Hunt List
12,995 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
79
|
CVE-2026-25775 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | A vulnerability in SenseLive X3050’s remote management service allows firmware r | |
|
79
|
CVE-2026-111732 |
9.3 | 0.0040 | NET NO AUTH LOW CX NO UI | P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses | |
|
78
|
CVE-2026-46809 |
9.1 | 0.0040 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware | |
|
78
|
CVE-2026-46930 |
9.1 | 0.0040 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle In-Memory Cost Management for Discrete Industries pr | |
|
78
|
CVE-2026-46949 |
9.1 | 0.0040 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Busi | |
|
78
|
CVE-2026-15089 |
9.1 | 0.0040 | NET NO AUTH LOW CX NO UI | Vulnerability in Drupal Commerce guest registration. This issue affects Commerce | |
|
78
|
CVE-2026-62414 |
9.1 | 0.0040 | NET NO AUTH LOW CX NO UI | Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3. | |
|
78
|
CVE-2026-14804 |
9.1 | 0.0040 | NET NO AUTH LOW CX NO UI | Use of hard-coded cryptographic key vulnerability in Bilin Software and Informat | |
|
77
|
CVE-2026-60030 |
8.7 | 0.0041 | NET NO AUTH LOW CX NO UI | Joomla Extension - themexpert.com - Broken Access Control for media management i | |
|
77
|
CVE-2026-47662 |
8.7 | 0.0041 | NET NO AUTH LOW CX NO UI | Pathling is a set of tools that make it easier to use FHIR and clinical terminol | |
|
77
|
CVE-2026-47663 |
8.7 | 0.0041 | NET NO AUTH LOW CX NO UI | Pathling is a set of tools that make it easier to use FHIR and clinical terminol | |
|
77
|
CVE-2026-73160 |
8.7 | 0.0041 | NET NO AUTH LOW CX NO UI | Affected versions of cti-transmute contain an SSRF vulnerability in the /fetch_m | |
|
77
|
CVE-2026-76596 |
8.7 | 0.0041 | NET NO AUTH LOW CX NO UI | Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doem | |
|
77
|
CVE-2026-76599 |
8.7 | 0.0041 | NET NO AUTH LOW CX NO UI | Joomla Extension - fabrikar.com - Unauthenticated database table list and table- | |
|
77
|
CVE-2026-67425 |
8.6 | 0.0041 | NET NO AUTH LOW CX NO UI | Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior | |
|
77
|
CVE-2026-73247 |
8.6 | 0.0041 | NET NO AUTH LOW CX NO UI | Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, K | |
|
77
|
CVE-2026-33445 |
8.7 | 0.0040 | NET NO AUTH LOW CX NO UI | CVE-2026-33445 is a memory management vulnerability in Secure Access servers pri | |
|
77
|
CVE-2026-114063 |
8.7 | 0.0040 | NET NO AUTH LOW CX NO UI | SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vul | |
|
77
|
CVE-2026-118660 |
8.6 | 0.0040 | NET NO AUTH LOW CX NO UI | Happy DOM is a JavaScript implementation of a web browser without its graphical | |
|
76
|
CVE-2026-33794 |
8.2 | 0.0040 | NET NO AUTH LOW CX NO UI | An Improper Check for Unusual or Exceptional Conditions vulnerability in the a | |
|
76
|
CVE-2026-57022 |
8.2 | 0.0040 | NET NO AUTH LOW CX NO UI | An Improper Check for Unusual or Exceptional Conditions vulnerability in the Pac | |
|
76
|
CVE-2026-68118 |
8.2 | 0.0040 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: tcp: challe | |
|
75
|
CVE-2026-3323 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | An unsecured configuration interface on affected devices allows unauthenticated | |
|
75
|
CVE-2026-48497 |
7.5 | 0.0040 | NET NO AUTH LOW CX NO UI | Envoy is an open source edge and service proxy designed for cloud-native applica | |
|
69
|
CVE-2026-115375 |
9.4 | 0.0040 | NET LOW CX NO UI | Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulner | |
