Hunt List
13,226 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-42072 |
9.8 | 0.0044 | NET NO AUTH LOW CX NO UI | Nornicdb is a distributed low-latency, Graph+Vector, Temporal MVCC with all sub- | |
|
80
|
CVE-2026-112832 |
9.8 | 0.0044 | NET NO AUTH LOW CX NO UI | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP | |
|
79
|
CVE-2026-92812 |
9.3 | 0.0044 | NET NO AUTH LOW CX NO UI | Decap CMS before 3.11.0 contains a path traversal vulnerability in the local pro | |
|
79
|
CVE-2021-48016 |
9.3 | 0.0044 | NET NO AUTH LOW CX NO UI | DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMs | |
|
78
|
CVE-2026-91265 |
9.1 | 0.0044 | NET NO AUTH LOW CX NO UI | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards | |
|
78
|
CVE-2026-91305 |
9.1 | 0.0044 | NET NO AUTH LOW CX NO UI | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards | |
|
78
|
CVE-2026-33805 |
9.0 | 0.0044 | NET NO AUTH LOW CX NO UI | @fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earl | |
|
78
|
CVE-2026-18753 |
9.1 | 0.0044 | NET NO AUTH LOW CX NO UI | The product firmware contains an embedded, static RSA private key utilized by th | |
|
78
|
CVE-2026-18754 |
9.1 | 0.0044 | NET NO AUTH LOW CX NO UI | The product firmware contains an embedded, static RSA private key utilized by th | |
|
78
|
CVE-2026-71238 |
9.1 | 0.0044 | NET NO AUTH LOW CX NO UI | DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed w | |
|
78
|
CVE-2026-94423 |
9.1 | 0.0044 | NET NO AUTH LOW CX NO UI | Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server | |
|
77
|
CVE-2026-76597 |
8.7 | 0.0044 | NET NO AUTH LOW CX NO UI | Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web r | |
|
77
|
CVE-2026-76066 |
8.7 | 0.0044 | NET NO AUTH LOW CX NO UI | IntentKit through 2.6.3, fixed in commit 5b91da5, contains an authorization bypa | |
|
77
|
CVE-2026-16731 |
8.3 | 0.0044 | NET NO AUTH LOW CX NO UI | OMICRON StationScout before version 3.05 contains a cryptographic timing side-ch | |
|
77
|
CVE-2026-18697 |
8.7 | 0.0044 | NET NO AUTH LOW CX NO UI | An issue in MongoDB Server's aggregation framework could allow an unauthenticate | |
|
75
|
CVE-2026-0669 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v | |
|
75
|
CVE-2026-45047 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | bird-lg-go is a BIRD looking glass in Go. Prior to 1.4.5, the apiHandler (and si | |
|
75
|
CVE-2026-12707 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | Summary Cloudflare quiche was discovered to be vulnerable to memory resource | |
|
75
|
CVE-2026-87369 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (com | |
|
75
|
CVE-2026-87395 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl | |
|
75
|
CVE-2026-91254 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel | |
|
75
|
CVE-2026-91255 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel | |
|
75
|
CVE-2026-91344 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl | |
|
75
|
CVE-2026-91345 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl | |
|
75
|
CVE-2026-91350 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl | |
|
75
|
CVE-2025-66735 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | youlai-boot V2.21.1 is vulnerable to Incorrect Access Control. The getRoleForm f | |
|
75
|
CVE-2026-28943 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | A logging issue was addressed with improved data redaction. This issue is fixed | |
|
75
|
CVE-2026-28987 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | A logging issue was addressed with improved data redaction. This issue is fixed | |
|
75
|
CVE-2026-8396 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | Improper restriction of XML external entity reference vulnerability in Netcad So | |
|
75
|
CVE-2026-6554 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a sig | |
|
75
|
CVE-2026-20236 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
75
|
CVE-2026-20356 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
75
|
CVE-2026-114144 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.par | |
|
68
|
CVE-2026-40350 |
8.8 | 0.0044 | NET LOW CX NO UI | Movary is a self hosted web app to track and rate a user's watched movies. Prior | |
|
68
|
CVE-2026-6859 |
8.8 | 0.0044 | NET NO AUTH LOW CX | A flaw was found in InstructLab. The `linux_train.py` script hardcodes `trust_re | |
|
68
|
CVE-2026-35265 |
8.8 | 0.0044 | NET LOW CX NO UI | Vulnerability in the Identity Manager product of Oracle Fusion Middleware (compo | |
|
68
|
CVE-2026-35267 |
8.8 | 0.0044 | NET LOW CX NO UI | Vulnerability in the Identity Manager product of Oracle Fusion Middleware (compo | |
|
68
|
CVE-2026-34057 |
8.8 | 0.0044 | NET LOW CX NO UI | Coolify is an open-source and self-hostable tool for managing servers, applicati | |
|
68
|
CVE-2026-56828 |
8.8 | 0.0044 | NET LOW CX NO UI | Shopper is a Headless e-commerce Admin Panel. From 2.8.0 until 2.8.1, three Shop | |
|
68
|
CVE-2026-32171 |
8.8 | 0.0044 | NET LOW CX NO UI | Insufficiently protected credentials in Azure Logic Apps allows an authorized at | |
|
67
|
CVE-2026-65049 |
8.4 | 0.0044 | NET NO AUTH LOW CX | Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an | |
|
66
|
CVE-2026-54409 |
8.1 | 0.0044 | NET NO AUTH NO UI | A malicious actor with access to the network and under certain conditions could | |
|
66
|
CVE-2026-57202 |
8.1 | 0.0044 | NET LOW CX NO UI | Asterisk is an open source private branch exchange and telephony toolkit. Prior | |
|
66
|
CVE-2026-103898 |
8.1 | 0.0044 | NET NO AUTH NO UI | The Wp Social Login and Register Social Counter plugin for WordPress is vulnerab | |
|
64
|
CVE-2026-88891 |
7.2 | 0.0044 | NET LOW CX NO UI | OpenPanel through 2.3.0 fails to enforce read-only project access level on 26 of | |
|
64
|
CVE-2026-58213 |
7.1 | 0.0044 | NET LOW CX NO UI | NATS Server is a high-performance server for NATS.io, the cloud and edge native | |
|
63
|
CVE-2026-5652 |
9.0 | 0.0044 | NET LOW CX NO UI | An insecure direct object reference vulnerability in the Users API component of | |
|
59
|
CVE-2026-24504 |
7.2 | 0.0044 | NET LOW CX NO UI | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release ver | |
|
57
|
CVE-2026-79881 |
8.3 | 0.0044 | NET NO AUTH | An authentication bypass vulnerability in the underlying operating system of AOS | |
|
55
|
CVE-2026-62999 |
7.5 | 0.0044 | NET NO AUTH | Copier is a library and CLI app for rendering project templates. From 9.5.0 thro |