Hunt List
13,021 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-112862 |
9.8 | 0.0041 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data vulnerability in xnau webdesign Participants D | |
|
80
|
CVE-2026-112853 |
9.8 | 0.0041 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallel | |
|
80
|
CVE-2026-112857 |
9.8 | 0.0041 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo a | |
|
80
|
CVE-2026-115968 |
9.8 | 0.0041 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Memb | |
|
80
|
CVE-2026-119526 |
9.8 | 0.0041 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows O | |
|
80
|
CVE-2026-39738 |
9.8 | 0.0041 | NET NO AUTH LOW CX NO UI | Deserialization of Untrusted Data vulnerability in Aman FunnelKit Automations wp | |
|
80
|
CVE-2026-64136 |
9.8 | 0.0041 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: smb: client | |
|
79
|
CVE-2026-47172 |
9.5 | 0.0041 | NET NO AUTH LOW CX NO UI | Quest Bot is an opensource modern Discord Bot built for moderation, utilities an | |
|
78
|
CVE-2026-68586 |
9.2 | 0.0041 | NET NO AUTH LOW CX NO UI | SiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc | |
|
78
|
CVE-2026-63158 |
9.1 | 0.0041 | NET NO AUTH LOW CX NO UI | Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnera | |
|
78
|
CVE-2026-47171 |
8.8 | 0.0041 | NET NO AUTH LOW CX NO UI | Quest Bot is an opensource modern Discord Bot built for moderation, utilities an | |
|
78
|
CVE-2026-91341 |
9.1 | 0.0041 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl | |
|
77
|
CVE-2026-44232 |
8.7 | 0.0041 | NET NO AUTH LOW CX NO UI | DSSRF is a Node.js library that provides a wide range of utilities and advanced | |
|
77
|
CVE-2026-85612 |
8.7 | 0.0041 | NET NO AUTH LOW CX NO UI | OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery v | |
|
77
|
CVE-2026-116741 |
8.3 | 0.0041 | NET NO AUTH LOW CX NO UI | Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnerability in | |
|
77
|
CVE-2026-63637 |
8.6 | 0.0041 | NET NO AUTH LOW CX NO UI | Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuo | |
|
77
|
CVE-2024-58276 |
8.7 | 0.0041 | NET NO AUTH LOW CX NO UI | Obi08/Enrollment System 1.0 contains a SQL injection vulnerability in the keywor | |
|
76
|
CVE-2026-91252 |
8.2 | 0.0041 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Servic | |
|
75
|
CVE-2026-57487 |
7.5 | 0.0041 | NET NO AUTH LOW CX NO UI | pupnp is an SDK for development of UPnP device and control point applications. P | |
|
75
|
CVE-2026-0828 |
7.5 | 0.0041 | NET NO AUTH LOW CX NO UI | Kernel driver ProcessMonitorDriver.sys in Safetica's endpoint client x64 , versi | |
|
75
|
CVE-2026-91542 |
7.5 | 0.0041 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware | |
|
75
|
CVE-2026-91552 |
7.5 | 0.0041 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware | |
|
75
|
CVE-2026-34839 |
7.7 | 0.0041 | NET NO AUTH LOW CX NO UI | Glances is an open-source system cross-platform monitoring tool. Prior to versio | |
|
74
|
CVE-2026-120114 |
7.2 | 0.0041 | NET NO AUTH LOW CX NO UI | The Debug Log Manager – Conveniently Monitor and Inspect Errors plugin for WordP | |
|
70
|
CVE-2026-47365 |
9.9 | 0.0041 | NET LOW CX NO UI | Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in c | |
|
70
|
CVE-2026-76531 |
9.9 | 0.0041 | NET LOW CX NO UI | As part of Cisco's ongoing commitment to proactive security and product quality, | |
|
68
|
CVE-2026-40066 |
8.8 | 0.0041 | NET LOW CX NO UI | Anviz CX2 Lite and CX7 are vulnerable to unverified update packages that can be | |
|
68
|
CVE-2026-112380 |
9.0 | 0.0041 | NET LOW CX NO UI | Missing authorization in the WhatsApp group channel in Kiro Crew might allow a r | |
|
68
|
CVE-2026-103092 |
8.8 | 0.0041 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacke | |
|
67
|
CVE-2026-67428 |
8.5 | 0.0041 | NET LOW CX NO UI | Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior | |
|
67
|
CVE-2026-27928 |
8.7 | 0.0041 | NET NO AUTH NO UI | Improper input validation in Windows Hello allows an unauthorized attacker to by | |
|
67
|
CVE-2026-34430 |
8.6 | 0.0041 | NET NO AUTH LOW CX | ByteDance DeerFlow versions prior to commit 92c7a20 contain a sandbox escape vul | |
|
66
|
CVE-2026-101771 |
8.1 | 0.0041 | NET NO AUTH NO UI | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon | |
|
66
|
CVE-2026-101772 |
8.1 | 0.0041 | NET NO AUTH NO UI | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon | |
|
64
|
CVE-2026-5966 |
7.2 | 0.0041 | NET LOW CX NO UI | ThreatSonar Anti-Ransomware developed by TeamT5 has an Arbitrary File Deletion v | |
|
64
|
CVE-2026-115580 |
7.1 | 0.0041 | NET NO AUTH LOW CX | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an att | |
|
64
|
CVE-2026-115585 |
7.1 | 0.0041 | NET NO AUTH LOW CX | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an inc | |
|
64
|
CVE-2026-60032 |
9.4 | 0.0041 | NET LOW CX NO UI | Joomla Extension - themexpert.com - Authenticated arbitrary file upload in JMedi | |
|
64
|
CVE-2026-57321 |
7.1 | 0.0041 | NET LOW CX NO UI | Contributor Arbitrary File Deletion in H5P <= 1.17.7 versions. | |
|
64
|
CVE-2026-57346 |
7.1 | 0.0041 | NET LOW CX NO UI | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v | |
|
64
|
CVE-2026-57696 |
7.1 | 0.0041 | NET LOW CX NO UI | Contributor Arbitrary File Deletion in Picture Gallery <= 1.6.5 versions. | |
|
64
|
CVE-2026-40251 |
7.1 | 0.0041 | NET LOW CX NO UI | Incus is a system container and virtual machine manager. In versions before 7.0. | |
|
62
|
CVE-2026-23899 |
8.6 | 0.0041 | NET LOW CX NO UI | An improper access check allows unauthorized access to webservice endpoints. | |
|
62
|
CVE-2026-60941 |
8.7 | 0.0041 | NET LOW CX NO UI | Vulnerability in the Oracle Service Fulfillment Manager product of Oracle E-Busi | |
|
62
|
CVE-2026-60707 |
8.7 | 0.0041 | NET LOW CX NO UI | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware | |
|
62
|
CVE-2026-60996 |
8.7 | 0.0041 | NET LOW CX NO UI | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion | |
|
62
|
CVE-2026-61332 |
8.7 | 0.0041 | NET LOW CX NO UI | Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM | |
|
62
|
CVE-2026-62607 |
8.7 | 0.0041 | NET LOW CX NO UI | Vulnerability in the Oracle Customer Care product of Oracle E-Business Suite (co | |
|
62
|
CVE-2026-71050 |
8.7 | 0.0041 | NET LOW CX NO UI | Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply | |
|
55
|
CVE-2026-28157 |
7.5 | 0.0041 | NET NO UI | Subscriber Path Traversal in Do Lasso <= 358 versions. |