Hunt List
13,097 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-62006 |
9.8 | 0.0042 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Nuts <= 1.12 versions. | |
|
80
|
CVE-2026-62008 |
9.8 | 0.0042 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions. | |
|
80
|
CVE-2026-62012 |
9.8 | 0.0042 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions. | |
|
80
|
CVE-2026-62017 |
9.8 | 0.0042 | NET NO AUTH LOW CX NO UI | Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions. | |
|
79
|
CVE-2026-76571 |
9.3 | 0.0042 | NET NO AUTH LOW CX NO UI | Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter c | |
|
78
|
CVE-2026-65760 |
9.2 | 0.0042 | NET NO AUTH LOW CX NO UI | Joomla Extension - joomshaper.com - cross-customer order and personal informatio | |
|
78
|
CVE-2026-40289 |
9.1 | 0.0042 | NET NO AUTH LOW CX NO UI | PraisonAI is a multi-agent teams system. In versions below 4.5.139 of PraisonAI | |
|
78
|
CVE-2026-96355 |
9.1 | 0.0042 | NET NO AUTH LOW CX NO UI | Improper Neutralization of Special Elements Used in a Template Engine vulnerabil | |
|
78
|
CVE-2026-62857 |
8.8 | 0.0042 | NET NO AUTH LOW CX NO UI | Fedify is a TypeScript library for building federated server apps powered by Act | |
|
78
|
CVE-2026-71277 |
9.1 | 0.0042 | NET NO AUTH LOW CX NO UI | rust-iot-platform's AuthToken request-guard implementation (api/src/main.rs) onl | |
|
78
|
CVE-2026-101590 |
9.1 | 0.0042 | NET NO AUTH LOW CX NO UI | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: hel | |
|
78
|
CVE-2026-91265 |
9.1 | 0.0042 | NET NO AUTH LOW CX NO UI | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards | |
|
78
|
CVE-2026-91305 |
9.1 | 0.0042 | NET NO AUTH LOW CX NO UI | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards | |
|
78
|
CVE-2026-114607 |
9.1 | 0.0042 | NET NO AUTH LOW CX NO UI | Better Auth is an authentication and authorization library for TypeScript. From | |
|
78
|
CVE-2026-112709 |
9.2 | 0.0042 | NET NO AUTH LOW CX NO UI | A heap-based buffer overflow vulnerability in the Fireware OS authentication ser | |
|
78
|
CVE-2026-112710 |
9.2 | 0.0042 | NET NO AUTH LOW CX NO UI | A heap-based buffer overflow vulnerability exists in the Fireware OS authenticat | |
|
77
|
CVE-2026-41278 |
8.7 | 0.0042 | NET NO AUTH LOW CX NO UI | Flowise is a drag & drop user interface to build a customized large language mod | |
|
77
|
CVE-2026-46382 |
8.7 | 0.0042 | NET NO AUTH LOW CX NO UI | The Meeting Room Booking System (MRBS) is a PHP-based application for booking me | |
|
77
|
CVE-2026-111074 |
8.7 | 0.0042 | NET NO AUTH LOW CX NO UI | In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerabl | |
|
77
|
CVE-2026-67436 |
8.3 | 0.0042 | NET NO AUTH LOW CX NO UI | Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Na | |
|
77
|
CVE-2026-114055 |
8.7 | 0.0042 | NET NO AUTH LOW CX NO UI | vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vuln | |
|
77
|
CVE-2026-58075 |
8.7 | 0.0042 | NET NO AUTH LOW CX NO UI | A vulnerability allowing an unauthenticated attacker to read arbitrary files fro | |
|
76
|
CVE-2026-54890 |
8.2 | 0.0042 | NET NO AUTH LOW CX NO UI | Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (e | |
|
75
|
CVE-2026-119286 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3 | |
|
75
|
CVE-2026-106565 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | ImageMagick is free and open-source software used for editing and manipulating d | |
|
75
|
