9.0 | 0.0047 | NET NO AUTH NO UI | A stack overflow vulnerability exists in the WebCam Server Login functionality o | |
|
68
|
CVE-2026-52811 |
9.0 | 0.0047 | NET LOW CX NO UI | Gogs is an open source self-hosted Git service. Prior to 0.14.3, (*Repository).U | |
|
68
|
CVE-2024-55579 |
8.8 | 0.0047 | NET NO AUTH LOW CX | An issue was discovered in Qlik Sense Enterprise for Windows before November 202 | |
|
67
|
CVE-2026-40040 |
8.7 | 0.0047 | NET LOW CX NO UI | Pachno 1.0.6 contains an unrestricted file upload vulnerability that allows auth | |
|
66
|
CVE-2026-79888 |
8.1 | 0.0048 | NET NO AUTH NO UI | A vulnerability in a certain web interface endpoint of AOS-8 devices could allow | |
|
66
|
CVE-2026-96228 |
8.1 | 0.0047 | NET NO AUTH NO UI | SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypa | |
|
65
|
CVE-2026-32271 |
7.7 | 0.0048 | NET LOW CX NO UI | Craft Commerce is an ecommerce platform for Craft CMS. In versions 4.0.0 through | |
|
65
|
CVE-2026-42011 |
7.4 | 0.0047 | NET NO AUTH NO UI | A flaw was found in gnutls. This vulnerability occurs because permitted name con | |
|
64
|
CVE-2026-6832 |
7.2 | 0.0047 | NET LOW CX NO UI | Hermes WebUI contains an arbitrary file deletion vulnerability in the /api/sessi | |
|
59
|
CVE-2026-88810 |
7.2 | 0.0048 | NET LOW CX NO UI | A privilege escalation issue was discovered in Rancher Manager's role-based acce | |
|
59
|
CVE-2026-66138 |
7.2 | 0.0047 | NET LOW CX NO UI | In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the | |
|
55
|
CVE-2026-72762 |
7.7 | 0.0048 | NET NO UI | n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file write | |
|
55
|
CVE-2026-78446 |
7.5 | 0.0048 | NET NO UI | Use after free in Windows Distributed File System (DFS) allows an authorized att | |
|
55
|
CVE-2026-114422 |
7.5 | 0.0047 | NET NO AUTH | The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the cla | |
|
52
|
CVE-2026-40171 |
8.4 | 0.0048 | NET LOW CX | In Jupyter Notebook versions 7.0.0 through 7.5.5, JupyterLab versions 4.5.6 and |