|
69
|
CVE-2026-115377 |
9.4 | 0.0040 | NET LOW CX NO UI | Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbit | |
|
68
|
CVE-2026-112995 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in Animation in Google Chrome prior to 156.0.8078.47 allowed a re | |
|
68
|
CVE-2026-113009 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in WindowControlsOverlay in Google Chrome prior to 156.0.8078.47 | |
|
68
|
CVE-2026-113141 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Use after free in Transactions Platform in Google Chrome prior to 156.0.8078.47 | |
|
68
|
CVE-2026-113146 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Memory corruption in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 all | |
|
68
|
CVE-2026-113220 |
8.8 | 0.0041 | NET NO AUTH LOW CX | Memory corruption in Extensions in Google Chrome on on Android prior to 156.0.80 | |
|
68
|
CVE-2026-13072 |
9.2 | 0.0040 | NET NO AUTH NO UI | When compute mode is enabled on a standalone mongod instance, insufficient valid | |
|
68
|
CVE-2026-119568 |
9.1 | 0.0040 | NET NO AUTH NO UI | vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data | |
|
68
|
CVE-2026-113175 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Improper input validation in FileSystem in Google Chrome prior to 156.0.8078.47 | |
|
68
|
CVE-2026-113176 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Memory corruption in Omnibox in Google Chrome prior to 156.0.8078.47 allowed a r | |
|
68
|
CVE-2026-113177 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Use after free in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a r | |
|
68
|
CVE-2026-113200 |
8.8 | 0.0040 | NET NO AUTH LOW CX | Use after free in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote | |
|
67
|
CVE-2026-62143 |
8.3 | 0.0040 | NET LOW CX NO UI | A Server-Side Request Forgery (SSRF) protection bypass existed in the html_to_ma | |
|
66
|
CVE-2026-42411 |
8.1 | 0.0040 | NET NO AUTH NO UI | Unauthenticated Broken Authentication in CloudSecure WP Security <= 1.4.7 versio | |
|
66
|
CVE-2026-49213 |
8.1 | 0.0040 | NET LOW CX NO UI | TypeBot is a chatbot builder tool. Prior to 3.17.2, Typebot's shared SSRF valida | |
|
66
|
CVE-2026-10547 |
8.1 | 0.0040 | NET LOW CX NO UI | IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate ownership in th | |
|
66
|
CVE-2026-57113 |
8.1 | 0.0040 | NET NO AUTH LOW CX | PraisonAI is a multi-agent teams system. From version 2.6.0 to before version 4. | |
|
65
|
CVE-2026-92203 |
7.7 | 0.0041 | NET LOW CX NO UI | Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forger | |
|
65
|
CVE-2026-103314 |
7.4 | 0.0040 | NET NO AUTH NO UI | A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Th | |
|
64
|
CVE-2026-18690 |
7.2 | 0.0041 | NET LOW CX NO UI | An issue in MongoDB Server could allow an authenticated user with a limited data | |
|
64
|
CVE-2026-76164 |
7.1 | 0.0040 | NET LOW CX NO UI | AIL Framework contains a server-side request forgery (SSRF) vulnerability in its | |
|
58
|
CVE-2026-19002 |
8.8 | 0.0040 | NET NO AUTH | A missing bounds check when parsing stored procedure parameter metadata in the M | |
|
57
|
CVE-2026-65986 |
8.5 | 0.0040 | NET LOW CX | CVAT is an open source interactive video and image annotation tool for computer | |
|
57
|
CVE-2026-85886 |
8.5 | 0.0040 | NET NO UI | Heap-based buffer overflow in SQL Server allows an authorized attacker to execut | |
|
54
|
CVE-2026-9588 |
7.0 | 0.0040 | NET LOW CX | A stored cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SM |