CVE-2026-106567 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | ImageMagick is free and open-source software used for editing and manipulating d | |
|
75
|
CVE-2026-101759 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Communications Billing and Revenue Management produc | |
|
69
|
CVE-2026-40088 |
9.6 | 0.0042 | NET NO AUTH LOW CX | PraisonAI is a multi-agent teams system. Prior to 4.5.121, the execute_command f | |
|
68
|
CVE-2026-9208 |
8.8 | 0.0042 | NET LOW CX NO UI | Tanium addressed an unauthorized code execution vulnerability in Connect. | |
|
68
|
CVE-2026-40873 |
8.9 | 0.0042 | NET NO AUTH LOW CX | mailcow: dockerized is an open source groupware/email suite based on docker. In | |
|
68
|
CVE-2026-33704 |
8.8 | 0.0042 | NET LOW CX NO UI | Chamilo LMS is a learning management system. Prior to 1.11.38, any authenticated | |
|
68
|
CVE-2026-63685 |
8.8 | 0.0042 | NET NO AUTH LOW CX | Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extensi | |
|
67
|
CVE-2026-57485 |
8.5 | 0.0042 | NET LOW CX NO UI | Stirling-PDF is a locally hosted web application that facilitates various operat | |
|
67
|
CVE-2026-115331 |
8.7 | 0.0042 | NET LOW CX NO UI | Lotus through 0.10.2 contains an sql injection vulnerability that allows authent | |
|
66
|
CVE-2026-13787 |
8.1 | 0.0042 | NET NO AUTH NO UI | Use after free in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 | |
|
66
|
CVE-2026-61160 |
8.1 | 0.0042 | NET LOW CX NO UI | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience | |
|
66
|
CVE-2026-115546 |
8.1 | 0.0042 | NET NO AUTH NO UI | Okta Access Gateway (OAG) does not validate the selected authentication source d | |
|
64
|
CVE-2026-56789 |
7.1 | 0.0042 | NET NO AUTH LOW CX | RTKLIB through 2.4.3 contains a heap buffer overflow vulnerability in the readrn | |
|
64
|
CVE-2026-13077 |
7.1 | 0.0042 | NET LOW CX NO UI | A missing bounds check in the BSON CodeWScope element accessors allows an attack | |
|
64
|
CVE-2026-48798 |
7.1 | 0.0042 | NET NO AUTH LOW CX | SSH.NET is a Secure Shell (SSH) library for .NET. In 2025.1.0 and earlier, ScpCl | |
|
64
|
CVE-2026-115457 |
7.1 | 0.0042 | NET NO AUTH LOW CX | baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and | |
|
64
|
CVE-2026-57032 |
7.1 | 0.0042 | NET LOW CX NO UI | An Improper Handling of Undefined Parameters vulnerability in the packet forward | |
|
64
|
CVE-2026-60176 |
7.1 | 0.0042 | NET LOW CX NO UI | Vulnerability in the Oracle Payments product of Oracle E-Business Suite (compone | |
|
64
|
CVE-2026-13071 |
7.1 | 0.0042 | NET LOW CX NO UI | An authenticated user with read access can cause the mongod process to be termin | |
|
64
|
CVE-2026-13075 |
7.1 | 0.0042 | NET LOW CX NO UI | An authenticated user can cause the mongod process to be terminated by the opera | |
|
64
|
CVE-2026-13076 |
7.1 | 0.0042 | NET LOW CX NO UI | An authenticated user can cause a {{mongod}} process to be terminated by the ope | |
|
64
|
CVE-2026-9737 |
7.1 | 0.0042 | NET LOW CX NO UI | During query planning when reading the sort pattern in raw BSONObj form, in some | |
|
64
|
CVE-2026-18888 |
7.1 | 0.0042 | NET LOW CX NO UI | The MongoDB BI Connector ODBC Driver converts floating point column values into | |
|
55
|
CVE-2026-28039 |
7.5 | 0.0042 | NET NO AUTH | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP | |
|
55
|
CVE-2026-87696 |
7.5 | 0.0042 | NET NO UI | Improper verification of cryptographic signature in Microsoft Exchange Server al |