Hunt List
13,093 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-29198 |
9.8 | 0.0042 | NET NO AUTH LOW CX NO UI | In Rocket.Chat <8.3.0, <8.2.1, <8.1.2, <8.0.3, <7.13.5, <7.12.6, <7.11.6, and <7 | |
|
80
|
CVE-2026-57116 |
9.8 | 0.0042 | NET NO AUTH LOW CX NO UI | PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4. | |
|
80
|
CVE-2026-65184 |
9.8 | 0.0042 | NET NO AUTH LOW CX NO UI | The root-privileged `wsserver` terminal-bridge daemon builds a shell command fro | |
|
78
|
CVE-2026-35615 |
9.2 | 0.0042 | NET NO AUTH LOW CX NO UI | PraisonAI is a multi-agent teams system. Prior to 1.5.113, _validate_path() call | |
|
78
|
CVE-2026-28698 |
9.2 | 0.0042 | NET NO AUTH LOW CX NO UI | Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive sys | |
|
78
|
CVE-2026-87302 |
9.1 | 0.0042 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware | |
|
78
|
CVE-2026-91225 |
9.1 | 0.0042 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo | |
|
77
|
CVE-2026-54417 |
8.7 | 0.0042 | NET NO AUTH LOW CX NO UI | An integer overflow in the mtar_next function in src/microtar.c in rxi microtar | |
|
77
|
CVE-2026-62160 |
8.7 | 0.0042 | NET NO AUTH LOW CX NO UI | Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the global `Languag | |
|
77
|
CVE-2026-59499 |
8.6 | 0.0042 | NET NO AUTH LOW CX NO UI | : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pr | |
|
76
|
CVE-2026-48145 |
8.2 | 0.0042 | NET NO AUTH LOW CX NO UI | Improper Validation of Certificate with Host Mismatch vulnerability in Apache Th | |
|
76
|
CVE-2026-35149 |
8.2 | 0.0042 | NET NO AUTH LOW CX NO UI | HCL DFXServer is affected by an Authentication Bypass vulnerability via server r | |
|
75
|
CVE-2026-16378 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Other issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerabili | |
|
75
|
CVE-2026-68968 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Apache Airflow's Backfill API authorized a request against a Dag id supplied by | |
|
75
|
CVE-2026-73261 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Mongoose is an embedded web server and network library. Prior to 7.23, the built | |
|
75
|
CVE-2026-54841 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in Vitepos <= 3.4.2 versions. | |
|
75
|
CVE-2026-57912 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Johnson & Johnson Campus Recruiting before 2025-10-31 allows viewing of data pro | |
|
75
|
CVE-2026-57913 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Johnson & Johnson Audit Tracking Management System (ATMS) before 2026-04-21 allo | |
|
75
|
CVE-2026-54824 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in Ads by WPQuads <= 3.0.3 versions. | |
|
75
|
CVE-2026-54834 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in Object Cache 4 everyone <= 2.3.2 vers | |
|
75
|
CVE-2026-56060 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in Print Invoice & Delivery Notes for Wo | |
|
75
|
CVE-2026-10706 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | In Adalo’s no-code app builder, (Versions 1 and 2) the attackers may extract ful | |
|
75
|
CVE-2026-7189 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Insertion of sensitive information into sent data vulnerability in Proliz Softwa | |
|
75
|
CVE-2026-7488 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Insertion of sensitive information into sent data vulnerability in IKAS Technolo | |
|
75
|
CVE-2026-65430 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Joomla Extension - regularlabs.com - MaxMind Credential leakage in GeoIP extensi | |
|
75
|
CVE-2026-65755 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Artic | |
|
75
|
CVE-2026-59528 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates <= 1.1 | |
|
75
|
CVE-2026-59548 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Unauthenticated Sensitive Data Exposure in Byteflows Travel & Hotel Booking | |
|
75
|
CVE-2026-65881 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Joomla Extension - joomdle.com - Insecure default configuration allows read/writ | |
|
75
|
CVE-2026-65543 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions. | |
|
75
|
CVE-2026-66432 |
7.5 | 0.0042 | NET NO AUTH LOW CX NO UI | Subscriber Sensitive Data Exposure in WPJAM Basic <= 7.0.2.1 versions. | |
|
69
|
CVE-2026-46789 |
9.6 | 0.0042 | NET NO AUTH LOW CX | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
69
|
CVE-2026-70958 |
9.6 | 0.0042 | NET NO AUTH LOW CX | Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle | |
|
68
|
CVE-2026-113180 |
8.8 | 0.0042 | NET NO AUTH LOW CX | Memory corruption in ContentCapture in Google Chrome on on Android prior to 156. | |
|
68
|
CVE-2026-26178 |
8.8 | 0.0042 | NET NO AUTH LOW CX | Integer size truncation in Windows Advanced Rasterization Platform (WARP) allows | |
|
68
|
CVE-2026-60651 |
8.8 | 0.0042 | NET NO AUTH LOW CX | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar | |
|
68
|
CVE-2026-60967 |
8.8 | 0.0042 | NET NO AUTH LOW CX | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS | |
|
68
|
CVE-2026-62619 |
8.8 | 0.0042 | NET NO AUTH LOW CX | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middlewar | |
|
68
|
CVE-2026-71106 |
8.8 | 0.0042 | NET NO AUTH LOW CX | Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Ora | |
|
68
|
CVE-2026-113276 |
8.8 | 0.0042 | NET NO AUTH LOW CX | Memory corruption in Passwords in Google Chrome on on Android prior to 156.0.807 | |
|
67
|
CVE-2026-101684 |
8.3 | 0.0042 | NET LOW CX NO UI | Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of O | |
|
66
|
CVE-2026-35276 |
8.1 | 0.0042 | NET NO AUTH NO UI | Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle Peop | |
|
65
|
CVE-2026-20313 |
7.7 | 0.0042 | NET LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
64
|
CVE-2026-67621 |
7.2 | 0.0042 | NET LOW CX NO UI | Flowise through 3.1.4 contains a missing authorization vulnerability that allows | |
|
64
|
CVE-2026-114078 |
7.2 | 0.0042 | NET LOW CX NO UI | Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in Delet | |
|
59
|
CVE-2026-4116 |
7.2 | 0.0042 | NET LOW CX NO UI | Improper handling of Unicode encoding in SonicWall SMA1000 series appliances all | |
|
59
|
CVE-2026-24505 |
7.2 | 0.0042 | NET LOW CX NO UI | Dell PowerProtect Data Domain, versions 8.5 through 8.6 contain an improper inpu | |
|
58
|
CVE-2026-73329 |
9.2 | 0.0042 | NET LOW CX | CamaleonCMS contains a stored cross-site scripting vulnerability that allows aut | |
|
58
|
CVE-2026-73332 |
9.2 | 0.0042 | NET LOW CX | CamaleonCMS contains a stored cross-site scripting vulnerability in the cama_con | |
|
55
|
CVE-2026-15584 |
7.5 | 0.0042 | NET NO UI | A privilege escalation vulnerability was found in the incluster-checks tool for |