Hunt List
13,324 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2025-58627 |
9.8 | 0.0045 | NET NO AUTH LOW CX NO UI | Authorization Bypass Through User-Controlled Key vulnerability in kamleshyadav M | |
|
80
|
CVE-2026-8721 |
9.8 | 0.0045 | NET NO AUTH LOW CX NO UI | Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with e | |
|
80
|
CVE-2026-11362 |
9.8 | 0.0045 | NET NO AUTH LOW CX NO UI | DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from e | |
|
80
|
CVE-2025-61165 |
9.8 | 0.0045 | NET NO AUTH LOW CX NO UI | An arbitrary file upload vulnerability in the /v1/my_drive/batch_upload componen | |
|
79
|
CVE-2026-25660 |
9.3 | 0.0045 | NET NO AUTH LOW CX NO UI | CodeChecker is an analyzer tooling, defect database and viewer extension for the | |
|
78
|
CVE-2026-46858 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Vulnerability in the APM - Application Performance Management product of Oracle | |
|
78
|
CVE-2026-60168 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beve | |
|
78
|
CVE-2026-60591 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beve | |
|
78
|
CVE-2026-62638 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middlewar | |
|
78
|
CVE-2026-70854 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hype | |
|
78
|
CVE-2026-70976 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
78
|
CVE-2026-70977 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
78
|
CVE-2026-70979 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
78
|
CVE-2026-70981 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
78
|
CVE-2026-70984 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
78
|
CVE-2026-71102 |
9.1 | 0.0045 | NET NO AUTH LOW CX NO UI | Vulnerability in the Portable Clusterware component of Oracle Database Server. | |
|
77
|
CVE-2026-32834 |
8.7 | 0.0045 | NET NO AUTH LOW CX NO UI | Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains a | |
|
77
|
CVE-2026-115506 |
8.7 | 0.0045 | NET NO AUTH LOW CX NO UI | libexpat through 2.9.0 contains a denial of service vulnerability because billio | |
|
77
|
CVE-2023-54402 |
8.7 | 0.0045 | NET NO AUTH LOW CX NO UI | iDocView contains a server-side request forgery vulnerability in its /doc/upload | |
|
77
|
CVE-2026-4436 |
8.6 | 0.0045 | NET NO AUTH LOW CX NO UI | A low-privileged remote attacker can send Modbus packets to manipulate register | |
|
77
|
CVE-2026-54603 |
8.6 | 0.0045 | NET NO AUTH LOW CX NO UI | OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, inc | |
|
77
|
CVE-2026-61576 |
8.3 | 0.0045 | NET NO AUTH LOW CX NO UI | Lightdash is an open source business intelligence platform. In affected versions | |
|
77
|
CVE-2026-58067 |
8.7 | 0.0045 | NET NO AUTH LOW CX NO UI | A vulnerability in Veeam Service Provider Console allowing an unauthenticated at | |
|
77
|
CVE-2019-25779 |
8.7 | 0.0045 | NET NO AUTH LOW CX NO UI | WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows u | |
|
75
|
CVE-2026-47204 |
7.5 | 0.0045 | NET NO AUTH LOW CX NO UI | Envoy is an open source edge and service proxy designed for cloud-native applica | |
|
75
|
CVE-2026-19630 |
7.5 | 0.0045 | NET NO AUTH LOW CX NO UI | In a BIND resolver, inbound DNS protocol messages with a particular structure wi | |
|
75
|
CVE-2026-97313 |
7.5 | 0.0045 | NET NO AUTH LOW CX NO UI | A recursive BIND server that receives a query with recursion desired (RD=1) foll | |
|
75
|
CVE-2026-33521 |
7.5 | 0.0045 | NET NO AUTH LOW CX NO UI | There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 a | |
|
75
|
CVE-2026-33750 |
7.5 | 0.0045 | NET NO AUTH LOW CX NO UI | The brace-expansion library generates arbitrary strings containing a common pref | |
|
75
|
CVE-2026-34487 |
7.5 | 0.0045 | NET NO AUTH LOW CX NO UI | Insertion of Sensitive Information into Log File vulnerability in the cloud memb | |
|
68
|
CVE-2026-113101 |
8.8 | 0.0045 | NET NO AUTH LOW CX | Use after free in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed | |
|
68
|
CVE-2026-72772 |
8.9 | 0.0045 | NET LOW CX NO UI | n8n before 2.32.1 (and before 2.31.5) is vulnerable to account takeover via the | |
|
68
|
CVE-2026-34058 |
8.8 | 0.0045 | NET LOW CX NO UI | Coolify is an open-source and self-hostable tool for managing servers, applicati | |
|
68
|
CVE-2026-17712 |
8.8 | 0.0045 | NET NO AUTH LOW CX | Race in Skia in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote att | |
|
68
|
CVE-2026-10572 |
8.8 | 0.0045 | NET LOW CX NO UI | IBM MQ could allow an authenticated attacker to cause a denial of service or pot | |
|
68
|
CVE-2026-47025 |
8.8 | 0.0045 | NET LOW CX NO UI | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utilit | |
|
68
|
CVE-2026-87359 |
8.8 | 0.0045 | NET LOW CX NO UI | Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (com | |
|
68
|
CVE-2026-64138 |
8.8 | 0.0045 | NET LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ksmbd: vali | |
|
68
|
CVE-2026-68098 |
8.8 | 0.0045 | NET LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ksmbd: boun | |
|
67
|
CVE-2026-120311 |
8.7 | 0.0045 | NET LOW CX NO UI | Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in | |
|
67
|
CVE-2026-120312 |
8.7 | 0.0045 | NET LOW CX NO UI | Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in | |
|
67
|
CVE-2026-59712 |
8.6 | 0.0045 | NET LOW CX NO UI | Leantime's Users::getUser method in the JSON-RPC API lacks proper authorization | |
|
65
|
CVE-2026-47164 |
7.7 | 0.0045 | NET NO AUTH NO UI | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, V | |
|
65
|
CVE-2026-53994 |
7.7 | 0.0045 | NET LOW CX NO UI | ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authentic | |
|
65
|
CVE-2024-1249 |
7.4 | 0.0045 | NET NO AUTH LOW CX | A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which a | |
|
65
|
CVE-2026-62217 |
7.7 | 0.0045 | NET LOW CX NO UI | OpenClaw 2026.5.14-beta.1 before 2026.5.27 contain an authorization flaw in the | |
|
65
|
CVE-2026-65016 |
7.7 | 0.0045 | NET LOW CX NO UI | n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation | |
|
64
|
CVE-2026-59207 |
7.1 | 0.0045 | NET LOW CX NO UI | n8n is an open source workflow automation platform. Prior to 2.27.4 and 2.28.1, | |
|
64
|
CVE-2026-98169 |
7.1 | 0.0045 | NET NO AUTH LOW CX | In the Linux kernel, the following vulnerability has been resolved: smb: client | |
|
59
|
CVE-2026-25700 |
7.2 | 0.0045 | NET LOW CX NO UI | Improper Restriction of Security Token Assignment vulnerability in Apache Answer |