Hunt List
13,195 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-87337 |
10.0 | 0.0044 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware ( | |
|
80
|
CVE-2026-6510 |
9.8 | 0.0044 | NET NO AUTH LOW CX NO UI | The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation vi | |
|
80
|
CVE-2026-41070 |
10.0 | 0.0044 | NET NO AUTH LOW CX NO UI | openvpn-auth-oauth2 is a plugin/management interface client for OpenVPN server t | |
|
80
|
CVE-2025-65358 |
9.8 | 0.0044 | NET NO AUTH LOW CX NO UI | Edoc-doctor-appointment-system v1.0.1 was discovered to contain SQl injection vu | |
|
80
|
CVE-2026-45060 |
9.8 | 0.0044 | NET NO AUTH LOW CX NO UI | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - | |
|
79
|
CVE-2026-109566 |
9.3 | 0.0044 | NET NO AUTH LOW CX NO UI | Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerabi | |
|
78
|
CVE-2026-111633 |
8.8 | 0.0044 | NET NO AUTH LOW CX NO UI | ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows | |
|
78
|
CVE-2026-24611 |
9.1 | 0.0044 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Access Control in MetForm Pro <= 3.9.1 versions. | |
|
78
|
CVE-2026-12694 |
9.1 | 0.0044 | NET NO AUTH LOW CX NO UI | Missing Authorization vulnerability in Vimesoft Inc. Enterprise Video Platform a | |
|
77
|
CVE-2026-115352 |
8.7 | 0.0044 | NET NO AUTH LOW CX NO UI | Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inl | |
|
77
|
CVE-2026-76490 |
8.6 | 0.0044 | NET NO AUTH LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
77
|
CVE-2026-0621 |
8.7 | 0.0044 | NET NO AUTH LOW CX NO UI | Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a reg | |
|
77
|
CVE-2026-115348 |
8.7 | 0.0044 | NET NO AUTH LOW CX NO UI | Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability | |
|
77
|
CVE-2026-101688 |
8.6 | 0.0044 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of O | |
|
77
|
CVE-2026-44593 |
8.7 | 0.0044 | NET NO AUTH LOW CX NO UI | esm.sh is a no-build content delivery network (CDN) for web development. In 137 | |
|
77
|
CVE-2026-60293 |
8.6 | 0.0044 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware | |
|
76
|
CVE-2026-8726 |
8.2 | 0.0044 | NET NO AUTH LOW CX NO UI | The extension fails to properly sanitize user input before using it in a databas | |
|
76
|
CVE-2026-21579 |
8.2 | 0.0044 | NET NO AUTH LOW CX NO UI | This High severity Information Disclosure vulnerability was introduced in versio | |
|
76
|
CVE-2026-12722 |
8.2 | 0.0044 | NET NO AUTH LOW CX NO UI | Missing authentication for critical function vulnerability in FTC Software IT Se | |
|
75
|
CVE-2026-16374 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | Information disclosure in the Framework component in DevTools. This vulnerabilit | |
|
75
|
CVE-2026-16391 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | Information disclosure in the Storage: IndexedDB component. This vulnerability w | |
|
75
|
CVE-2026-16405 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | Information disclosure in the Networking: WebSockets component. This vulnerabili | |
|
75
|
CVE-2026-14861 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | The User Verification by PickPlugins WordPress plugin through 2.0.47 does not ve | |
|
75
|
CVE-2025-66236 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | Before Airflow 3.2.0, it was unclear that secure Airflow deployments require the | |
|
75
|
CVE-2026-77646 |
7.7 | 0.0044 | NET NO AUTH LOW CX NO UI | A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Wind | |
|
75
|
CVE-2026-28925 |
7.5 | 0.0044 | NET NO AUTH LOW CX NO UI | A buffer overflow was addressed with improved bounds checking. This issue is fix | |
|
70
|
CVE-2026-47752 |
9.9 | 0.0044 | NET LOW CX NO UI | Tugtainer is a self-hosted app for automating updates of Docker containers. Vers | |
|
69
|
CVE-2026-17718 |
9.6 | 0.0044 | NET NO AUTH LOW CX | Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote | |
|
69
|
CVE-2026-17721 |
9.6 | 0.0044 | NET NO AUTH LOW CX | Out of bounds write in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a r | |
|
68
|
CVE-2026-44271 |
8.8 | 0.0044 | NET LOW CX NO UI | Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Imprope | |
|
68
|
CVE-2026-44272 |
8.8 | 0.0044 | NET LOW CX NO UI | Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Imprope | |
|
68
|
CVE-2026-12161 |
8.8 | 0.0044 | NET LOW CX NO UI | Improper input validation in the SSH Elevate Shell feature allows an authenticat | |
|
68
|
CVE-2026-39386 |
8.8 | 0.0044 | NET LOW CX NO UI | Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC In v | |
|
68
|
CVE-2026-10574 |
8.8 | 0.0044 | NET LOW CX NO UI | IBM MQ could allow an authenticated attacker to cause a denial of service or pot | |
|
67
|
CVE-2026-40876 |
8.7 | 0.0044 | NET LOW CX NO UI | goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains | |
|
67
|
CVE-2026-19433 |
8.6 | 0.0044 | NET LOW CX NO UI | Authorization Bypass Through User-Controlled Key in the contact management compo | |
|
67
|
CVE-2026-19539 |
8.6 | 0.0044 | NET LOW CX NO UI | Authorization Bypass Through User-Controlled Key in the ticket management compon | |
|
67
|
CVE-2026-114716 |
8.5 | 0.0044 | NET LOW CX NO UI | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail hea | |
|
67
|
CVE-2026-35554 |
8.7 | 0.0044 | NET NO AUTH NO UI | A race condition in the Apache Kafka Java producer client’s buffer pool manageme | |
|
66
|
CVE-2026-112820 |
8.1 | 0.0044 | NET NO AUTH NO UI | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP | |
|
65
|
CVE-2026-75888 |
7.7 | 0.0044 | NET LOW CX NO UI | A flaw was found in the OpenShift console. An authenticated console user can exp | |
|
64
|
CVE-2026-119549 |
7.1 | 0.0044 | NET LOW CX NO UI | Jellyfin through 12.4 contains a server-side request forgery vulnerability that | |
|
64
|
CVE-2026-55460 |
7.1 | 0.0044 | NET LOW CX NO UI | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authentica | |
|
64
|
CVE-2026-59255 |
7.1 | 0.0044 | NET LOW CX NO UI | BloodHound through 9.4.0, fixed in commit 8f79035, contains a missing authorizat | |
|
64
|
CVE-2026-49253 |
7.1 | 0.0044 | NET NO AUTH LOW CX | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ft | |
|
64
|
CVE-2026-72774 |
7.1 | 0.0044 | NET LOW CX NO UI | n8n before 1.123.67, 2.31.5, and 2.32.1 contains a credential authorization bypa | |
|
63
|
CVE-2026-34279 |
9.1 | 0.0044 | NET LOW CX NO UI | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle E | |
|
59
|
CVE-2026-44727 |
9.3 | 0.0044 | NET LOW CX | Jupyter Server is the backend for Jupyter web applications. Prior to 2.20, the n | |
|
59
|
CVE-2026-54453 |
7.2 | 0.0044 | NET LOW CX NO UI | OpenCATS is an open-source applicant tracking system and recruitment CRM for sta | |
|
55
|
CVE-2026-35465 |
7.5 | 0.0044 | NET NO AUTH | SecureDrop Client is a desktop app for journalists to securely communicate with |